Add trust center references

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

apps/console/src/components/trustCenter/DeleteTrustCenterReferenceDialog.tsx

@@ -0,0 +1,83 @@
+import {
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  IconTrashCan,
+  Spinner,
+  useDialogRef,
+} from "@probo/ui";
+import { useTranslate } from "@probo/i18n";
+import { sprintf } from "@probo/helpers";
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import { deleteTrustCenterReferenceMutation } from "/hooks/graph/TrustCenterReferenceGraph";
+
+type Props = {
+  children: React.ReactNode;
+  referenceId: string;
+  referenceName: string;
+  connectionId: string;
+  onSuccess?: () => void;
+};
+
+export function DeleteTrustCenterReferenceDialog({
+  children,
+  referenceId,
+  referenceName,
+  connectionId,
+  onSuccess,
+}: Props) {
+  const { __ } = useTranslate();
+  const ref = useDialogRef();
+
+  const [mutate, isDeleting] = useMutationWithToasts(deleteTrustCenterReferenceMutation, {
+    successMessage: __("Reference deleted successfully"),
+    errorMessage: __("Failed to delete reference"),
+  });
+
+  const handleDelete = async () => {
+    await mutate({
+      variables: {
+        input: {
+          id: referenceId,
+        },
+        connections: [connectionId],
+      },
+    });
+
+    onSuccess?.();
+    ref.current?.close();
+  };
+
+  return (
+    <Dialog
+      ref={ref}
+      trigger={children}
+      title={__("Delete Reference")}
+      className="max-w-md"
+    >
+      <DialogContent padded>
+        <p className="text-txt-secondary">
+          {sprintf(
+            __("Are you sure you want to delete the reference \"%s\"?"),
+            referenceName
+          )}
+        </p>
+        <p className="text-txt-secondary mt-2">
+          {__("This action cannot be undone.")}
+        </p>
+      </DialogContent>
+
+      <DialogFooter>
+        <Button
+          variant="danger"
+          onClick={handleDelete}
+          disabled={isDeleting}
+          icon={isDeleting ? Spinner : IconTrashCan}
+        >
+          {isDeleting ? __("Deleting...") : __("Delete")}
+        </Button>
+      </DialogFooter>
+    </Dialog>
+  );
+}

apps/console/src/components/trustCenter/TrustCenterReferenceDialog.tsx

@@ -0,0 +1,262 @@
+import { useTranslate } from "@probo/i18n";
+import {
+  Button,
+  Dialog,
+  DialogContent,
+  DialogFooter,
+  Dropzone,
+  Field,
+  Spinner,
+  Textarea,
+  useDialogRef,
+} from "@probo/ui";
+import { type ReactNode, useState, useImperativeHandle, forwardRef } from "react";
+import { z } from "zod";
+import { useFormWithSchema } from "/hooks/useFormWithSchema";
+import {
+  useCreateTrustCenterReferenceMutation,
+  useUpdateTrustCenterReferenceMutation
+} from "/hooks/graph/TrustCenterReferenceGraph";
+
+const referenceSchema = z.object({
+  name: z.string().min(1, "Name is required"),
+  description: z.string(),
+  websiteUrl: z.string().url("Please enter a valid URL"),
+});
+
+type ReferenceFormData = z.infer<typeof referenceSchema>;
+
+export type TrustCenterReferenceDialogRef = {
+  openCreate: (trustCenterId: string, connectionId: string) => void;
+  openEdit: (reference: {
+    id: string;
+    name: string;
+    description: string;
+    websiteUrl: string;
+  }) => void;
+};
+
+type Reference = {
+  id: string;
+  name: string;
+  description: string;
+  websiteUrl: string;
+};
+
+export const TrustCenterReferenceDialog = forwardRef<TrustCenterReferenceDialogRef, { children?: ReactNode }>(
+  function TrustCenterReferenceDialog({ children }, ref) {
+    const { __ } = useTranslate();
+    const dialogRef = useDialogRef();
+    const [mode, setMode] = useState<'create' | 'edit'>('create');
+    const [trustCenterId, setTrustCenterId] = useState<string>("");
+    const [connectionId, setConnectionId] = useState<string>("");
+    const [editReference, setEditReference] = useState<Reference | null>(null);
+    const [uploadedFile, setUploadedFile] = useState<File | null>(null);
+
+    const [createReference, isCreating] = useCreateTrustCenterReferenceMutation();
+    const [updateReference, isUpdating] = useUpdateTrustCenterReferenceMutation();
+
+    const { register, handleSubmit, formState: { errors }, reset } = useFormWithSchema(
+      referenceSchema,
+      {
+        defaultValues: {
+          name: "",
+          description: "",
+          websiteUrl: "",
+        },
+      }
+    );
+
+    useImperativeHandle(ref, () => ({
+      openCreate: (tId: string, cId: string) => {
+        setMode('create');
+        setTrustCenterId(tId);
+        setConnectionId(cId);
+        setEditReference(null);
+        setUploadedFile(null);
+        reset({
+          name: "",
+          description: "",
+          websiteUrl: "",
+        });
+        dialogRef.current?.open();
+      },
+      openEdit: (reference: Reference) => {
+        setMode('edit');
+        setEditReference(reference);
+        setUploadedFile(null);
+        reset({
+          name: reference.name,
+          description: reference.description,
+          websiteUrl: reference.websiteUrl,
+        });
+        dialogRef.current?.open();
+      },
+    }));
+
+    const handleDrop = (files: File[]) => {
+      if (files.length > 0) {
+        const file = files[0];
+        setUploadedFile(file);
+      }
+    };
+
+    const onSubmit = handleSubmit(async (data: ReferenceFormData) => {
+      if (mode === 'create') {
+        if (!uploadedFile) {
+          return;
+        }
+
+        await createReference({
+          variables: {
+            input: {
+              trustCenterId,
+              name: data.name,
+              description: data.description,
+              websiteUrl: data.websiteUrl,
+              logoFile: null,
+            },
+            connections: [connectionId],
+          },
+          uploadables: {
+            "input.logoFile": uploadedFile,
+          },
+          onSuccess: () => {
+            reset();
+            setUploadedFile(null);
+            dialogRef.current?.close();
+          },
+        });
+      } else if (editReference) {
+        const input: {
+          id: string;
+          name: string;
+          description: string;
+          websiteUrl: string;
+          logoFile?: null;
+        } = {
+          id: editReference.id,
+          name: data.name,
+          description: data.description,
+          websiteUrl: data.websiteUrl,
+        };
+
+        const uploadables: Record<string, File> = {};
+
+        if (uploadedFile) {
+          input.logoFile = null;
+          uploadables["input.logoFile"] = uploadedFile;
+        }
+
+        await updateReference({
+          variables: { input },
+          uploadables: Object.keys(uploadables).length > 0 ? uploadables : undefined,
+          onSuccess: () => {
+            reset();
+            setUploadedFile(null);
+            dialogRef.current?.close();
+          },
+        });
+      }
+    });
+
+    const handleClose = () => {
+      reset();
+      setUploadedFile(null);
+    };
+
+    const isSubmitting = isCreating || isUpdating;
+    const title = mode === 'create' ? __("Add Reference") : __("Edit Reference");
+
+    return (
+      <>
+        {children && (
+          <span onClick={() => mode === 'create' && dialogRef.current?.open()}>
+            {children}
+          </span>
+        )}
+
+        <Dialog
+          ref={dialogRef}
+          title={title}
+          className="max-w-2xl"
+          onClose={handleClose}
+        >
+          <form onSubmit={onSubmit}>
+            <DialogContent padded className="space-y-6">
+              <Field
+                {...register("name")}
+                label={__("Reference Name")}
+                type="text"
+                required
+                error={errors.name?.message}
+                placeholder={__("Company or organization name")}
+              />
+
+              <Field label={__("Description")} error={errors.description?.message}>
+                <Textarea
+                  {...register("description")}
+                  placeholder={__("Brief description of the reference")}
+                  rows={3}
+                />
+              </Field>
+
+              <Field
+                {...register("websiteUrl")}
+                label={__("Website URL")}
+                type="url"
+                required
+                error={errors.websiteUrl?.message}
+                placeholder={__("https://example.com")}
+              />
+
+              <Field label={__("Logo")}>
+                <Dropzone
+                  description={__("Upload logo image (PNG, JPG, WEBP up to 5MB)")}
+                  isUploading={isSubmitting}
+                  onDrop={handleDrop}
+                  accept={{
+                    "image/png": [".png"],
+                    "image/jpeg": [".jpg", ".jpeg"],
+                    "image/webp": [".webp"],
+                  }}
+                  maxSize={5}
+                />
+                {uploadedFile && (
+                  <div className="mt-2 p-3 bg-tertiary-subtle rounded-lg">
+                    <p className="text-sm font-medium">{__("Selected file")}:</p>
+                    <p className="text-sm text-txt-secondary">{uploadedFile.name}</p>
+                  </div>
+                )}
+                {mode === 'edit' && !uploadedFile && (
+                  <div className="mt-2 p-3 bg-tertiary-subtle rounded-lg">
+                    <p className="text-sm text-txt-secondary">
+                      {__("Current logo will be kept if no new file is uploaded")}
+                    </p>
+                  </div>
+                )}
+                {mode === 'create' && !uploadedFile && (
+                  <div className="mt-2 p-3 bg-warning-subtle rounded-lg">
+                    <p className="text-sm">
+                      {__("Logo is required for new references")}
+                    </p>
+                  </div>
+                )}
+              </Field>
+            </DialogContent>
+
+            <DialogFooter>
+              <Button
+                type="submit"
+                disabled={isSubmitting || (mode === 'create' && !uploadedFile)}
+                icon={isSubmitting ? Spinner : undefined}
+              >
+                {mode === 'create' ? __("Add Reference") : __("Update Reference")}
+              </Button>
+            </DialogFooter>
+          </form>
+        </Dialog>
+      </>
+    );
+  }
+);

