Add social links

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
2026-03-09 09:28:12 +01:00
parent 87415c0324
commit fe241fc136
42 changed files with 5428 additions and 415 deletions
--- a/pkg/coredata/compliance_external_url.go
+++ b/pkg/coredata/compliance_external_url.go
@@ -0,0 +1,303 @@
+package coredata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type (
+	ComplianceExternalURL struct {
+		ID             gid.GID   `db:"id"`
+		OrganizationID gid.GID   `db:"organization_id"`
+		TrustCenterID  gid.GID   `db:"trust_center_id"`
+		Name           string    `db:"name"`
+		URL            string    `db:"url"`
+		Rank           int       `db:"rank"`
+		CreatedAt      time.Time `db:"created_at"`
+		UpdatedAt      time.Time `db:"updated_at"`
+	}
+
+	ComplianceExternalURLs []*ComplianceExternalURL
+)
+
+func (c ComplianceExternalURL) CursorKey(orderBy ComplianceExternalURLOrderField) page.CursorKey {
+	switch orderBy {
+	case ComplianceExternalURLOrderFieldCreatedAt:
+		return page.NewCursorKey(c.ID, c.CreatedAt)
+	case ComplianceExternalURLOrderFieldRank:
+		return page.NewCursorKey(c.ID, c.Rank)
+	}
+	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+}
+
+func (c *ComplianceExternalURL) AuthorizationAttributes(ctx context.Context, conn pg.Conn) (map[string]string, error) {
+	q := `SELECT organization_id FROM compliance_external_urls WHERE id = $1 LIMIT 1;`
+
+	var organizationID gid.GID
+	if err := conn.QueryRow(ctx, q, c.ID).Scan(&organizationID); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrResourceNotFound
+		}
+		return nil, fmt.Errorf("cannot query compliance external URL authorization attributes: %w", err)
+	}
+
+	return map[string]string{"organization_id": organizationID.String()}, nil
+}
+
+func (c *ComplianceExternalURL) LoadByID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	id gid.GID,
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    trust_center_id,
+    name,
+    url,
+    rank,
+    created_at,
+    updated_at
+FROM
+    compliance_external_urls
+WHERE
+    %s
+    AND id = @id
+LIMIT 1;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": id}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query compliance_external_urls: %w", err)
+	}
+
+	result, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[ComplianceExternalURL])
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return ErrResourceNotFound
+		}
+		return fmt.Errorf("cannot collect compliance external URL: %w", err)
+	}
+
+	*c = result
+
+	return nil
+}
+
+func (c *ComplianceExternalURL) Insert(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+INSERT INTO
+    compliance_external_urls (
+        id,
+        tenant_id,
+        organization_id,
+        trust_center_id,
+        name,
+        url,
+        rank,
+        created_at,
+        updated_at
+    )
+VALUES (
+    @id,
+    @tenant_id,
+    @organization_id,
+    @trust_center_id,
+    @name,
+    @url,
+    (SELECT COALESCE(MAX(rank), 0) + 1 FROM compliance_external_urls WHERE trust_center_id = @trust_center_id),
+    @created_at,
+    @updated_at
+)
+RETURNING rank;
+`
+
+	args := pgx.StrictNamedArgs{
+		"id":              c.ID,
+		"tenant_id":       scope.GetTenantID(),
+		"organization_id": c.OrganizationID,
+		"trust_center_id": c.TrustCenterID,
+		"name":            c.Name,
+		"url":             c.URL,
+		"created_at":      c.CreatedAt,
+		"updated_at":      c.UpdatedAt,
+	}
+
+	if err := conn.QueryRow(ctx, q, args).Scan(&c.Rank); err != nil {
+		return fmt.Errorf("cannot insert compliance external URL: %w", err)
+	}
+
+	return nil
+}
+
+func (c *ComplianceExternalURL) Update(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+UPDATE compliance_external_urls
+SET
+    name = @name,
+    url = @url,
+    updated_at = @updated_at
+WHERE
+    %s
+    AND id = @id;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{
+		"id":         c.ID,
+		"name":       c.Name,
+		"url":        c.URL,
+		"updated_at": c.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update compliance external URL: %w", err)
+	}
+
+	return nil
+}
+
+func (c *ComplianceExternalURL) UpdateRank(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+WITH old AS (
+  SELECT
+    rank AS old_rank
+  FROM compliance_external_urls
+  WHERE %s AND id = @id AND trust_center_id = @trust_center_id
+)
+
+UPDATE compliance_external_urls
+SET
