Open Trust Center by Ettic

A self-hosted, open-source trust center plugin for WordPress.

Publish security policies, subprocessors, certifications, and data practices on your own site, with an optional AI assistant grounded in your policies.

---

Open Trust Center by Ettic is a self-hosted, open-source trust center for WordPress. Procurement teams want a URL they can read. Buyers want receipts. Auditors want a version trail. Open Trust Center by Ettic gives you all three on a branded page that lives on your own WordPress site.

What's inside

• Security policies with auto-incrementing version numbers and archived revisions reachable at stable URLs (/trust-center/policy/{slug}/version/{n}/).
• Subprocessors with pre-filled metadata for 200+ common cloud vendors and SaaS providers.
• Compliance certifications with status badges (active, in progress, expired) and a bundled catalog covering SOC 2, ISO 27001, ISO 27701, HIPAA, PCI-DSS, and others.
• Data practices organised by category — the full GDPR Article 30 surface, made public.
• FAQ seeded with sensible defaults; edit, add, or remove freely.
• Contact & DPO block with company description, DPO name and email, security contact, mailing address, PGP key URL, company registration, VAT/Tax ID. Renders only fields you populate.
• Optional AI chat powered by Anthropic, OpenAI, or OpenRouter — agentic retrieval, inline citations, token budgets, rate limits.

Install

From WordPress.org: coming soon at https://wordpress.org/plugins/open-trust-center-by-ettic/ (currently in review).

Manually:

1. Download the latest release from Releases.
2. WP Admin → Plugins → Add New → Upload Plugin → upload the zip → Activate.
3. Visit Open Trust Center in the admin sidebar to set your accent colour, logo, and company name.
4. Add content under Open Trust Center → Policies / Certifications / Subprocessors / Data Practices.
5. Visit /trust-center/ on your site.

AI chat

Add an optional chat assistant that answers visitor questions straight from your published trust center. Ask it "Where is our data hosted?" or "Are you SOC 2 certified?" and it searches your policies, certifications, subprocessors, and data practices, then answers with citations linking back to the exact source.

It only ever answers from what you've published — it can't retrieve a document you haven't given it, so it won't invent policy you don't have. Anthropic is the recommended provider because it returns native, verifiable citations; OpenAI and OpenRouter also work, using inline citation markers.

To turn it on:

1. Open Trust Center → Settings → AI Chat
2. Pick a provider, paste an API key (encrypted at rest with libsodium before it touches the database), and pick a model.
3. Set the daily/monthly token budgets you're comfortable with.
4. Optional: enable Cloudflare Turnstile in the same tab for bot defence.
5. Visit /trust-center/ask/.

There's no SaaS subscription. You only pay your AI provider for tokens consumed (~$3–$15/month for typical traffic, hard ceilings at 500K tokens/day and 10M tokens/month by default).

Privacy by design

• Zero telemetry, zero analytics, zero licence checks. The only outbound HTTP calls the plugin can make are AI provider requests you configure, and they go through an SSRF host allowlist.
• No PII in logs. The optional wp_ettic_otc_chat_log table stores only short hashed identifiers — never raw IPs, emails, sessions, user agents, or referrers. The privacy posture is enforced by the schema itself.
• Encrypted secrets. API keys and the Cloudflare Turnstile secret are encrypted at rest with libsodium secretbox, salted from wp_salt('auth'). Rotating AUTH_KEY invalidates every stored secret atomically.
• Theme-isolated rendering. The trust center intercepts at template_redirect, outputs a complete standalone HTML document with inlined CSS, and exits. Your theme's stylesheet, header, footer, and JavaScript never load.
• Capability-checked admin actions with nonce verification on every save handler.

Stack

• PHP 8.1+ (strict types, match expressions, readonly properties)
• WordPress 6.0+
• libsodium for secret encryption (bundled with PHP 7.2+)
• No Composer vendor tree, no build step, no Node.js
• Vanilla JS for the frontend; jQuery only in admin (a WordPress dependency)
• WPML / Polylang compatible out of the box

Local development

git clone https://github.com/EtticDevelopment/opentrust.git
cd opentrust

# Symlink into a local WordPress install (e.g. WP Studio, Local, Lando, etc.)
ln -s "$(pwd)" /path/to/wordpress/wp-content/plugins/opentrust

# Activate via WP-CLI
wp plugin activate opentrust --path=/path/to/wordpress

Run Plugin Check before submitting changes

wp plugin check opentrust \
  --categories=plugin_repo,security,performance,general,accessibility \
  --severity=warning \
  --exclude-directories=".claude,.git" \
  --exclude-files="CLAUDE.md,.gitignore,.distignore,.DS_Store"

Should report "No errors found." Anything else is a regression.

Build a distribution zip locally

rsync -a --exclude-from=.distignore --exclude='.git' --exclude='.claude' \
      ./ /tmp/opentrust-stage/opentrust/
cd /tmp/opentrust-stage && zip -rq opentrust.zip opentrust

Translations

Ships with a .pot template and a starter Dutch (nl_NL) translation. WPML and Polylang compatible — all four content CPTs are registered public with a wpml-config.xml declaring translatable meta fields, so policies, certifications, subprocessors, and data practices can be translated per-language.

Translators can regenerate the template from source:

wp i18n make-pot . languages/open-trust-center-by-ettic.pot --domain=open-trust-center-by-ettic

Contribute a translation at translate.wordpress.org once the plugin is live there.

Contributing

Issues and pull requests welcome. Before opening a PR:

1. Run Plugin Check (above) — it should report zero errors.
2. Verify the plugin still loads cleanly on a fresh WordPress install (/trust-center/ returns 200, no PHP errors in debug.log).
3. If you're adding a user-facing string, wrap it in the opentrust text domain.
4. Keep PHP 8.1 as the floor — match expressions and named arguments are fine.

Status

1.0.0 — first public release. Submitted to wordpress.org.

License

GPL-2.0-or-later. Same as WordPress core.

Acknowledgements

Built and maintained by Ettic.