Bundle a customer trust packet from your audit evidence

Stitch the artifacts you already built (**audit narrative** ([Build an audit narrative from your logs](/tutorials/build-an-audit-narrative-from-your-logs)), **subprocessor inventory** ([Map your subprocessors for procurement](/tutorials/map-your-subprocessors-for-procurement)), **SOC 2 control map** ([Build a SOC 2 control mapping for your Auxot deployment](/tutorials/build-a-soc-2-control-mapping-for-your-auxot-deployment)), **retention stance** ([Plan for retention and deletion requests](/tutorials/plan-for-retention-and-deletion-requests)), and **two-person rules evidence** ([Use two-person rules for high-impact actions](/tutorials/use-two-person-rules-for-high-impact-actions))) into one **dated, redacted, audience-aware bundle** enterprise procurement can review without scheduling another call.

Plus: three Admin-Agent passes: draft a cover letter tuned to your buyer (vendor security reviewer vs. board diligence vs. auditor), sweep pasted artifact contents for stale customer names and vendor identifiers, and produce a **packet manifest** that shows last-updated dates per section so refreshing the bundle stays mechanical.

Audience	Admins · Executives · Everyone
Time	~15 min
Prerequisites	The source artifacts already exist (this tutorial assembles, it does not create): [Build an audit narrative from your logs](/tutorials/build-an-audit-narrative-from-your-logs), [Map your subprocessors for procurement](/tutorials/map-your-subprocessors-for-procurement), [Build a SOC 2 control mapping for your Auxot deployment](/tutorials/build-a-soc-2-control-mapping-for-your-auxot-deployment), [Plan for retention and deletion requests](/tutorials/plan-for-retention-and-deletion-requests). Helpful: [Answer vendor security questionnaires from your own evidence](/tutorials/answer-vendor-security-questionnaires-from-your-own-evidence) (same sources, different shape), [Use two-person rules for high-impact actions](/tutorials/use-two-person-rules-for-high-impact-actions) (separation-of-duties evidence), [Back up and export your Auxot data](/tutorials/back-up-and-export-your-auxot-data) for getting redacted exports out cleanly.
You'll end up with	A dated trust packet (cover letter, table of contents with last-updated dates per section, redacted source artifacts, and a tracking row recording which buyer received which version) ready to attach to a sales-cycle email or upload to a procurement portal.

When a tutorial shows italic text in quotation marks, it usually mirrors a label or helper string inside Auxot. Product copy changes between releases — if something reads differently in your workspace, trust what you see on screen.

Callouts with a Worth knowing gold accent are meant as must-read context before you move on. Blockquotes that open with Tip are lighter, optional depth.

Why this matters

Enterprise buyers ask for “your security packet” at some point in every serious deal cycle. Most companies scramble: someone forwards a screenshot of last quarter’s SOC 2 letter, someone pastes the subprocessor list from a year-old PDF, and the sales lead writes a cover paragraph in Slack between meetings.

The deal slips because the buyer’s procurement team checks the packet against their questionnaire vocabulary and finds three documents that disagree.

The fix is one bundle, dated, audience-aware, and versioned. Not a new artifact you author from scratch every time. An assembly step that takes the pieces you already maintain (Build an audit narrative from your logs, Map your subprocessors for procurement, Build a SOC 2 control mapping for your Auxot deployment, Plan for retention and deletion requests) and packages them as a coherent set with a cover letter that matches this buyer’s role.

This is not a sales asset wrapped in marketing voice. That artifact lives over here (Write the agent section of your customer-facing security page): same source material, different audience and tone. The trust packet is the procurement-team-facing version: factual, dated, redacted, and structured so the security reviewer can search for “SOC 2” or “subprocessor” and land on the row they need.

Nothing assembles on its own: you pick the contents, you approve the cover letter, you redact customer names before it leaves your domain.

Quick start

Pick the audience. Vendor security reviewer, customer board diligence, or external auditor: three different cover-letter tones, same evidence. Write down which one this bundle serves before you start.
List source artifacts. Minimum bundle: audit narrative + subprocessor inventory + SOC 2 control map + retention paragraph. Heavier bundle adds two-person rules evidence (Use two-person rules for high-impact actions) and questionnaire-row appendix (Answer vendor security questionnaires from your own evidence).
Draft the cover letter. Admin Agent power move 1: paste buyer context + bundle inventory; get a one-page cover that names what is and isn’t in the packet, dated, signed by a real human role (not the agent).
Redact. Admin Agent power move 2: sweep each artifact for customer names, vendor identifiers, and internal IDs that shouldn’t leave your domain. Reviewer-grade redaction, not legal redaction.
Version + log. Date the packet (e.g. trust-packet-2026-Q2), append a row to your packet log: buyer name, version sent, date, follow-up owner. Future-you stops sending stale bundles.

Done? One packet attached to one real deal: cover letter on the first page, redacted artifacts in order, manifest with last-updated dates per section.

The agent can do that?

1. Audience-tuned cover letter

Chat → Admin Agent:

Buyer context: [vendor security reviewer at Acme Corp, mid-cycle procurement, healthcare-adjacent]. Bundle inventory: audit narrative (Q2 2026), subprocessor list (May 2026), SOC 2 control map (April 2026), retention paragraph (March 2026). Draft a one-page cover letter that names what's in the packet, names what's NOT (e.g. SOC 2 Type II report not yet attached, Q3 deliverable), signed by [Compliance Lead role], dated today, ≤350 words.