apps/console/src/components/trustCenter/TrustCenterReferencesSection.tsx

@@ -0,0 +1,164 @@
+import { useTranslate } from "@probo/i18n";
+import { safeOpenUrl } from "@probo/helpers";
+import {
+  Avatar,
+  Button,
+  Card,
+  IconPlusLarge,
+  IconTrashCan,
+  IconPencil,
+} from "@probo/ui";
+import { type ReactNode, useRef } from "react";
+import {
+  useTrustCenterReferences,
+} from "/hooks/graph/TrustCenterReferenceGraph";
+import { TrustCenterReferenceDialog, type TrustCenterReferenceDialogRef } from "./TrustCenterReferenceDialog";
+import { DeleteTrustCenterReferenceDialog } from "./DeleteTrustCenterReferenceDialog";
+
+type Props = {
+  trustCenterId: string;
+  children?: ReactNode;
+};
+
+type Reference = {
+  id: string;
+  name: string;
+  description: string;
+  websiteUrl: string;
+  logoUrl: string;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export function TrustCenterReferencesSection({ trustCenterId }: Props) {
+  const { __ } = useTranslate();
+  const dialogRef = useRef<TrustCenterReferenceDialogRef>(null);
+  const data = useTrustCenterReferences(trustCenterId);
+
+  const trustCenterNode = data?.node;
+  const references = trustCenterNode?.references?.edges?.map((edge) => edge.node) || [];
+  const referencesConnectionId = trustCenterNode?.references?.__id || "";
+
+  const handleCreate = () => {
+    if (referencesConnectionId) {
+      dialogRef.current?.openCreate(trustCenterId, referencesConnectionId);
+    }
+  };
+
+  const handleEdit = (reference: Reference) => {
+    dialogRef.current?.openEdit(reference);
+  };
+
+
+  const handleVisitWebsite = (websiteUrl: string) => {
+    safeOpenUrl(websiteUrl);
+  };
+
+  return (
+    <div className="space-y-4">
+      <div className="flex items-center justify-between">
+        <div>
+          <h2 className="text-base font-medium">{__("Trusted by")}</h2>
+          <p className="text-sm text-txt-tertiary">
+            {__("Showcase your customers and partners on your trust center")}
+          </p>
+        </div>
+        <Button
+          variant="secondary"
+          icon={IconPlusLarge}
+          onClick={handleCreate}
+        >
+          {__("Add Reference")}
+        </Button>
+      </div>
+
+      <Card padded>
+        {references.length === 0 ? (
+          <div className="text-center py-12">
+            <div className="mx-auto w-12 h-12 bg-tertiary rounded-lg flex items-center justify-center mb-4">
+              <IconPlusLarge size={24} className="text-txt-tertiary" />
+            </div>
+            <h3 className="text-lg font-medium text-txt-primary mb-2">
+              {__("No references yet")}
+            </h3>
+            <p className="text-txt-tertiary mb-4">
+              {__("Add customer testimonials and partner references to build trust")}
+            </p>
+          </div>
+        ) : (
+          <div className="space-y-4">
+            {references.map((reference: Reference) => (
+              <ReferenceRow
+                key={reference.id}
+                reference={reference}
+                onEdit={() => handleEdit(reference)}
+                connectionId={referencesConnectionId}
+                onVisitWebsite={() => handleVisitWebsite(reference.websiteUrl)}
+              />
+            ))}
+          </div>
+        )}
+      </Card>
+
+      <TrustCenterReferenceDialog ref={dialogRef} />
+    </div>
+  );
+}
+
+type ReferenceRowProps = {
+  reference: Reference;
+  onEdit: () => void;
+  connectionId: string;
+  onVisitWebsite: () => void;
+};
+
+function ReferenceRow({ reference, onEdit, connectionId, onVisitWebsite }: ReferenceRowProps) {
+
+  return (
+    <div className="flex items-center justify-between p-4 bg-level-1 rounded-lg">
+      <div className="flex items-center space-x-4 flex-1">
+        <Avatar
+          src={reference.logoUrl}
+          name={reference.name}
+          size="l"
+        />
+
+        <div className="flex-1 min-w-0">
+          <div className="flex items-center space-x-2 mb-1">
+            <button
+              type="button"
+              onClick={onVisitWebsite}
+              className="font-medium text-txt-primary truncate hover:text-primary hover:underline text-left cursor-pointer"
+            >
+              {reference.name}
+            </button>
+          </div>
+
+          <p className="text-sm text-txt-secondary line-clamp-2 mb-2">
+            {reference.description}
+          </p>
+        </div>
+      </div>
+
+      <div className="flex items-center justify-center space-x-2 ml-4">
+        <Button
+          variant="tertiary"
+          icon={IconPencil}
+          onClick={onEdit}
+          aria-label="Edit reference"
+        />
+        <DeleteTrustCenterReferenceDialog
+          referenceId={reference.id}
+          referenceName={reference.name}
+          connectionId={connectionId}
+        >
+          <Button
+            variant="danger"
+            icon={IconTrashCan}
+            aria-label="Delete reference"
+          />
+        </DeleteTrustCenterReferenceDialog>
+      </div>
+    </div>
+  );
+}

apps/console/src/hooks/graph/TrustCenterGraph.ts

@@ -16,6 +16,19 @@ export const trustCenterQuery = graphql`
           ndaFileUrl
           createdAt
           updatedAt
+          references(first: 100, orderBy: { field: CREATED_AT, direction: DESC }) {
+            edges {
+              node {
+                id
+                name
+                description
+                websiteUrl
+                logoUrl
+                createdAt
+                updatedAt
+              }
+            }
+          }
         }
         documents(first: 100) {
           edges {
@@ -112,4 +125,3 @@ export function useDeleteTrustCenterNDAMutation() {
     }
   );
 }
-

apps/console/src/hooks/graph/TrustCenterReferenceGraph.ts

@@ -0,0 +1,133 @@
+import { graphql } from 'react-relay';
+import { useLazyLoadQuery } from 'react-relay';
+import { useMutationWithToasts } from "/hooks/useMutationWithToasts";
+import type {
+  TrustCenterReferenceGraphQuery,
+  TrustCenterReferenceGraphQuery$data
+} from "./__generated__/TrustCenterReferenceGraphQuery.graphql";
+import type { TrustCenterReferenceGraphCreateMutation } from "./__generated__/TrustCenterReferenceGraphCreateMutation.graphql";
+import type { TrustCenterReferenceGraphUpdateMutation } from "./__generated__/TrustCenterReferenceGraphUpdateMutation.graphql";
+import type { TrustCenterReferenceGraphDeleteMutation } from "./__generated__/TrustCenterReferenceGraphDeleteMutation.graphql";
+
+export const trustCenterReferencesQuery = graphql`
+  query TrustCenterReferenceGraphQuery($trustCenterId: ID!) {
+    node(id: $trustCenterId) {
+      ... on TrustCenter {
+        id
+        references(first: 100, orderBy: { field: CREATED_AT, direction: DESC })
+          @connection(key: "TrustCenterReferencesSection_references") {
+          __id
+          pageInfo {
+            hasNextPage
+            hasPreviousPage
+            startCursor
+            endCursor
+          }
+          edges {
+            cursor
+            node {
+              id
+              name
+              description
+              websiteUrl
+              logoUrl
+              createdAt
+              updatedAt
+            }
+          }
+        }
+      }
+    }
+  }
+`;
+
+export const createTrustCenterReferenceMutation = graphql`
+  mutation TrustCenterReferenceGraphCreateMutation(
+    $input: CreateTrustCenterReferenceInput!
+    $connections: [ID!]!
+  ) {
+    createTrustCenterReference(input: $input) {
+      trustCenterReferenceEdge @prependEdge(connections: $connections) {
+        cursor
+        node {
+          id
+          name
+          description
+          websiteUrl
+          logoUrl
+          createdAt
+          updatedAt
+        }
+      }
+    }
+  }
+`;
+
+export const updateTrustCenterReferenceMutation = graphql`
+  mutation TrustCenterReferenceGraphUpdateMutation(
+    $input: UpdateTrustCenterReferenceInput!
+  ) {
+    updateTrustCenterReference(input: $input) {
+      trustCenterReference {
+        id
+        name
+        description
+        websiteUrl
+        logoUrl
+        createdAt
+        updatedAt
+      }
+    }
+  }
+`;
+
+export const deleteTrustCenterReferenceMutation = graphql`
+  mutation TrustCenterReferenceGraphDeleteMutation(
+    $input: DeleteTrustCenterReferenceInput!
+    $connections: [ID!]!
+  ) {
+    deleteTrustCenterReference(input: $input) {
+      deletedTrustCenterReferenceId @deleteEdge(connections: $connections)
+    }
+  }
+`;
+
+export function useTrustCenterReferences(trustCenterId: string): TrustCenterReferenceGraphQuery$data | null {
+  const data = useLazyLoadQuery<TrustCenterReferenceGraphQuery>(
+    trustCenterReferencesQuery,
+    { trustCenterId: trustCenterId || "" },
+    { fetchPolicy: 'network-only' }
+  );
+
+  return trustCenterId ? data : null;
+}
+
+export function useCreateTrustCenterReferenceMutation() {
+  return useMutationWithToasts<TrustCenterReferenceGraphCreateMutation>(
+    createTrustCenterReferenceMutation,
+    {
+      successMessage: "Reference created successfully",
+      errorMessage: "Failed to create reference",
+    }
+  );
+}
+
+export function useUpdateTrustCenterReferenceMutation() {
+  return useMutationWithToasts<TrustCenterReferenceGraphUpdateMutation>(
+    updateTrustCenterReferenceMutation,
+    {
+      successMessage: "Reference updated successfully",
+      errorMessage: "Failed to update reference",
+    }
+  );
+}
+
+export function useDeleteTrustCenterReferenceMutation() {
+  return useMutationWithToasts<TrustCenterReferenceGraphDeleteMutation>(
+    deleteTrustCenterReferenceMutation,
+    {
+      successMessage: "Reference deleted successfully",
+      errorMessage: "Failed to delete reference",
+    }
+  );
+}