+    rank = CASE
+        WHEN id = @id THEN @new_rank
+        ELSE rank + CASE
+            WHEN @new_rank < old.old_rank THEN 1
+            WHEN @new_rank > old.old_rank THEN -1
+        END
+    END,
+    updated_at = @updated_at
+FROM old
+WHERE %s
+  AND trust_center_id = @trust_center_id
+  AND (
+    id = @id
+    OR (rank BETWEEN LEAST(old.old_rank, @new_rank) AND GREATEST(old.old_rank, @new_rank))
+  );
+`
+
+	scopeFragment := scope.SQLFragment()
+	q = fmt.Sprintf(q, scopeFragment, scopeFragment)
+
+	args := pgx.StrictNamedArgs{
+		"id":              c.ID,
+		"new_rank":        c.Rank,
+		"trust_center_id": c.TrustCenterID,
+		"updated_at":      c.UpdatedAt,
+	}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot update compliance external URL rank: %w", err)
+	}
+
+	return nil
+}
+
+func (c *ComplianceExternalURL) Delete(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
+	q := `
+DELETE FROM
+    compliance_external_urls
+WHERE
+    %s
+    AND id = @id;
+`
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.StrictNamedArgs{"id": c.ID}
+	maps.Copy(args, scope.SQLArguments())
+
+	_, err := conn.Exec(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot delete compliance external URL: %w", err)
+	}
+
+	return nil
+}
+
+func (c *ComplianceExternalURLs) LoadByTrustCenterID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	trustCenterID gid.GID,
+	cursor *page.Cursor[ComplianceExternalURLOrderField],
+) error {
+	q := `
+SELECT
+    id,
+    organization_id,
+    trust_center_id,
+    name,
+    url,
+    rank,
+    created_at,
+    updated_at
+FROM
+    compliance_external_urls
+WHERE
+    %s
+    AND trust_center_id = @trust_center_id
+    AND %s
+`
+	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
+
+	args := pgx.NamedArgs{"trust_center_id": trustCenterID}
+	maps.Copy(args, scope.SQLArguments())
+	maps.Copy(args, cursor.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query compliance_external_urls: %w", err)
+	}
+
+	results, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[ComplianceExternalURL])
+	if err != nil {
+		return fmt.Errorf("cannot collect compliance external URLs: %w", err)
+	}
+
+	*c = results
+
+	return nil
+}
--- a/pkg/coredata/compliance_external_url_order_field.go
+++ b/pkg/coredata/compliance_external_url_order_field.go
@@ -0,0 +1,34 @@
+package coredata
+
+type (
+	ComplianceExternalURLOrderField string
+)
+
+const (
+	ComplianceExternalURLOrderFieldCreatedAt ComplianceExternalURLOrderField = "CREATED_AT"
+	ComplianceExternalURLOrderFieldRank      ComplianceExternalURLOrderField = "RANK"
+)
+
+func (p ComplianceExternalURLOrderField) Column() string {
+	switch p {
+	case ComplianceExternalURLOrderFieldCreatedAt:
+		return "created_at"
+	case ComplianceExternalURLOrderFieldRank:
+		return "rank"
+	default:
+		return string(p)
+	}
+}
+
+func (p ComplianceExternalURLOrderField) String() string {
+	return string(p)
+}
+
+func (p ComplianceExternalURLOrderField) MarshalText() ([]byte, error) {
+	return []byte(p.String()), nil
+}
+
+func (p *ComplianceExternalURLOrderField) UnmarshalText(text []byte) error {
+	*p = ComplianceExternalURLOrderField(text)
+	return nil
+}
--- a/pkg/coredata/entity_type_reg.go
+++ b/pkg/coredata/entity_type_reg.go
@@ -86,6 +86,7 @@ const (
 	ElectronicSignatureEventEntityType         uint16 = 60
 	EmailAttachmentEntityType                  uint16 = 61
 	ComplianceFrameworkEntityType              uint16 = 62
+	ComplianceExternalURLEntityType            uint16 = 63
 )

 func NewEntityFromID(id gid.GID) (any, bool) {
@@ -212,6 +213,8 @@ func NewEntityFromID(id gid.GID) (any, bool) {
 		return &EmailAttachment{ID: id}, true
 	case ComplianceFrameworkEntityType:
 		return &ComplianceFramework{ID: id}, true
+	case ComplianceExternalURLEntityType:
+		return &ComplianceExternalURL{ID: id}, true
 	default:
 		return nil, false
 	}
--- a/pkg/coredata/migrations/20260306T200000Z.sql
+++ b/pkg/coredata/migrations/20260306T200000Z.sql
@@ -0,0 +1,16 @@
+CREATE TABLE compliance_external_urls (
+    id TEXT NOT NULL PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    organization_id TEXT NOT NULL REFERENCES organizations(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    trust_center_id TEXT NOT NULL REFERENCES trust_centers(id) ON UPDATE CASCADE ON DELETE CASCADE,
+    name TEXT NOT NULL,
+    url TEXT NOT NULL,
