diff --git a/site/src/components/TrustStrip.astro b/site/src/components/TrustStrip.astro
new file mode 100644
index 0000000..1d539d1
--- /dev/null
+++ b/site/src/components/TrustStrip.astro
@@ -0,0 +1,130 @@
+---
+// Site-wide trust strip: ONLY signals we have legitimately earned.
+// - Qualys SSL Labs A+ (verified 2026-06: live report links to ssllabs.com)
+// - SecurityHeaders.com A (verified 2026-06)
+// - Payments via Stripe (PCI DSS Level 1) - we process exclusively through Stripe
+// - 256-bit TLS / HTTPS (Let's Encrypt, TLS 1.2/1.3, HSTS preload)
+// - Hosted in a SOC 2 Type II compliant data center (infrastructure attestation)
+//
+// Deliberately NO government/regulator logos (CMS/NPPES/FCC/Medicare) and NO
+// self-claimed certs we don't hold. Each badge is defensible and, where a public
+// report exists, links to the live verification.
+//
+// Props let order/landing pages tighten or relax the wording without forking.
+export interface Props {
+ variant?: "full" | "compact";
+ /** Show the live "Verify" links (default true). */
+ links?: boolean;
+ class?: string;
+}
+const { variant = "full", links = true, class: extraClass = "" } = Astro.props;
+const compact = variant === "compact";
+---
+
+
+