apps/console/src/hooks/graph/__generated__/TrustCenterGraphQuery.graphql.ts

@@ -1,5 +1,5 @@
 /**
- * @generated SignedSource<<9dbea87f398ce8189cb2431d7c03912c>>
+ * @generated SignedSource<<241faf24f6f9e1ca0e5f8171e40e5cd3>>
  * @lightSyntaxTransform
  * @nogrep
  */
@@ -39,6 +39,19 @@ export type TrustCenterGraphQuery$data = {
       readonly id: string;
       readonly ndaFileName: string | null | undefined;
       readonly ndaFileUrl: string | null | undefined;
+      readonly references: {
+        readonly edges: ReadonlyArray<{
+          readonly node: {
+            readonly createdAt: any;
+            readonly description: string;
+            readonly id: string;
+            readonly logoUrl: string;
+            readonly name: string;
+            readonly updatedAt: any;
+            readonly websiteUrl: string;
+          };
+        }>;
+      };
       readonly slug: string;
       readonly updatedAt: any;
     } | null | undefined;
@@ -94,6 +107,25 @@ v4 = {
   "storageKey": null
 },
 v5 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "updatedAt",
+  "storageKey": null
+},
+v6 = {
+  "kind": "Literal",
+  "name": "first",
+  "value": 100
+},
+v7 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "description",
+  "storageKey": null
+},
+v8 = {
   "alias": null,
   "args": null,
   "concreteType": "TrustCenter",
@@ -131,24 +163,76 @@ v5 = {
       "storageKey": null
     },
     (v4/*: any*/),
+    (v5/*: any*/),
     {
       "alias": null,
-      "args": null,
+      "args": [
-      "kind": "ScalarField",
+        (v6/*: any*/),
-      "name": "updatedAt",
+        {
-      "storageKey": null
+          "kind": "Literal",
+          "name": "orderBy",
+          "value": {
+            "direction": "DESC",
+            "field": "CREATED_AT"
+          }
+        }
+      ],
+      "concreteType": "TrustCenterReferenceConnection",
+      "kind": "LinkedField",
+      "name": "references",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "concreteType": "TrustCenterReferenceEdge",
+          "kind": "LinkedField",
+          "name": "edges",
+          "plural": true,
+          "selections": [
+            {
+              "alias": null,
+              "args": null,
+              "concreteType": "TrustCenterReference",
+              "kind": "LinkedField",
+              "name": "node",
+              "plural": false,
+              "selections": [
+                (v2/*: any*/),
+                (v3/*: any*/),
+                (v7/*: any*/),
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "websiteUrl",
+                  "storageKey": null
+                },
+                {
+                  "alias": null,
+                  "args": null,
+                  "kind": "ScalarField",
+                  "name": "logoUrl",
+                  "storageKey": null
+                },
+                (v4/*: any*/),
+                (v5/*: any*/)
+              ],
+              "storageKey": null
+            }
+          ],
+          "storageKey": null
+        }
+      ],
+      "storageKey": "references(first:100,orderBy:{\"direction\":\"DESC\",\"field\":\"CREATED_AT\"})"
     }
   ],
   "storageKey": null
 },
-v6 = [
+v9 = [
-  {
+  (v6/*: any*/)
-    "kind": "Literal",
-    "name": "first",
-    "value": 100
-  }
 ],
-v7 = {
+v10 = {
   "alias": null,
   "args": null,
   "kind": "ScalarField",
@@ -175,10 +259,10 @@ return {
             "selections": [
               (v2/*: any*/),
               (v3/*: any*/),
-              (v5/*: any*/),
+              (v8/*: any*/),
               {
                 "alias": null,
-                "args": (v6/*: any*/),
+                "args": (v9/*: any*/),
                 "concreteType": "DocumentConnection",
                 "kind": "LinkedField",
                 "name": "documents",
@@ -217,7 +301,7 @@ return {
               },
               {
                 "alias": null,
-                "args": (v6/*: any*/),
+                "args": (v9/*: any*/),
                 "concreteType": "AuditConnection",
                 "kind": "LinkedField",
                 "name": "audits",
@@ -256,7 +340,7 @@ return {
               },
               {
                 "alias": null,
-                "args": (v6/*: any*/),
+                "args": (v9/*: any*/),
                 "concreteType": "VendorConnection",
                 "kind": "LinkedField",
                 "name": "vendors",
@@ -330,10 +414,10 @@ return {
             "kind": "InlineFragment",
             "selections": [
               (v3/*: any*/),
-              (v5/*: any*/),
+              (v8/*: any*/),
               {
                 "alias": null,
-                "args": (v6/*: any*/),
+                "args": (v9/*: any*/),
                 "concreteType": "DocumentConnection",
                 "kind": "LinkedField",
                 "name": "documents",
@@ -371,7 +455,7 @@ return {
                             "name": "documentType",
                             "storageKey": null
                           },
-                          (v7/*: any*/),
+                          (v10/*: any*/),
                           {
                             "alias": null,
                             "args": [
@@ -430,7 +514,7 @@ return {
               },
               {
                 "alias": null,
-                "args": (v6/*: any*/),
+                "args": (v9/*: any*/),
                 "concreteType": "AuditConnection",
                 "kind": "LinkedField",
                 "name": "audits",
@@ -488,7 +572,7 @@ return {
                             "name": "state",
                             "storageKey": null
                           },
-                          (v7/*: any*/),
+                          (v10/*: any*/),
                           (v4/*: any*/)
                         ],
                         "storageKey": null
@@ -501,7 +585,7 @@ return {
               },
               {
                 "alias": null,
-                "args": (v6/*: any*/),
+                "args": (v9/*: any*/),
                 "concreteType": "VendorConnection",
                 "kind": "LinkedField",
                 "name": "vendors",
@@ -532,14 +616,8 @@ return {
                             "name": "category",
                             "storageKey": null
                           },
-                          {
-                            "alias": null,
-                            "args": null,
-                            "kind": "ScalarField",
-                            "name": "description",
-                            "storageKey": null
-                          },
                           (v7/*: any*/),
+                          (v10/*: any*/),
                           (v4/*: any*/)
                         ],
                         "storageKey": null
@@ -560,16 +638,16 @@ return {
     ]
   },
   "params": {
-    "cacheID": "8dff30a639470418ba7151cb5743d3cc",
+    "cacheID": "d08519f604d27066ddaabb667d234552",
     "id": null,
     "metadata": {},
     "name": "TrustCenterGraphQuery",
     "operationKind": "query",
-    "text": "query TrustCenterGraphQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      name\n      trustCenter {\n        id\n        active\n        slug\n        ndaFileName\n        ndaFileUrl\n        createdAt\n        updatedAt\n      }\n      documents(first: 100) {\n        edges {\n          node {\n            id\n            ...TrustCenterDocumentsCardFragment\n          }\n        }\n      }\n      audits(first: 100) {\n        edges {\n          node {\n            id\n            ...TrustCenterAuditsCardFragment\n          }\n        }\n      }\n      vendors(first: 100) {\n        edges {\n          node {\n            id\n            ...TrustCenterVendorsCardFragment\n          }\n        }\n      }\n    }\n    id\n  }\n}\n\nfragment TrustCenterAuditsCardFragment on Audit {\n  id\n  name\n  framework {\n    name\n    id\n  }\n  validFrom\n  validUntil\n  state\n  showOnTrustCenter\n  createdAt\n}\n\nfragment TrustCenterDocumentsCardFragment on Document {\n  id\n  title\n  createdAt\n  documentType\n  showOnTrustCenter\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n      }\n    }\n  }\n}\n\nfragment TrustCenterVendorsCardFragment on Vendor {\n  id\n  name\n  category\n  description\n  showOnTrustCenter\n  createdAt\n}\n"
+    "text": "query TrustCenterGraphQuery(\n  $organizationId: ID!\n) {\n  organization: node(id: $organizationId) {\n    __typename\n    ... on Organization {\n      id\n      name\n      trustCenter {\n        id\n        active\n        slug\n        ndaFileName\n        ndaFileUrl\n        createdAt\n        updatedAt\n        references(first: 100, orderBy: {field: CREATED_AT, direction: DESC}) {\n          edges {\n            node {\n              id\n              name\n              description\n              websiteUrl\n              logoUrl\n              createdAt\n              updatedAt\n            }\n          }\n        }\n      }\n      documents(first: 100) {\n        edges {\n          node {\n            id\n            ...TrustCenterDocumentsCardFragment\n          }\n        }\n      }\n      audits(first: 100) {\n        edges {\n          node {\n            id\n            ...TrustCenterAuditsCardFragment\n          }\n        }\n      }\n      vendors(first: 100) {\n        edges {\n          node {\n            id\n            ...TrustCenterVendorsCardFragment\n          }\n        }\n      }\n    }\n    id\n  }\n}\n\nfragment TrustCenterAuditsCardFragment on Audit {\n  id\n  name\n  framework {\n    name\n    id\n  }\n  validFrom\n  validUntil\n  state\n  showOnTrustCenter\n  createdAt\n}\n\nfragment TrustCenterDocumentsCardFragment on Document {\n  id\n  title\n  createdAt\n  documentType\n  showOnTrustCenter\n  versions(first: 1) {\n    edges {\n      node {\n        id\n        status\n      }\n    }\n  }\n}\n\nfragment TrustCenterVendorsCardFragment on Vendor {\n  id\n  name\n  category\n  description\n  showOnTrustCenter\n  createdAt\n}\n"
   }
 };
 })();
 
-(node as any).hash = "21b2915ae5002dd54c990013e94adf5d";
+(node as any).hash = "4d70dd23cdcdac7cd715b3eb9020ed37";
 
 export default node;

apps/console/src/hooks/graph/__generated__/TrustCenterReferenceGraphCreateMutation.graphql.ts

@@ -0,0 +1,218 @@
+/**
+ * @generated SignedSource<<216f3e7b4510c3d1127c3910bebc8b95>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type CreateTrustCenterReferenceInput = {
+  description: string;
+  logoFile: any;
+  name: string;
+  trustCenterId: string;
+  websiteUrl: string;
+};
+export type TrustCenterReferenceGraphCreateMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: CreateTrustCenterReferenceInput;
+};
+export type TrustCenterReferenceGraphCreateMutation$data = {
+  readonly createTrustCenterReference: {
+    readonly trustCenterReferenceEdge: {
+      readonly cursor: any;
+      readonly node: {
+        readonly createdAt: any;
+        readonly description: string;
+        readonly id: string;
+        readonly logoUrl: string;
+        readonly name: string;
+        readonly updatedAt: any;
+        readonly websiteUrl: string;
+      };
+    };
+  };
+};
+export type TrustCenterReferenceGraphCreateMutation = {
+  response: TrustCenterReferenceGraphCreateMutation$data;
+  variables: TrustCenterReferenceGraphCreateMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "concreteType": "TrustCenterReferenceEdge",
+  "kind": "LinkedField",
+  "name": "trustCenterReferenceEdge",
+  "plural": false,
+  "selections": [
+    {
+      "alias": null,
+      "args": null,
+      "kind": "ScalarField",
+      "name": "cursor",
+      "storageKey": null
+    },
+    {
+      "alias": null,
+      "args": null,
+      "concreteType": "TrustCenterReference",
+      "kind": "LinkedField",
+      "name": "node",
+      "plural": false,
+      "selections": [
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "id",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "name",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "description",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "websiteUrl",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "logoUrl",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "createdAt",
+          "storageKey": null
+        },
+        {
+          "alias": null,
+          "args": null,
+          "kind": "ScalarField",
+          "name": "updatedAt",
+          "storageKey": null
+        }
+      ],
+      "storageKey": null
+    }
+  ],
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "TrustCenterReferenceGraphCreateMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateTrustCenterReferencePayload",
+        "kind": "LinkedField",
+        "name": "createTrustCenterReference",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "TrustCenterReferenceGraphCreateMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "CreateTrustCenterReferencePayload",
+        "kind": "LinkedField",
+        "name": "createTrustCenterReference",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "prependEdge",
+            "key": "",
+            "kind": "LinkedHandle",
+            "name": "trustCenterReferenceEdge",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "17a206ba4702d641ffd7631cb8e3e03b",
+    "id": null,
+    "metadata": {},
+    "name": "TrustCenterReferenceGraphCreateMutation",
+    "operationKind": "mutation",
+    "text": "mutation TrustCenterReferenceGraphCreateMutation(\n  $input: CreateTrustCenterReferenceInput!\n) {\n  createTrustCenterReference(input: $input) {\n    trustCenterReferenceEdge {\n      cursor\n      node {\n        id\n        name\n        description\n        websiteUrl\n        logoUrl\n        createdAt\n        updatedAt\n      }\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "e0a76c3f5582bf1ed5def08db36d9e25";
+
+export default node;

apps/console/src/hooks/graph/__generated__/TrustCenterReferenceGraphDeleteMutation.graphql.ts

@@ -0,0 +1,132 @@
+/**
+ * @generated SignedSource<<1f4c8af006c90496e08b285944c83eac>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type DeleteTrustCenterReferenceInput = {
+  id: string;
+};
+export type TrustCenterReferenceGraphDeleteMutation$variables = {
+  connections: ReadonlyArray<string>;
+  input: DeleteTrustCenterReferenceInput;
+};
+export type TrustCenterReferenceGraphDeleteMutation$data = {
+  readonly deleteTrustCenterReference: {
+    readonly deletedTrustCenterReferenceId: string;
+  };
+};
+export type TrustCenterReferenceGraphDeleteMutation = {
+  response: TrustCenterReferenceGraphDeleteMutation$data;
+  variables: TrustCenterReferenceGraphDeleteMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "connections"
+},
+v1 = {
+  "defaultValue": null,
+  "kind": "LocalArgument",
+  "name": "input"
+},
+v2 = [
+  {
+    "kind": "Variable",
+    "name": "input",
+    "variableName": "input"
+  }
+],
+v3 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "deletedTrustCenterReferenceId",
+  "storageKey": null
+};
+return {
+  "fragment": {
+    "argumentDefinitions": [
+      (v0/*: any*/),
+      (v1/*: any*/)
+    ],
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "TrustCenterReferenceGraphDeleteMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteTrustCenterReferencePayload",
+        "kind": "LinkedField",
+        "name": "deleteTrustCenterReference",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": [
+      (v1/*: any*/),
+      (v0/*: any*/)
+    ],
+    "kind": "Operation",
+    "name": "TrustCenterReferenceGraphDeleteMutation",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v2/*: any*/),
+        "concreteType": "DeleteTrustCenterReferencePayload",
+        "kind": "LinkedField",
+        "name": "deleteTrustCenterReference",
+        "plural": false,
+        "selections": [
+          (v3/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "filters": null,
+            "handle": "deleteEdge",
+            "key": "",
+            "kind": "ScalarHandle",
+            "name": "deletedTrustCenterReferenceId",
+            "handleArgs": [
+              {
+                "kind": "Variable",
+                "name": "connections",
+                "variableName": "connections"
+              }
+            ]
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "6d22b36eb6ce9b568bfc091741a63ea8",
+    "id": null,
+    "metadata": {},
+    "name": "TrustCenterReferenceGraphDeleteMutation",
+    "operationKind": "mutation",
+    "text": "mutation TrustCenterReferenceGraphDeleteMutation(\n  $input: DeleteTrustCenterReferenceInput!\n) {\n  deleteTrustCenterReference(input: $input) {\n    deletedTrustCenterReferenceId\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "31a0fcb302daa8f42bc5ecb74fadfd0b";
+
+export default node;

apps/console/src/hooks/graph/__generated__/TrustCenterReferenceGraphQuery.graphql.ts