Why it’s non-obvious: Generic cover letters get skimmed; audience-named cover letters earn the next two minutes of reviewer attention. The “what’s NOT in the packet” line buys credibility; you still verify the gaps list before the packet leaves.

2. Redaction sweep

Pasted artifact: [paste contents]. Sweep for: customer names (real or accidentally left in examples), vendor identifiers beyond what's already public in our subprocessor list, internal ticket IDs, employee names below VP level, deployment hostnames, and dollar figures from internal contracts. Output a markdown table with columns Item, Location, Suggested redaction, Why. Flag uncertain calls explicitly.

Why it’s non-obvious: Reviewers screenshot sloppy redacted artifacts and pass them around. The sweep catches the obvious slips before you hit send; you still make the final call on the borderline rows.

3. Packet manifest

Bundle sections: [list with last-updated date per section]. Produce a markdown manifest table with columns Section, Last updated, Refresh cadence, Owner. Include a "next refresh due" column flagging anything older than 90 days.

Why it’s non-obvious: Stale packets quietly erode trust. The manifest is what makes refresh mechanical: at the next quarterly cycle, the rows flagged “next refresh due” are exactly the artifacts you re-pull and re-attach.

Go deeper

Sales-team handoff

Sales reps shouldn’t assemble these bundles ad hoc; that’s how stale versions ship. Centralize: compliance owns the canonical bundle, sales reps request a version tagged to a specific buyer. Pair with Run a deal desk for pricing and legal exceptions workflow shape: sales submits the request, compliance assembles and approves the send.

Refresh cadence

Quarterly bundle refresh aligns with most enterprise procurement review windows. Tie the refresh job to the same calendar as Run a quarterly review of your agents: one Friday afternoon, both rituals done together.

Versioning that survives counsel review

If counsel red-pens the cover letter or any source artifact, version the bundle (e.g. trust-packet-2026-Q2-v2) instead of editing in place. Reviewers compare versions; you preserve the audit trail for what was sent when.

Owner change and dry runs

When the compliance lead who curates this bundle rotates, the packet has to survive: Hand off the audit narrative when your compliance lead changes covers the handoff motion that keeps the bundle and the reasoning behind each section’s inclusion intact across the role change. Before a high-stakes external review, Run an internal pre-audit drill against your own narrative rehearses against this exact bundle so the gaps surface internally before a buyer or auditor finds them.

Public-page vs. trust-packet boundary

The public-page sister (Write the agent section of your customer-facing security page) is marketing voice; the trust packet is procurement voice. Don’t merge them: the public page can lose detail for clarity; the packet earns trust by including the detail.

Drafting paths

If you wire an MCP to draft the cover letter or assemble artifact sections, use the offline-file model: an offline-file Word MCP writes the .docx to a folder on your machine, never touching OneDrive. You open the file, redact, and decide whether to package and send. The file itself is the human-review gate.

Skip the Microsoft Graph paths (live Word documents in OneDrive) for trust-packet content. The cloud tools write the live document on the first call with no draft state in between, which collapses the redaction step you need.

Walkthrough

Step 1: Catalog source artifacts

List every artifact you might include: source location, last-updated date, owner. This is your standing list; bundles are subsets of it, not new authoring work.

Step 2: Pick contents for this buyer

Different buyers need different subsets. Healthcare-adjacent procurement wants the subprocessor list + retention stance up front. Fintech procurement leads with SOC 2 mapping. Sales-team buyers may just want the audit narrative + cover letter. Match contents to context.

Step 3: Draft cover + redact

Power moves 1 and 2 above. Cover letter first (frames the packet for the reviewer), redaction second (catches what shouldn’t leave). Compliance approves both before the bundle is finalized.

Step 4: Stamp + manifest

Date the bundle. Produce the manifest (power move 3). Save the bundle as a single PDF or zipped folder named after the version tag.

Step 5: Log who received what

Append a row to your packet log spreadsheet: buyer, version, send date, follow-up owner, response deadline. Next quarter, this is how you decide whether to refresh or roll forward unchanged.

What’s next

→ Build an audit narrative from your logs. Source artifact: the prose layer your trust packet leads with.
→ Map your subprocessors for procurement. Source artifact: the subprocessor inventory page.
→ Build a SOC 2 control mapping for your Auxot deployment. Source artifact: the control-by-control evidence map.
→ Plan for retention and deletion requests. Source artifact: the retention stance paragraph.
→ Answer vendor security questionnaires from your own evidence. Sister artifact: questionnaire rows; trust packets and questionnaires share source material, different shape.
→ Write the agent section of your customer-facing security page. Public-page sister; do not merge with the trust packet.
→ Run a deal desk for pricing and legal exceptions. Workflow shape sales reps use to request a buyer-tagged packet from compliance.
→ Hand off the audit narrative when your compliance lead changes. This bundle is part of the handoff packet when the compliance lead rotates; the next person needs the reasoning behind each section’s inclusion, not just the assembled file.
→ Run an internal pre-audit drill against your own narrative. Rehearse against this exact bundle before a high-stakes external review so the gaps surface internally first.

Reference

Pages in Auxot: Chat, Settings → Context Files, Audit Logs
See also: Use two-person rules for high-impact actions, Back up and export your Auxot data, Run a quarterly review of your agents, Run an incident tabletop exercise, Document your agent usage for cyber insurance renewal