> ## Documentation Index
> Fetch the complete documentation index at: https://docs.assuric.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Choosing what to publish

> Which documents customers ask for, and the approval step people miss.

<Note>
  **Quick summary**

  * An authored document has to be *Approved* before you can add it to your Trust Centre.
  * Publish a hazard log to show customers an always-current web view for each product, not a PDF.
  * Custom frameworks, for things like a NIS 2 certificate, are off until our team switches them on.
</Note>

## Approve, then publish

An authored document can be added only once it's [*Approved*](/documents/versions-and-version-history). Customers see that version, so editing the draft changes nothing until you approve the next one and move the resource to it.

<Info>
  Evidence, PDFs and certificates don't need the *Approved* status that authored documents do. Nothing in your evidence bank is public until you add it to your Trust Centre.
</Info>

## What customers ask for

* Certificates: Cyber Essentials, Cyber Essentials Plus, ISO 27001 and <Tooltip tip="Data Security and Protection Toolkit, the NHS annual data security self-assessment.">DSPT</Tooltip>
* Clinical Safety Case Report, Hazard Log and Clinical Risk Management Plan, your <Tooltip tip="The NHS standard for clinical risk management by manufacturers of health IT.">DCB0129</Tooltip> set
* [DPIAs](/assuric-overview/glossary#abbreviations) and other templates

## Publishing a hazard log

**Publish** on a [hazard log](/clinical-safety/sharing-and-publishing) puts an always-current web view of it on your Trust Centre, easier to read than a PDF. Customers can still download it as a spreadsheet.

<Frame caption="Publishing a set of hazard log versions to your Trust Centre, scoped per product.">
  <img src="https://mintcdn.com/assuric-docs/QS1JGzHvfuGL9o1b/images/trust-centre/published-hazard-log.png?fit=max&auto=format&n=QS1JGzHvfuGL9o1b&q=85&s=df2e1ba05a64aec571947be68af97032" alt="The Published Hazard Logs panel in the Assuric admin" width="719" height="548" data-path="images/trust-centre/published-hazard-log.png" />
</Frame>

## Framework badges, statuses and custom frameworks

Get in touch with our team for a *verified by Assuric* badge.

Custom frameworks show an assurance Assuric doesn't track, such as a NIS 2 certificate or a CREST penetration test. Ask our team to switch them on for your workspace; until then, **Add Framework** is greyed out. To add one (admins only):

1. Go to **Trust Centre → Page Content → Compliance** and click **Add Framework**.
2. Enter a *Label*, such as `NIS 2`, upload a square logo, and add a *Description*, a *Status* (*Active* or *In Progress*) and the *Countries / Regions* it covers.
3. Leave *Visible on Trust Page* on to show it straight away, or turn it off to add it hidden. Then click **Create Framework**. It appears in your list tagged *Custom*.

* It works like your other frameworks: you can attach resources to it, each public or by access request.
* Admins can edit or delete it from its card.
* It appears only on your Trust Centre, not under **Frameworks**, because it isn't linked to compliance tracking.

<Warning>
  Deleting a custom framework removes it from every Trust Centre view and can't be undone.
</Warning>

<Frame caption="Compliance frameworks in the admin, with the Verified badge and per-resource visibility. Add Framework, top right, stays greyed out until custom frameworks are switched on.">
  <img src="https://mintcdn.com/assuric-docs/QS1JGzHvfuGL9o1b/images/trust-centre/framework-badges.png?fit=max&auto=format&n=QS1JGzHvfuGL9o1b&q=85&s=75c62c0a91876e737cf2ac8b137844f6" alt="Compliance frameworks in the Assuric admin showing Verified badges" width="1720" height="813" data-path="images/trust-centre/framework-badges.png" />
</Frame>

## Subprocessors

Add each <Tooltip tip="A third party you use that processes personal data on your behalf.">subprocessor</Tooltip> with what it does and where it's based. Information governance teams use these details to check where data is held and that data processing agreements are in place.

## FAQs

FAQs answer what you'd otherwise get by email, like where you host data. Ours are at [trust.assuric.com/assuric/public/faq](https://trust.assuric.com/assuric/public/faq).

<Tip>
  **What we recommend**

  * Certificates and framework badges can be public. Clinical safety documents usually go behind an access request, as do sensitive ones such as a penetration test report.
  * Add subprocessors that process patient data early, as you may be asked for them during procurement.
</Tip>

## Related articles

<Columns cols={2}>
  <Card title="Access requests and who can see what" icon="eye" href="/trust-centre/access-control">
    Public documents, access requests, expiry dates and who approves.
  </Card>

  <Card title="Notify stakeholders of updates" icon="send" href="/trust-centre/updates-and-notifications">
    Update a published document and tell the people who hold it.
  </Card>
</Columns>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.