@@ -0,0 +1,333 @@
+/**
+ * @generated SignedSource<<f53f001d217e4c6f5b353f2243f700f2>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type TrustCenterReferenceGraphQuery$variables = {
+  trustCenterId: string;
+};
+export type TrustCenterReferenceGraphQuery$data = {
+  readonly node: {
+    readonly id?: string;
+    readonly references?: {
+      readonly __id: string;
+      readonly edges: ReadonlyArray<{
+        readonly cursor: any;
+        readonly node: {
+          readonly createdAt: any;
+          readonly description: string;
+          readonly id: string;
+          readonly logoUrl: string;
+          readonly name: string;
+          readonly updatedAt: any;
+          readonly websiteUrl: string;
+        };
+      }>;
+      readonly pageInfo: {
+        readonly endCursor: any | null | undefined;
+        readonly hasNextPage: boolean;
+        readonly hasPreviousPage: boolean;
+        readonly startCursor: any | null | undefined;
+      };
+    };
+  };
+};
+export type TrustCenterReferenceGraphQuery = {
+  response: TrustCenterReferenceGraphQuery$data;
+  variables: TrustCenterReferenceGraphQuery$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "trustCenterId"
+  }
+],
+v1 = [
+  {
+    "kind": "Variable",
+    "name": "id",
+    "variableName": "trustCenterId"
+  }
+],
+v2 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "id",
+  "storageKey": null
+},
+v3 = {
+  "kind": "Literal",
+  "name": "orderBy",
+  "value": {
+    "direction": "DESC",
+    "field": "CREATED_AT"
+  }
+},
+v4 = {
+  "alias": null,
+  "args": null,
+  "kind": "ScalarField",
+  "name": "__typename",
+  "storageKey": null
+},
+v5 = [
+  {
+    "alias": null,
+    "args": null,
+    "concreteType": "PageInfo",
+    "kind": "LinkedField",
+    "name": "pageInfo",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "hasNextPage",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "hasPreviousPage",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "startCursor",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "endCursor",
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  },
+  {
+    "alias": null,
+    "args": null,
+    "concreteType": "TrustCenterReferenceEdge",
+    "kind": "LinkedField",
+    "name": "edges",
+    "plural": true,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "cursor",
+        "storageKey": null
+      },
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "TrustCenterReference",
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v2/*: any*/),
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "name",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "description",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "websiteUrl",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "logoUrl",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "createdAt",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "updatedAt",
+            "storageKey": null
+          },
+          (v4/*: any*/)
+        ],
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  },
+  {
+    "kind": "ClientExtension",
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "kind": "ScalarField",
+        "name": "__id",
+        "storageKey": null
+      }
+    ]
+  }
+],
+v6 = [
+  {
+    "kind": "Literal",
+    "name": "first",
+    "value": 100
+  },
+  (v3/*: any*/)
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "TrustCenterReferenceGraphQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              (v2/*: any*/),
+              {
+                "alias": "references",
+                "args": [
+                  (v3/*: any*/)
+                ],
+                "concreteType": "TrustCenterReferenceConnection",
+                "kind": "LinkedField",
+                "name": "__TrustCenterReferencesSection_references_connection",
+                "plural": false,
+                "selections": (v5/*: any*/),
+                "storageKey": "__TrustCenterReferencesSection_references_connection(orderBy:{\"direction\":\"DESC\",\"field\":\"CREATED_AT\"})"
+              }
+            ],
+            "type": "TrustCenter",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "type": "Query",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "TrustCenterReferenceGraphQuery",
+    "selections": [
+      {
+        "alias": null,
+        "args": (v1/*: any*/),
+        "concreteType": null,
+        "kind": "LinkedField",
+        "name": "node",
+        "plural": false,
+        "selections": [
+          (v4/*: any*/),
+          (v2/*: any*/),
+          {
+            "kind": "InlineFragment",
+            "selections": [
+              {
+                "alias": null,
+                "args": (v6/*: any*/),
+                "concreteType": "TrustCenterReferenceConnection",
+                "kind": "LinkedField",
+                "name": "references",
+                "plural": false,
+                "selections": (v5/*: any*/),
+                "storageKey": "references(first:100,orderBy:{\"direction\":\"DESC\",\"field\":\"CREATED_AT\"})"
+              },
+              {
+                "alias": null,
+                "args": (v6/*: any*/),
+                "filters": [
+                  "orderBy"
+                ],
+                "handle": "connection",
+                "key": "TrustCenterReferencesSection_references",
+                "kind": "LinkedHandle",
+                "name": "references"
+              }
+            ],
+            "type": "TrustCenter",
+            "abstractKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ]
+  },
+  "params": {
+    "cacheID": "8e9fd111488feb14deeedf47bfa4a0f0",
+    "id": null,
+    "metadata": {
+      "connection": [
+        {
+          "count": null,
+          "cursor": null,
+          "direction": "forward",
+          "path": [
+            "node",
+            "references"
+          ]
+        }
+      ]
+    },
+    "name": "TrustCenterReferenceGraphQuery",
+    "operationKind": "query",
+    "text": "query TrustCenterReferenceGraphQuery(\n  $trustCenterId: ID!\n) {\n  node(id: $trustCenterId) {\n    __typename\n    ... on TrustCenter {\n      id\n      references(first: 100, orderBy: {field: CREATED_AT, direction: DESC}) {\n        pageInfo {\n          hasNextPage\n          hasPreviousPage\n          startCursor\n          endCursor\n        }\n        edges {\n          cursor\n          node {\n            id\n            name\n            description\n            websiteUrl\n            logoUrl\n            createdAt\n            updatedAt\n            __typename\n          }\n        }\n      }\n    }\n    id\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "8b62ed10055cff04e117a31dd598eee4";
+
+export default node;

apps/console/src/hooks/graph/__generated__/TrustCenterReferenceGraphUpdateMutation.graphql.ts

@@ -0,0 +1,157 @@
+/**
+ * @generated SignedSource<<3b02f7734c467adddc8f8abe1c18c4e5>>
+ * @lightSyntaxTransform
+ * @nogrep
+ */
+
+/* tslint:disable */
+/* eslint-disable */
+// @ts-nocheck
+
+import { ConcreteRequest } from 'relay-runtime';
+export type UpdateTrustCenterReferenceInput = {
+  description?: string | null | undefined;
+  id: string;
+  logoFile?: any | null | undefined;
+  name?: string | null | undefined;
+  websiteUrl?: string | null | undefined;
+};
+export type TrustCenterReferenceGraphUpdateMutation$variables = {
+  input: UpdateTrustCenterReferenceInput;
+};
+export type TrustCenterReferenceGraphUpdateMutation$data = {
+  readonly updateTrustCenterReference: {
+    readonly trustCenterReference: {
+      readonly createdAt: any;
+      readonly description: string;
+      readonly id: string;
+      readonly logoUrl: string;
+      readonly name: string;
+      readonly updatedAt: any;
+      readonly websiteUrl: string;
+    };
+  };
+};
+export type TrustCenterReferenceGraphUpdateMutation = {
+  response: TrustCenterReferenceGraphUpdateMutation$data;
+  variables: TrustCenterReferenceGraphUpdateMutation$variables;
+};
+
+const node: ConcreteRequest = (function(){
+var v0 = [
+  {
+    "defaultValue": null,
+    "kind": "LocalArgument",
+    "name": "input"
+  }
+],
+v1 = [
+  {
+    "alias": null,
+    "args": [
+      {
+        "kind": "Variable",
+        "name": "input",
+        "variableName": "input"
+      }
+    ],
+    "concreteType": "UpdateTrustCenterReferencePayload",
+    "kind": "LinkedField",
+    "name": "updateTrustCenterReference",
+    "plural": false,
+    "selections": [
+      {
+        "alias": null,
+        "args": null,
+        "concreteType": "TrustCenterReference",
+        "kind": "LinkedField",
+        "name": "trustCenterReference",
+        "plural": false,
+        "selections": [
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "id",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "name",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "description",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "websiteUrl",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "logoUrl",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "createdAt",
+            "storageKey": null
+          },
+          {
+            "alias": null,
+            "args": null,
+            "kind": "ScalarField",
+            "name": "updatedAt",
+            "storageKey": null
+          }
+        ],
+        "storageKey": null
+      }
+    ],
+    "storageKey": null
+  }
+];
+return {
+  "fragment": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Fragment",
+    "metadata": null,
+    "name": "TrustCenterReferenceGraphUpdateMutation",
+    "selections": (v1/*: any*/),
+    "type": "Mutation",
+    "abstractKey": null
+  },
+  "kind": "Request",
+  "operation": {
+    "argumentDefinitions": (v0/*: any*/),
+    "kind": "Operation",
+    "name": "TrustCenterReferenceGraphUpdateMutation",
+    "selections": (v1/*: any*/)
+  },
+  "params": {
+    "cacheID": "e5fa3bdb21897523c1491d6cfbf816cf",
+    "id": null,
+    "metadata": {},
+    "name": "TrustCenterReferenceGraphUpdateMutation",
+    "operationKind": "mutation",
+    "text": "mutation TrustCenterReferenceGraphUpdateMutation(\n  $input: UpdateTrustCenterReferenceInput!\n) {\n  updateTrustCenterReference(input: $input) {\n    trustCenterReference {\n      id\n      name\n      description\n      websiteUrl\n      logoUrl\n      createdAt\n      updatedAt\n    }\n  }\n}\n"
+  }
+};
+})();
+
+(node as any).hash = "2340a9c559d302025df08a5748c18b80";
+
+export default node;

apps/console/src/hooks/useTrustCenterQueries.ts

@@ -222,6 +222,17 @@ const TRUST_CENTER_QUERY = `
           }
         }
       }
+      references(first: 100) {
+        edges {
+          node {
+            id
+            name
+            description
+            websiteUrl
+            logoUrl
+          }
+        }
+      }
     }
   }
 `;

apps/console/src/pages/organizations/trustCenter/TrustCenterPage.tsx

@@ -21,6 +21,7 @@ import type { TrustCenterGraphQuery } from "/hooks/graph/__generated__/TrustCent
 import { useState } from "react";
 import { useOrganizationId } from "/hooks/useOrganizationId";
 import { Outlet, useLocation, Link } from "react-router";
+import { TrustCenterReferencesSection } from "/components/trustCenter/TrustCenterReferencesSection";
 
 type Props = {
   queryRef: PreloadedQuery<TrustCenterGraphQuery>;
@@ -328,6 +329,10 @@ export default function TrustCenterPage({ queryRef }: Props) {
         </Card>
       </div>
 
+      {organization.trustCenter?.id && (
+        <TrustCenterReferencesSection trustCenterId={organization.trustCenter.id} />
+      )}
+
       <div className="space-y-4">
         <Tabs>
           <TabItem

packages/helpers/src/dom.ts

@@ -20,3 +20,16 @@ export function downloadFile(url: string | undefined | null, filename: string) {
     link.click();
     document.body.removeChild(link);
 }
+
+export function safeOpenUrl(url: string) {
+    try {
+        const parsedUrl = new URL(url);
+        if (parsedUrl.protocol === 'http:' || parsedUrl.protocol === 'https:') {
+            window.open(url, '_blank', 'noopener,noreferrer');
+        } else {
+            console.error('Invalid URL protocol. Only HTTP and HTTPS URLs are allowed:', url);
+        }
+    } catch (error) {
+        console.error('Invalid URL format:', url, error);
+    }
+}

packages/helpers/src/index.ts

@@ -6,7 +6,7 @@ export {
     getRiskLikelihoods,
     getSeverity,
 } from "./risk";
-export { withViewTransition, downloadFile } from "./dom";
+export { withViewTransition, downloadFile, safeOpenUrl } from "./dom";
 export { times, groupBy, isEmpty } from "./array";
 export { randomInt } from "./number";
 export { getMeasureStateLabel, measureStates } from "./measure";

pkg/coredata/entity_type_reg.go

@@ -56,4 +56,5 @@ const (
 	ContinualImprovementEntityType
 	ProcessingActivityEntityType
 	ExportJobEntityType
+	TrustCenterReferenceEntityType
 )

pkg/coredata/migrations/20250919T142754Z.sql

@@ -0,0 +1,13 @@
+CREATE TABLE trust_center_references (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    trust_center_id TEXT NOT NULL REFERENCES trust_centers(id)
+        ON UPDATE CASCADE ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    description TEXT NOT NULL,
+    website_url TEXT NOT NULL,
+    logo_file_id TEXT NOT NULL REFERENCES files(id)
+        ON UPDATE CASCADE ON DELETE RESTRICT,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL
+);

pkg/coredata/trust_center_reference.go

@@ -0,0 +1,304 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	TrustCenterReference struct {
+		ID            gid.GID   `db:"id"`
+		TrustCenterID gid.GID   `db:"trust_center_id"`
+		Name          string    `db:"name"`
+		Description   string    `db:"description"`
+		WebsiteURL    string    `db:"website_url"`
+		LogoFileID    gid.GID   `db:"logo_file_id"`
+		CreatedAt     time.Time `db:"created_at"`
+		UpdatedAt     time.Time `db:"updated_at"`
+	}
+
+	TrustCenterReferences []*TrustCenterReference
+)
+
+func (t TrustCenterReference) CursorKey(orderBy TrustCenterReferenceOrderField) page.CursorKey {
+	switch orderBy {
+	case TrustCenterReferenceOrderFieldName:
+		return page.NewCursorKey(t.ID, t.Name)
+	case TrustCenterReferenceOrderFieldCreatedAt:
+		return page.NewCursorKey(t.ID, t.CreatedAt)
+	case TrustCenterReferenceOrderFieldUpdatedAt:
+		return page.NewCursorKey(t.ID, t.UpdatedAt)
+	}
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (t *TrustCenterReference) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterReferenceID gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    trust_center_id,
+    name,
+    description,
+    website_url,
+    logo_file_id,
+    created_at,
+    updated_at
+FROM
+    trust_center_references
+WHERE
+    %s
+    AND id = @trust_center_reference_id
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"trust_center_reference_id": trustCenterReferenceID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query trust_center_references: %w", err)
+	}
+
+	reference, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[TrustCenterReference])
+	if err != nil {
+		return fmt.Errorf("cannot collect trust center reference: %w", err)
+	}
+
+	*t = reference
+
+	return nil
+}
+
+func (t TrustCenterReference) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    trust_center_references (
+        tenant_id,
+        id,
+        trust_center_id,
+        name,
+        description,
+        website_url,
+        logo_file_id,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @tenant_id,
+    @id,
+    @trust_center_id,
+    @name,
+    @description,
+    @website_url,
+    @logo_file_id,
+    @created_at,
+    @updated_at
+);
+`
+
+	args := pgx.StrictNamedArgs{
+		"tenant_id":       scope.GetTenantID(),
+		"id":              t.ID,
+		"trust_center_id": t.TrustCenterID,
+		"name":            t.Name,
+		"description":     t.Description,
+		"website_url":     t.WebsiteURL,
+		"logo_file_id":    t.LogoFileID,
+		"created_at":      t.CreatedAt,
+		"updated_at":      t.UpdatedAt,
+	}
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot insert trust center reference: %w", err)
+	}
+
+	return nil
+}
+
+func (t *TrustCenterReference) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE trust_center_references
+SET
+    name = @name,
+    description = @description,
+    website_url = @website_url,
+    logo_file_id = @logo_file_id,
+    updated_at = @updated_at
+WHERE
+    %s
+    AND id = @id
+RETURNING
+    id,
+    trust_center_id,
+    name,
+    description,
+    website_url,
+    logo_file_id,
+    created_at,
+    updated_at
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":           t.ID,
+		"name":         t.Name,
+		"description":  t.Description,
+		"website_url":  t.WebsiteURL,
+		"logo_file_id": t.LogoFileID,
+		"updated_at":   t.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update trust center reference: %w", err)
+	}
+
+	reference, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[TrustCenterReference])
+	if err != nil {
+		return fmt.Errorf("cannot collect updated trust center reference: %w", err)
+	}
+
+	*t = reference
+
+	return nil
+}
+
+func (t *TrustCenterReference) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM
+    trust_center_references
+WHERE
+    %s
+    AND id = @id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": t.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete trust center reference: %w", err)
+	}
+
+	return nil
+}
+
+func (t *TrustCenterReferences) LoadByTrustCenterID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterID gid.GID,
+	cursor *page.Cursor[TrustCenterReferenceOrderField],
+) error {
+	q := `
+SELECT
+    id,
+    trust_center_id,
+    name,
+    description,
+    website_url,
+    logo_file_id,
+    created_at,
+    updated_at
+FROM
+    trust_center_references
+WHERE
+    %s
+    AND trust_center_id = @trust_center_id
+    AND %s
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"trust_center_id": trustCenterID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query trust_center_references: %w", err)
+	}
+
+	references, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[TrustCenterReference])
+	if err != nil {
+		return fmt.Errorf("cannot collect trust center references: %w", err)
+	}
+
+	*t = references
+
+	return nil
+}
+
+func (t *TrustCenterReferences) CountByTrustCenterID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterID gid.GID,
+) (int, error) {
+	q := `
+SELECT
+    COUNT(*)
+FROM
+    trust_center_references
+WHERE
+    %s
+    AND trust_center_id = @trust_center_id
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"trust_center_id": trustCenterID}
+	maps.Copy(args, scope.SQLArguments())
+
+	var count int
+	err := conn.QueryRow(ctx, q, args).Scan(&count)
+	if err != nil {
+		return 0, fmt.Errorf("cannot count trust center references: %w", err)
+	}
+
+	return count, nil
+}

pkg/coredata/trust_center_reference_order_field.go

@@ -0,0 +1,51 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package coredata
+
+type (
+	TrustCenterReferenceOrderField string
+)
+
+const (
+	TrustCenterReferenceOrderFieldName      TrustCenterReferenceOrderField = "NAME"
+	TrustCenterReferenceOrderFieldCreatedAt TrustCenterReferenceOrderField = "CREATED_AT"
+	TrustCenterReferenceOrderFieldUpdatedAt TrustCenterReferenceOrderField = "UPDATED_AT"
+)
+
+func (p TrustCenterReferenceOrderField) Column() string {
+	switch p {
+	case TrustCenterReferenceOrderFieldName:
+		return "name"
+	case TrustCenterReferenceOrderFieldCreatedAt:
+		return "created_at"
+	case TrustCenterReferenceOrderFieldUpdatedAt:
+		return "updated_at"
+	default:
+		return string(p)
+	}
+}
+
+func (p TrustCenterReferenceOrderField) String() string {
+	return string(p)
+}
+
+func (p TrustCenterReferenceOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *TrustCenterReferenceOrderField) UnmarshalText(text []byte) error {
+	*p = TrustCenterReferenceOrderField(text)
+	return nil
+}

pkg/probo/service.go

@@ -88,6 +88,7 @@ type (
 		Reports                           *ReportService
 		TrustCenters                      *TrustCenterService
 		TrustCenterAccesses               *TrustCenterAccessService
+		TrustCenterReferences             *TrustCenterReferenceService
 		Nonconformities                   *NonconformityService
 		Obligations                       *ObligationService
 		Snapshots                         *SnapshotService
@@ -186,6 +187,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.Reports = &ReportService{svc: tenantService}
 	tenantService.TrustCenters = &TrustCenterService{svc: tenantService}
 	tenantService.TrustCenterAccesses = &TrustCenterAccessService{svc: tenantService, usrmgr: s.usrmgr}
+	tenantService.TrustCenterReferences = &TrustCenterReferenceService{svc: tenantService}
 	tenantService.Nonconformities = &NonconformityService{svc: tenantService}
 	tenantService.Obligations = &ObligationService{svc: tenantService}
 	tenantService.Snapshots = &SnapshotService{svc: tenantService}

pkg/probo/trust_center_reference_service.go

@@ -0,0 +1,408 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package probo
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"mime"
+	"net/url"
+	"path/filepath"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"go.gearno.de/crypto/uuid"
+	"go.gearno.de/kit/pg"
+)
+
+type (
+	TrustCenterReferenceService struct {
+		svc *TenantService
+	}
+
+	CreateTrustCenterReferenceRequest struct {
+		TrustCenterID gid.GID
+		Name          string
+		Description   string
+		WebsiteURL    string
+		LogoFile      File
+	}
+
+	UpdateTrustCenterReferenceRequest struct {
+		ID          gid.GID
+		Name        *string
+		Description *string
+		WebsiteURL  *string
+		LogoFile    *File
+	}
+
+	DeleteTrustCenterReferenceRequest struct {
+		ID gid.GID
+	}
+)
+
+func (s TrustCenterReferenceService) ListForTrustCenterID(
+	ctx context.Context,
+	trustCenterID gid.GID,
+	cursor *page.Cursor[coredata.TrustCenterReferenceOrderField],
+) (*page.Page[*coredata.TrustCenterReference, coredata.TrustCenterReferenceOrderField], error) {
+	var references coredata.TrustCenterReferences
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		err := references.LoadByTrustCenterID(ctx, conn, s.svc.scope, trustCenterID, cursor)
+		if err != nil {
+			return fmt.Errorf("cannot load trust center references: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(references, cursor), nil
+}
+
+func (s TrustCenterReferenceService) CountForTrustCenterID(
+	ctx context.Context,
+	trustCenterID gid.GID,
+) (int, error) {
+	var count int
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) (err error) {
+		references := coredata.TrustCenterReferences{}
+		count, err = references.CountByTrustCenterID(ctx, conn, s.svc.scope, trustCenterID)
+		if err != nil {
+			return fmt.Errorf("cannot count trust center references: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return 0, err
+	}
+
+	return count, nil
+}
+
+func (s TrustCenterReferenceService) Get(
+	ctx context.Context,
+	referenceID gid.GID,
+) (*coredata.TrustCenterReference, error) {
+	var reference coredata.TrustCenterReference
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		err := reference.LoadByID(ctx, conn, s.svc.scope, referenceID)
+		if err != nil {
+			return fmt.Errorf("cannot load trust center reference: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return &reference, nil
+}
+
+func (s TrustCenterReferenceService) Create(
+	ctx context.Context,
+	req *CreateTrustCenterReferenceRequest,
+) (*coredata.TrustCenterReference, error) {
+	if req.Name == "" {
+		return nil, fmt.Errorf("name is required")
+	}
+
+	if req.WebsiteURL == "" {
+		return nil, fmt.Errorf("website URL is required")
+	}
+
+	now := time.Now()
+
+	referenceID := gid.New(s.svc.scope.GetTenantID(), coredata.TrustCenterReferenceEntityType)
+
+	var reference *coredata.TrustCenterReference
+
+	var logoKey string
+
+	err := s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
+		fileID, s3Key, err := s.uploadLogoFile(ctx, tx, req.LogoFile, referenceID, now)
+		if err != nil {
+			return fmt.Errorf("cannot upload logo file: %w", err)
+		}
+		logoKey = s3Key
+
+		reference = &coredata.TrustCenterReference{
+			ID:            referenceID,
+			TrustCenterID: req.TrustCenterID,
+			Name:          req.Name,
+			Description:   req.Description,
+			WebsiteURL:    req.WebsiteURL,
+			LogoFileID:    fileID,
+			CreatedAt:     now,
+			UpdatedAt:     now,
+		}
+
+		if err := reference.Insert(ctx, tx, s.svc.scope); err != nil {
+			return fmt.Errorf("cannot insert trust center reference: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		s.cleanupS3Object(ctx, logoKey)
+		return nil, err
+	}
+
+	return reference, nil
+}
+
+func (s TrustCenterReferenceService) Update(
+	ctx context.Context,
+	req *UpdateTrustCenterReferenceRequest,
+) (*coredata.TrustCenterReference, error) {
+	now := time.Now()
+
+	var reference *coredata.TrustCenterReference
+	var newFileID *gid.GID
+
+	if req.Name != nil && *req.Name == "" {
+		return nil, fmt.Errorf("name is required")
+	}
+
+	if req.WebsiteURL != nil && *req.WebsiteURL == "" {
+		return nil, fmt.Errorf("website URL is required")
+	}
+
+	var logoKey string
+
+	err := s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
+		if req.LogoFile != nil {
+			fileID, s3Key, err := s.uploadLogoFile(ctx, tx, *req.LogoFile, req.ID, now)
+			if err != nil {
+				return fmt.Errorf("cannot upload logo file: %w", err)
+			}
+			newFileID = &fileID
+			logoKey = s3Key
+		}
+
+		reference = &coredata.TrustCenterReference{}
+
+		if err := reference.LoadByID(ctx, tx, s.svc.scope, req.ID); err != nil {
+			return fmt.Errorf("cannot load trust center reference: %w", err)
+		}
+
+		if req.Name != nil {
+			reference.Name = *req.Name
+		}
+		if req.Description != nil {
+			reference.Description = *req.Description
+		}
+		if req.WebsiteURL != nil {
+			reference.WebsiteURL = *req.WebsiteURL
+		}
+		if newFileID != nil {
+			reference.LogoFileID = *newFileID
+		}
+		reference.UpdatedAt = now
+
+		if err := reference.Update(ctx, tx, s.svc.scope); err != nil {
+			return fmt.Errorf("cannot update trust center reference: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		s.cleanupS3Object(ctx, logoKey)
+		return nil, err
+	}
+
+	return reference, nil
+}
+
+func (s TrustCenterReferenceService) Delete(
+	ctx context.Context,
+	req *DeleteTrustCenterReferenceRequest,
+) error {
+	err := s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
+		reference := &coredata.TrustCenterReference{}
+
+		if err := reference.LoadByID(ctx, tx, s.svc.scope, req.ID); err != nil {
+			return fmt.Errorf("cannot load trust center reference: %w", err)
+		}
+
+		if err := reference.Delete(ctx, tx, s.svc.scope); err != nil {
+			return fmt.Errorf("cannot delete trust center reference: %w", err)
+		}
+
+		return nil
+	})
+
+	return err
+}
+
+func (s TrustCenterReferenceService) GenerateLogoURL(
+	ctx context.Context,
+	referenceID gid.GID,
+	duration time.Duration,
+) (string, error) {
+	reference := &coredata.TrustCenterReference{}
+	file := &coredata.File{}
+	err := s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
+		err := reference.LoadByID(ctx, tx, s.svc.scope, referenceID)
+		if err != nil {
+			return fmt.Errorf("cannot load trust center reference: %w", err)
+		}
+
+		err = file.LoadByID(ctx, tx, s.svc.scope, reference.LogoFileID)
+		if err != nil {
+			return fmt.Errorf("cannot load logo file: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return "", nil
+	}
+
+	presignClient := s3.NewPresignClient(s.svc.s3)
+
+	encodedFilename := url.PathEscape(file.FileName)
+	contentDisposition := fmt.Sprintf("inline; filename=\"%s\"; filename*=UTF-8''%s",
+		encodedFilename, encodedFilename)
+
+	presignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
+		Bucket:                     aws.String(s.svc.bucket),
+		Key:                        aws.String(file.FileKey),
+		ResponseCacheControl:       aws.String("max-age=3600, public"),
+		ResponseContentDisposition: aws.String(contentDisposition),
+	}, func(opts *s3.PresignOptions) {
+		opts.Expires = duration
+	})
+	if err != nil {
+		return "", fmt.Errorf("cannot presign GetObject request: %w", err)
+	}
+
+	return presignedReq.URL, nil
+}
+
+func (s TrustCenterReferenceService) uploadLogoFile(
+	ctx context.Context,
+	tx pg.Conn,
+	file File,
+	referenceID gid.GID,
+	now time.Time,
+) (gid.GID, string, error) {
+	fileID := gid.New(s.svc.scope.GetTenantID(), coredata.FileEntityType)
+
+	objectKey, err := uuid.NewV7()
+	if err != nil {
+		return gid.GID{}, "", fmt.Errorf("cannot generate object key: %w", err)
+	}
+
+	var fileSize int64
+	var fileContent io.ReadSeeker
+	filename := file.Filename
+	contentType := file.ContentType
+
+	if readSeeker, ok := file.Content.(io.ReadSeeker); ok {
+		if file.Size <= 0 {
+			size, err := readSeeker.Seek(0, io.SeekEnd)
+			if err != nil {
+				return gid.GID{}, "", fmt.Errorf("cannot determine file size: %w", err)
+			}
+			fileSize = size
+
+			_, err = readSeeker.Seek(0, io.SeekStart)
+			if err != nil {
+				return gid.GID{}, "", fmt.Errorf("cannot reset file position: %w", err)
+			}
+		} else {
+			fileSize = file.Size
+		}
+		fileContent = readSeeker
+	} else {
+		buf, err := io.ReadAll(file.Content)
+		if err != nil {
+			return gid.GID{}, "", fmt.Errorf("cannot read file: %w", err)
+		}
+		fileSize = int64(len(buf))
+		fileContent = bytes.NewReader(buf)
+	}
+
+	if contentType == "" {
+		contentType = "application/octet-stream"
+		if filename != "" {
+			if detectedType := mime.TypeByExtension(filepath.Ext(filename)); detectedType != "" {
+				contentType = detectedType
+			}
+		}
+	}
+
+	_, err = s.svc.s3.PutObject(ctx, &s3.PutObjectInput{
+		Bucket:      aws.String(s.svc.bucket),
+		Key:         aws.String(objectKey.String()),
+		Body:        fileContent,
+		ContentType: aws.String(contentType),
+		Metadata: map[string]string{
+			"type":                      "trust-center-reference-logo",
+			"trust-center-reference-id": referenceID.String(),
+		},
+	})
+	if err != nil {
+		return gid.GID{}, "", fmt.Errorf("cannot upload logo file to S3: %w", err)
+	}
+
+	fileRecord := &coredata.File{
+		ID:         fileID,
+		BucketName: s.svc.bucket,
+		MimeType:   contentType,
+		FileName:   filename,
+		FileKey:    objectKey.String(),
+		FileSize:   int(fileSize),
+		CreatedAt:  now,
+		UpdatedAt:  now,
+	}
+
+	if err := fileRecord.Insert(ctx, tx, s.svc.scope); err != nil {
+		return gid.GID{}, "", fmt.Errorf("cannot insert file: %w", err)
+	}
+
+	return fileID, objectKey.String(), nil
+}
+
+func (s TrustCenterReferenceService) cleanupS3Object(ctx context.Context, s3Key string) {
+	if s3Key == "" {
+		return
+	}
+
+	s.svc.s3.DeleteObject(ctx, &s3.DeleteObjectInput{
+		Bucket: aws.String(s.svc.bucket),
+		Key:    aws.String(s3Key),
+	})
+}

pkg/server/api/console/v1/schema.graphql

@@ -1106,6 +1106,22 @@ enum TrustCenterAccessOrderField
     )
 }
 
+enum TrustCenterReferenceOrderField
+  @goModel(model: "github.com/getprobo/probo/pkg/coredata.TrustCenterReferenceOrderField") {
+  NAME
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.TrustCenterReferenceOrderFieldName"
+    )
+  CREATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.TrustCenterReferenceOrderFieldCreatedAt"
+    )
+  UPDATED_AT
+    @goEnum(
+      value: "github.com/getprobo/probo/pkg/coredata.TrustCenterReferenceOrderFieldUpdatedAt"
+    )
+}
+
 enum SnapshotsType
   @goModel(model: "github.com/getprobo/probo/pkg/coredata.SnapshotsType") {
   RISKS
@@ -1279,6 +1295,14 @@ input TrustCenterAccessOrder
   field: TrustCenterAccessOrderField!
 }
 
+input TrustCenterReferenceOrder
+  @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.TrustCenterReferenceOrderBy"
+  ) {
+  direction: OrderDirection!
+  field: TrustCenterReferenceOrderField!
+}
+
 input EvidenceOrder
   @goModel(
     model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.EvidenceOrderBy"
@@ -1413,6 +1437,14 @@ type TrustCenter implements Node {
     before: CursorKey
     orderBy: TrustCenterAccessOrder
   ): TrustCenterAccessConnection! @goField(forceResolver: true)
+
+  references(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+    orderBy: TrustCenterReferenceOrder
+  ): TrustCenterReferenceConnection! @goField(forceResolver: true)
 }
 
 type Organization implements Node {
@@ -2168,6 +2200,29 @@ type TrustCenterAccessEdge {
   node: TrustCenterAccess!
 }
 
+type TrustCenterReference implements Node {
+  id: ID!
+  name: String!
+  description: String!
+  websiteUrl: String!
+  logoUrl: String! @goField(forceResolver: true)
+  createdAt: Datetime!
+  updatedAt: Datetime!
+}
+
+type TrustCenterReferenceConnection @goModel(
+    model: "github.com/getprobo/probo/pkg/server/api/console/v1/types.TrustCenterReferenceConnection"
+  ){
+  totalCount: Int! @goField(forceResolver: true)
+  edges: [TrustCenterReferenceEdge!]!
+  pageInfo: PageInfo!
+}
+
+type TrustCenterReferenceEdge {
+  cursor: CursorKey!
+  node: TrustCenterReference!
+}
+
 type UserConnection {
   edges: [UserEdge!]!
   pageInfo: PageInfo!
@@ -2504,6 +2559,19 @@ type Mutation {
     input: DeleteTrustCenterAccessInput!
   ): DeleteTrustCenterAccessPayload!
 
+  # Trust Center Reference mutations
+  createTrustCenterReference(
+    input: CreateTrustCenterReferenceInput!
+  ): CreateTrustCenterReferencePayload!
+
+  updateTrustCenterReference(
+    input: UpdateTrustCenterReferenceInput!
+  ): UpdateTrustCenterReferencePayload!
+
+  deleteTrustCenterReference(
+    input: DeleteTrustCenterReferenceInput!
+  ): DeleteTrustCenterReferencePayload!
+
   # User mutations
   confirmEmail(input: ConfirmEmailInput!): ConfirmEmailPayload!
   inviteUser(input: InviteUserInput!): InviteUserPayload!
@@ -2813,6 +2881,26 @@ input DeleteTrustCenterAccessInput {
   id: ID!
 }
 
+input CreateTrustCenterReferenceInput {
+  trustCenterId: ID!
+  name: String!
+  description: String!
+  websiteUrl: String!
+  logoFile: Upload!
+}
+
+input UpdateTrustCenterReferenceInput {
+  id: ID!
+  name: String
+  description: String
+  websiteUrl: String
+  logoFile: Upload
+}
+
+input DeleteTrustCenterReferenceInput {
+  id: ID!
+}
+
 input CreateVendorInput {
   organizationId: ID!
   name: String!
@@ -3450,6 +3538,18 @@ type DeleteTrustCenterAccessPayload {
   deletedTrustCenterAccessId: ID!
 }
 
+type CreateTrustCenterReferencePayload {
+  trustCenterReferenceEdge: TrustCenterReferenceEdge!
+}
+
+type UpdateTrustCenterReferencePayload {
+  trustCenterReference: TrustCenterReference!
+}
+
+type DeleteTrustCenterReferencePayload {
+  deletedTrustCenterReferenceId: ID!
+}
+
 type CreateControlPayload {
   controlEdge: ControlEdge!
 }

pkg/server/api/console/v1/types/trust_center_access.go

@@ -54,5 +54,3 @@ func NewTrustCenterAccessEdge(tca *coredata.TrustCenterAccess, orderBy coredata.
 		Node:   NewTrustCenterAccess(tca),
 	}
 }
-
-// Types are auto-generated in types.go - only helper functions remain here

pkg/server/api/console/v1/types/trust_center_reference.go

@@ -0,0 +1,65 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+type TrustCenterReferenceOrderBy = OrderBy[coredata.TrustCenterReferenceOrderField]
+
+type TrustCenterReferenceConnection struct {
+	TotalCount int                         `json:"totalCount"`
+	Edges      []*TrustCenterReferenceEdge `json:"edges"`
+	PageInfo   *PageInfo                   `json:"pageInfo"`
+	ParentID   gid.GID                     `json:"-"`
+}
+
+func NewTrustCenterReference(tcc *coredata.TrustCenterReference) *TrustCenterReference {
+	return &TrustCenterReference{
+		ID:          tcc.ID,
+		Name:        tcc.Name,
+		Description: tcc.Description,
+		WebsiteURL:  tcc.WebsiteURL,
+		CreatedAt:   tcc.CreatedAt,
+		UpdatedAt:   tcc.UpdatedAt,
+	}
+}
+
+func NewTrustCenterReferenceConnection(
+	p *page.Page[*coredata.TrustCenterReference, coredata.TrustCenterReferenceOrderField],
+	parentID gid.GID,
+) *TrustCenterReferenceConnection {
+	var edges = make([]*TrustCenterReferenceEdge, len(p.Data))
+
+	for i := range edges {
+		edges[i] = NewTrustCenterReferenceEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+
+	return &TrustCenterReferenceConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+		ParentID: parentID,
+	}
+}
+
+func NewTrustCenterReferenceEdge(tcc *coredata.TrustCenterReference, orderBy coredata.TrustCenterReferenceOrderField) *TrustCenterReferenceEdge {
+	return &TrustCenterReferenceEdge{
+		Cursor: tcc.CursorKey(orderBy),
+		Node:   NewTrustCenterReference(tcc),
+	}
+}

pkg/server/api/console/v1/types/types.go

@@ -537,6 +537,18 @@ type CreateTrustCenterAccessPayload struct {
 	TrustCenterAccessEdge *TrustCenterAccessEdge `json:"trustCenterAccessEdge"`
 }
 
+type CreateTrustCenterReferenceInput struct {
+	TrustCenterID gid.GID        `json:"trustCenterId"`
+	Name          string         `json:"name"`
+	Description   string         `json:"description"`
+	WebsiteURL    string         `json:"websiteUrl"`
+	LogoFile      graphql.Upload `json:"logoFile"`
+}
+
+type CreateTrustCenterReferencePayload struct {
+	TrustCenterReferenceEdge *TrustCenterReferenceEdge `json:"trustCenterReferenceEdge"`
+}
+
 type CreateVendorContactInput struct {
 	VendorID gid.GID `json:"vendorId"`
 	FullName *string `json:"fullName,omitempty"`
@@ -852,6 +864,14 @@ type DeleteTrustCenterNDAPayload struct {
 	TrustCenter *TrustCenter `json:"trustCenter"`
 }
 
+type DeleteTrustCenterReferenceInput struct {
+	ID gid.GID `json:"id"`
+}
+
+type DeleteTrustCenterReferencePayload struct {
+	DeletedTrustCenterReferenceID gid.GID `json:"deletedTrustCenterReferenceId"`
+}
+
 type DeleteVendorBusinessAssociateAgreementInput struct {
 	VendorID gid.GID `json:"vendorId"`
 }
@@ -1461,15 +1481,16 @@ type TaskEdge struct {
 }
 
 type TrustCenter struct {
-	ID           gid.GID                      `json:"id"`
+	ID           gid.GID                         `json:"id"`
-	Active       bool                         `json:"active"`
+	Active       bool                            `json:"active"`
-	Slug         string                       `json:"slug"`
+	Slug         string                          `json:"slug"`
-	NdaFileName  *string                      `json:"ndaFileName,omitempty"`
+	NdaFileName  *string                         `json:"ndaFileName,omitempty"`
-	NdaFileURL   *string                      `json:"ndaFileUrl,omitempty"`
+	NdaFileURL   *string                         `json:"ndaFileUrl,omitempty"`
-	CreatedAt    time.Time                    `json:"createdAt"`
+	CreatedAt    time.Time                       `json:"createdAt"`
-	UpdatedAt    time.Time                    `json:"updatedAt"`
+	UpdatedAt    time.Time                       `json:"updatedAt"`
-	Organization *Organization                `json:"organization"`
+	Organization *Organization                   `json:"organization"`
-	Accesses     *TrustCenterAccessConnection `json:"accesses"`
+	Accesses     *TrustCenterAccessConnection    `json:"accesses"`
+	References   *TrustCenterReferenceConnection `json:"references"`
 }
 
 func (TrustCenter) IsNode()             {}
@@ -1508,6 +1529,24 @@ type TrustCenterEdge struct {
 	Node   *TrustCenter   `json:"node"`
 }
 
+type TrustCenterReference struct {
+	ID          gid.GID   `json:"id"`
+	Name        string    `json:"name"`
+	Description string    `json:"description"`
+	WebsiteURL  string    `json:"websiteUrl"`
+	LogoURL     string    `json:"logoUrl"`
+	CreatedAt   time.Time `json:"createdAt"`
+	UpdatedAt   time.Time `json:"updatedAt"`
+}
+
+func (TrustCenterReference) IsNode()             {}
+func (this TrustCenterReference) GetID() gid.GID { return this.ID }
+
+type TrustCenterReferenceEdge struct {
+	Cursor page.CursorKey        `json:"cursor"`
+	Node   *TrustCenterReference `json:"node"`
+}
+
 type UnassignTaskInput struct {
 	TaskID gid.GID `json:"taskId"`
 }
@@ -1767,6 +1806,18 @@ type UpdateTrustCenterPayload struct {
 	TrustCenter *TrustCenter `json:"trustCenter"`
 }
 
+type UpdateTrustCenterReferenceInput struct {
+	ID          gid.GID         `json:"id"`
+	Name        *string         `json:"name,omitempty"`
+	Description *string         `json:"description,omitempty"`
+	WebsiteURL  *string         `json:"websiteUrl,omitempty"`
+	LogoFile    *graphql.Upload `json:"logoFile,omitempty"`
+}
+
+type UpdateTrustCenterReferencePayload struct {
+	TrustCenterReference *TrustCenterReference `json:"trustCenterReference"`
+}
+
 type UpdateVendorBusinessAssociateAgreementInput struct {
 	VendorID   gid.GID    `json:"vendorId"`
 	ValidFrom  *time.Time `json:"validFrom,omitempty"`

pkg/server/api/console/v1/v1_resolver.go

@@ -1229,6 +1229,77 @@ func (r *mutationResolver) DeleteTrustCenterAccess(ctx context.Context, input ty
 	}, nil
 }
 
+// CreateTrustCenterReference is the resolver for the createTrustCenterReference field.
+func (r *mutationResolver) CreateTrustCenterReference(ctx context.Context, input types.CreateTrustCenterReferenceInput) (*types.CreateTrustCenterReferencePayload, error) {
+	prb := r.ProboService(ctx, input.TrustCenterID.TenantID())
+
+	reference, err := prb.TrustCenterReferences.Create(ctx, &probo.CreateTrustCenterReferenceRequest{
+		TrustCenterID: input.TrustCenterID,
+		Name:          input.Name,
+		Description:   input.Description,
+		WebsiteURL:    input.WebsiteURL,
+		LogoFile: probo.File{
+			Content:     input.LogoFile.File,
+			Filename:    input.LogoFile.Filename,
+			Size:        input.LogoFile.Size,
+			ContentType: input.LogoFile.ContentType,
+		},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot create trust center reference: %w", err)
+	}
+
+	return &types.CreateTrustCenterReferencePayload{
+		TrustCenterReferenceEdge: types.NewTrustCenterReferenceEdge(reference, coredata.TrustCenterReferenceOrderFieldCreatedAt),
+	}, nil
+}
+
+// UpdateTrustCenterReference is the resolver for the updateTrustCenterReference field.
+func (r *mutationResolver) UpdateTrustCenterReference(ctx context.Context, input types.UpdateTrustCenterReferenceInput) (*types.UpdateTrustCenterReferencePayload, error) {
+	prb := r.ProboService(ctx, input.ID.TenantID())
+
+	req := &probo.UpdateTrustCenterReferenceRequest{
+		ID:          input.ID,
+		Name:        input.Name,
+		Description: input.Description,
+		WebsiteURL:  input.WebsiteURL,
+	}
+
+	if input.LogoFile != nil {
+		req.LogoFile = &probo.File{
+			Content:     input.LogoFile.File,
+			Filename:    input.LogoFile.Filename,
+			Size:        input.LogoFile.Size,
+			ContentType: input.LogoFile.ContentType,
+		}
+	}
+
+	reference, err := prb.TrustCenterReferences.Update(ctx, req)
+	if err != nil {
+		return nil, fmt.Errorf("cannot update trust center reference: %w", err)
+	}
+
+	return &types.UpdateTrustCenterReferencePayload{
+		TrustCenterReference: types.NewTrustCenterReference(reference),
+	}, nil
+}
+
+// DeleteTrustCenterReference is the resolver for the deleteTrustCenterReference field.
+func (r *mutationResolver) DeleteTrustCenterReference(ctx context.Context, input types.DeleteTrustCenterReferenceInput) (*types.DeleteTrustCenterReferencePayload, error) {
+	prb := r.ProboService(ctx, input.ID.TenantID())
+
+	err := prb.TrustCenterReferences.Delete(ctx, &probo.DeleteTrustCenterReferenceRequest{
+		ID: input.ID,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("cannot delete trust center reference: %w", err)
+	}
+
+	return &types.DeleteTrustCenterReferencePayload{
+		DeletedTrustCenterReferenceID: input.ID,
+	}, nil
+}
+
 // ConfirmEmail is the resolver for the confirmEmail field.
 func (r *mutationResolver) ConfirmEmail(ctx context.Context, input types.ConfirmEmailInput) (*types.ConfirmEmailPayload, error) {
 	err := r.usrmgrSvc.ConfirmEmail(ctx, input.Token)
@@ -4552,6 +4623,54 @@ func (r *trustCenterResolver) Accesses(ctx context.Context, obj *types.TrustCent
 	return types.NewTrustCenterAccessConnection(result), nil
 }
 
+// References is the resolver for the references field.
+func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterReferenceOrderField]) (*types.TrustCenterReferenceConnection, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.TrustCenterReferenceOrderField]{
+		Field:     coredata.TrustCenterReferenceOrderFieldName,
+		Direction: page.OrderDirectionAsc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.TrustCenterReferenceOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	result, err := prb.TrustCenterReferences.ListForTrustCenterID(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list trust center references: %w", err))
+	}
+
+	return types.NewTrustCenterReferenceConnection(result, obj.ID), nil
+}
+
+// LogoURL is the resolver for the logoUrl field.
+func (r *trustCenterReferenceResolver) LogoURL(ctx context.Context, obj *types.TrustCenterReference) (string, error) {
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	fileURL, err := prb.TrustCenterReferences.GenerateLogoURL(ctx, obj.ID, 1*time.Hour)
+	if err != nil {
+		panic(fmt.Errorf("failed to generate logo URL: %w", err))
+	}
+
+	return fileURL, nil
+}
+
+// TotalCount is the resolver for the totalCount field.
+func (r *trustCenterReferenceConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterReferenceConnection) (int, error) {
+	prb := r.ProboService(ctx, obj.ParentID.TenantID())
+
+	count, err := prb.TrustCenterReferences.CountForTrustCenterID(ctx, obj.ParentID)
+	if err != nil {
+		panic(fmt.Errorf("cannot count trust center references: %w", err))
+	}
+	return count, nil
+}
+
 // People is the resolver for the people field.
 func (r *userResolver) People(ctx context.Context, obj *types.User, organizationID gid.GID) (*types.People, error) {
 	prb := r.ProboService(ctx, organizationID.TenantID())
@@ -5082,6 +5201,16 @@ func (r *Resolver) TaskConnection() schema.TaskConnectionResolver { return &task
 // TrustCenter returns schema.TrustCenterResolver implementation.
 func (r *Resolver) TrustCenter() schema.TrustCenterResolver { return &trustCenterResolver{r} }
 
+// TrustCenterReference returns schema.TrustCenterReferenceResolver implementation.
+func (r *Resolver) TrustCenterReference() schema.TrustCenterReferenceResolver {
+	return &trustCenterReferenceResolver{r}
+}
+
+// TrustCenterReferenceConnection returns schema.TrustCenterReferenceConnectionResolver implementation.
+func (r *Resolver) TrustCenterReferenceConnection() schema.TrustCenterReferenceConnectionResolver {
+	return &trustCenterReferenceConnectionResolver{r}
+}
+
 // User returns schema.UserResolver implementation.
 func (r *Resolver) User() schema.UserResolver { return &userResolver{r} }
 
@@ -5160,6 +5289,8 @@ type snapshotConnectionResolver struct{ *Resolver }
 type taskResolver struct{ *Resolver }
 type taskConnectionResolver struct{ *Resolver }
 type trustCenterResolver struct{ *Resolver }
+type trustCenterReferenceResolver struct{ *Resolver }
+type trustCenterReferenceConnectionResolver struct{ *Resolver }
 type userResolver struct{ *Resolver }
 type vendorResolver struct{ *Resolver }
 type vendorBusinessAssociateAgreementResolver struct{ *Resolver }

pkg/server/api/trust/v1/schema.graphql

@@ -452,6 +452,24 @@ type VendorEdge {
   node: Vendor!
 }
 
+type TrustCenterReference implements Node {
+  id: ID!
+  name: String!
+  description: String!
+  websiteUrl: String!
+  logoUrl: String! @goField(forceResolver: true)
+}
+
+type TrustCenterReferenceConnection {
+  edges: [TrustCenterReferenceEdge!]!
+  pageInfo: PageInfo!
+}
+
+type TrustCenterReferenceEdge {
+  cursor: CursorKey!
+  node: TrustCenterReference!
+}
+
 type TrustCenter implements Node {
   id: ID!
   active: Boolean!
@@ -482,6 +500,13 @@ type TrustCenter implements Node {
     last: Int
     before: CursorKey
   ): VendorConnection! @goField(forceResolver: true)
+
+  references(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): TrustCenterReferenceConnection! @goField(forceResolver: true)
 }
 
 type TrustCenterAccess implements Node {

pkg/server/api/trust/v1/types/trust_center_reference.go

@@ -0,0 +1,49 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/page"
+)
+
+func NewTrustCenterReference(tcc *coredata.TrustCenterReference) *TrustCenterReference {
+	return &TrustCenterReference{
+		ID:          tcc.ID,
+		Name:        tcc.Name,
+		Description: tcc.Description,
+		WebsiteURL:  tcc.WebsiteURL,
+	}
+}
+
+func NewTrustCenterReferenceConnection(p *page.Page[*coredata.TrustCenterReference, coredata.TrustCenterReferenceOrderField]) *TrustCenterReferenceConnection {
+	edges := make([]*TrustCenterReferenceEdge, len(p.Data))
+
+	for i, item := range p.Data {
+		edges[i] = NewTrustCenterReferenceEdge(item, p.Cursor.OrderBy.Field)
+	}
+
+	return &TrustCenterReferenceConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+	}
+}
+
+func NewTrustCenterReferenceEdge(tcc *coredata.TrustCenterReference, orderBy coredata.TrustCenterReferenceOrderField) *TrustCenterReferenceEdge {
+	return &TrustCenterReferenceEdge{
+		Cursor: tcc.CursorKey(orderBy),
+		Node:   NewTrustCenterReference(tcc),
+	}
+}

pkg/server/api/trust/v1/types/types.go

@@ -134,17 +134,18 @@ func (Report) IsNode()             {}
 func (this Report) GetID() gid.GID { return this.ID }
 
 type TrustCenter struct {
-	ID                                gid.GID             `json:"id"`
+	ID                                gid.GID                         `json:"id"`
-	Active                            bool                `json:"active"`
+	Active                            bool                            `json:"active"`
-	Slug                              string              `json:"slug"`
+	Slug                              string                          `json:"slug"`
-	NdaFileName                       *string             `json:"ndaFileName,omitempty"`
+	NdaFileName                       *string                         `json:"ndaFileName,omitempty"`
-	NdaFileURL                        *string             `json:"ndaFileUrl,omitempty"`
+	NdaFileURL                        *string                         `json:"ndaFileUrl,omitempty"`
-	Organization                      *Organization       `json:"organization"`
+	Organization                      *Organization                   `json:"organization"`
-	IsUserAuthenticated               bool                `json:"isUserAuthenticated"`
+	IsUserAuthenticated               bool                            `json:"isUserAuthenticated"`
-	HasAcceptedNonDisclosureAgreement bool                `json:"hasAcceptedNonDisclosureAgreement"`
+	HasAcceptedNonDisclosureAgreement bool                            `json:"hasAcceptedNonDisclosureAgreement"`
-	Documents                         *DocumentConnection `json:"documents"`
+	Documents                         *DocumentConnection             `json:"documents"`
-	Audits                            *AuditConnection    `json:"audits"`
+	Audits                            *AuditConnection                `json:"audits"`
-	Vendors                           *VendorConnection   `json:"vendors"`
+	Vendors                           *VendorConnection               `json:"vendors"`
+	References                        *TrustCenterReferenceConnection `json:"references"`
 }
 
 func (TrustCenter) IsNode()             {}
@@ -161,6 +162,27 @@ type TrustCenterAccess struct {
 func (TrustCenterAccess) IsNode()             {}
 func (this TrustCenterAccess) GetID() gid.GID { return this.ID }
 
+type TrustCenterReference struct {
+	ID          gid.GID `json:"id"`
+	Name        string  `json:"name"`
+	Description string  `json:"description"`
+	WebsiteURL  string  `json:"websiteUrl"`
+	LogoURL     string  `json:"logoUrl"`
+}
+
+func (TrustCenterReference) IsNode()             {}
+func (this TrustCenterReference) GetID() gid.GID { return this.ID }
+
+type TrustCenterReferenceConnection struct {
+	Edges    []*TrustCenterReferenceEdge `json:"edges"`
+	PageInfo *PageInfo                   `json:"pageInfo"`
+}
+
+type TrustCenterReferenceEdge struct {
+	Cursor page.CursorKey        `json:"cursor"`
+	Node   *TrustCenterReference `json:"node"`
+}
+
 type Vendor struct {
 	ID               gid.GID                 `json:"id"`
 	Name             string                  `json:"name"`

pkg/server/api/trust/v1/v1_resolver.go

@@ -330,6 +330,36 @@ func (r *trustCenterResolver) Vendors(ctx context.Context, obj *types.TrustCente
 	return types.NewVendorConnection(vendorPage), nil
 }
 
+// References is the resolver for the references field.
+func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TrustCenterReferenceConnection, error) {
+	publicTrustService := r.PublicTrustService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.TrustCenterReferenceOrderField]{
+		Field:     coredata.TrustCenterReferenceOrderFieldCreatedAt,
+		Direction: page.OrderDirectionDesc,
+	}
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	referencePage, err := publicTrustService.TrustCenterReferences.ListForTrustCenterID(ctx, obj.ID, cursor)
+	if err != nil {
+		panic(fmt.Errorf("cannot list public trust center references: %w", err))
+	}
+
+	return types.NewTrustCenterReferenceConnection(referencePage), nil
+}
+
+// LogoURL is the resolver for the logoUrl field.
+func (r *trustCenterReferenceResolver) LogoURL(ctx context.Context, obj *types.TrustCenterReference) (string, error) {
+	publicTrustService := r.PublicTrustService(ctx, obj.ID.TenantID())
+
+	logoURL, err := publicTrustService.TrustCenterReferences.GenerateLogoURL(ctx, obj.ID, 1*time.Hour)
+	if err != nil {
+		panic(fmt.Errorf("cannot generate logo URL: %w", err))
+	}
+
+	return logoURL, nil
+}
+
 // Audit returns schema.AuditResolver implementation.
 func (r *Resolver) Audit() schema.AuditResolver { return &auditResolver{r} }
 
@@ -345,8 +375,14 @@ func (r *Resolver) Query() schema.QueryResolver { return &queryResolver{r} }
 // TrustCenter returns schema.TrustCenterResolver implementation.
 func (r *Resolver) TrustCenter() schema.TrustCenterResolver { return &trustCenterResolver{r} }
 
+// TrustCenterReference returns schema.TrustCenterReferenceResolver implementation.
+func (r *Resolver) TrustCenterReference() schema.TrustCenterReferenceResolver {
+	return &trustCenterReferenceResolver{r}
+}
+
 type auditResolver struct{ *Resolver }
 type mutationResolver struct{ *Resolver }
 type organizationResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type trustCenterResolver struct{ *Resolver }
+type trustCenterReferenceResolver struct{ *Resolver }

pkg/trust/service.go

@@ -53,6 +53,7 @@ type (
 		Vendors             *VendorService
 		Frameworks          *FrameworkService
 		TrustCenterAccesses *TrustCenterAccessService
+		TrustCenterReferences *TrustCenterReferenceService
 		Reports             *ReportService
 		Organizations       *OrganizationService
 	}
@@ -97,6 +98,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.Vendors = &VendorService{svc: tenantService}
 	tenantService.Frameworks = &FrameworkService{svc: tenantService}
 	tenantService.TrustCenterAccesses = &TrustCenterAccessService{svc: tenantService, usrmgr: s.usrmgr}
+	tenantService.TrustCenterReferences = &TrustCenterReferenceService{svc: tenantService}
 	tenantService.Reports = &ReportService{svc: tenantService}
 	tenantService.Organizations = &OrganizationService{svc: tenantService}
 

pkg/trust/trust_center_reference_service.go

@@ -0,0 +1,102 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package trust
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/getprobo/probo/pkg/coredata"
+	"github.com/getprobo/probo/pkg/gid"
+	"github.com/getprobo/probo/pkg/page"
+	"go.gearno.de/kit/pg"
+)
+
+type TrustCenterReferenceService struct {
+	svc *TenantService
+}
+
+func (s TrustCenterReferenceService) ListForTrustCenterID(
+	ctx context.Context,
+	trustCenterID gid.GID,
+	cursor *page.Cursor[coredata.TrustCenterReferenceOrderField],
+) (*page.Page[*coredata.TrustCenterReference, coredata.TrustCenterReferenceOrderField], error) {
+	var references coredata.TrustCenterReferences
+
+	err := s.svc.pg.WithConn(ctx, func(conn pg.Conn) error {
+		err := references.LoadByTrustCenterID(ctx, conn, s.svc.scope, trustCenterID, cursor)
+		if err != nil {
+			return fmt.Errorf("cannot load trust center references: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(references, cursor), nil
+}
+
+func (s TrustCenterReferenceService) GenerateLogoURL(
+	ctx context.Context,
+	referenceID gid.GID,
+	duration time.Duration,
+) (string, error) {
+	reference := &coredata.TrustCenterReference{}
+	file := &coredata.File{}
+	err := s.svc.pg.WithTx(ctx, func(tx pg.Conn) error {
+		err := reference.LoadByID(ctx, tx, s.svc.scope, referenceID)
+		if err != nil {
+			return fmt.Errorf("cannot load trust center reference: %w", err)
+		}
+
+		err = file.LoadByID(ctx, tx, s.svc.scope, reference.LogoFileID)
+		if err != nil {
+			return fmt.Errorf("cannot load logo file: %w", err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return "", nil
+	}
+
+	presignClient := s3.NewPresignClient(s.svc.s3)
+
+	encodedFilename := url.PathEscape(file.FileName)
+	contentDisposition := fmt.Sprintf("inline; filename=\"%s\"; filename*=UTF-8''%s",
+		encodedFilename, encodedFilename)
+
+	presignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
+		Bucket:                     aws.String(s.svc.bucket),
+		Key:                        aws.String(file.FileKey),
+		ResponseCacheControl:       aws.String("max-age=3600, public"),
+		ResponseContentDisposition: aws.String(contentDisposition),
+	}, func(opts *s3.PresignOptions) {
+		opts.Expires = duration
+	})
+	if err != nil {
+		return "", fmt.Errorf("cannot presign GetObject request: %w", err)
+	}
+
+	return presignedReq.URL, nil
+}