+    rank INTEGER NOT NULL,
+    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
+    updated_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+
+ALTER TABLE compliance_external_urls
+ADD CONSTRAINT compliance_external_urls_trust_center_id_rank_key
+    UNIQUE (trust_center_id, rank)
+    DEFERRABLE INITIALLY DEFERRED;
--- a/pkg/probo/actions.go
+++ b/pkg/probo/actions.go
@@ -53,6 +53,12 @@ const (
 	ActionComplianceFrameworkDelete     = "core:compliance-framework:delete"
 	ActionComplianceFrameworkUpdateRank = "core:compliance-framework:update-rank"

+	// ComplianceExternalURL actions
+	ActionComplianceExternalURLList   = "core:compliance-external-url:list"
+	ActionComplianceExternalURLCreate = "core:compliance-external-url:create"
+	ActionComplianceExternalURLUpdate = "core:compliance-external-url:update"
+	ActionComplianceExternalURLDelete = "core:compliance-external-url:delete"
+
 	// TrustCenterFile actions
 	ActionTrustCenterFileGet        = "core:trust-center-file:get"
 	ActionTrustCenterFileList       = "core:trust-center-file:list"
--- a/pkg/probo/compliance_external_url_service.go
+++ b/pkg/probo/compliance_external_url_service.go
@@ -0,0 +1,195 @@
+package probo
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+	"go.probo.inc/probo/pkg/validator"
+)
+
+type (
+	ComplianceExternalURLService struct {
+		svc *TenantService
+	}
+
+	CreateComplianceExternalURLRequest struct {
+		TrustCenterID gid.GID
+		Name          string
+		URL           string
+	}
+
+	UpdateComplianceExternalURLRequest struct {
+		ID   gid.GID
+		Name string
+		URL  string
+		Rank *int
+	}
+
+	DeleteComplianceExternalURLRequest struct {
+		ID gid.GID
+	}
+)
+
+func (r *CreateComplianceExternalURLRequest) Validate() error {
+	v := validator.New()
+	v.Check(r.TrustCenterID, "trust_center_id", validator.Required(), validator.GID(coredata.TrustCenterEntityType))
+	v.Check(r.URL, "url", validator.Required(), validator.URL())
+	return v.Error()
+}
+
+func (r *UpdateComplianceExternalURLRequest) Validate() error {
+	v := validator.New()
+	v.Check(r.ID, "id", validator.Required(), validator.GID(coredata.ComplianceExternalURLEntityType))
+	v.Check(r.URL, "url", validator.Required(), validator.URL())
+	v.Check(r.Rank, "rank", validator.Min(1))
+	return v.Error()
+}
+
+func (r *DeleteComplianceExternalURLRequest) Validate() error {
+	v := validator.New()
+	v.Check(r.ID, "id", validator.Required(), validator.GID(coredata.ComplianceExternalURLEntityType))
+	return v.Error()
+}
+
+func (s ComplianceExternalURLService) List(
+	ctx context.Context,
+	trustCenterID gid.GID,
+	cursor *page.Cursor[coredata.ComplianceExternalURLOrderField],
+) (*page.Page[*coredata.ComplianceExternalURL, coredata.ComplianceExternalURLOrderField], error) {
+	var items coredata.ComplianceExternalURLs
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			if err := items.LoadByTrustCenterID(ctx, conn, s.svc.scope, trustCenterID, cursor); err != nil {
+				return fmt.Errorf("cannot load compliance external URLs: %w", err)
+			}
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(items, cursor), nil
+}
+
+func (s ComplianceExternalURLService) Create(
+	ctx context.Context,
+	req *CreateComplianceExternalURLRequest,
+) (*coredata.ComplianceExternalURL, error) {
+	if err := req.Validate(); err != nil {
+		return nil, err
+	}
+
+	now := time.Now()
+	id := gid.New(s.svc.scope.GetTenantID(), coredata.ComplianceExternalURLEntityType)
+
+	var item *coredata.ComplianceExternalURL
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			trustCenter := &coredata.TrustCenter{}
+			if err := trustCenter.LoadByID(ctx, tx, s.svc.scope, req.TrustCenterID); err != nil {
+				return fmt.Errorf("cannot load trust center: %w", err)
+			}
+
+			item = &coredata.ComplianceExternalURL{
+				ID:             id,
+				OrganizationID: trustCenter.OrganizationID,
+				TrustCenterID:  req.TrustCenterID,
+				Name:           req.Name,
+				URL:            req.URL,
+				CreatedAt:      now,
+				UpdatedAt:      now,
+			}
+
+			if err := item.Insert(ctx, tx, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot insert compliance external URL: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return item, nil
+}
+
+func (s ComplianceExternalURLService) Update(
+	ctx context.Context,
+	req *UpdateComplianceExternalURLRequest,
+) (*coredata.ComplianceExternalURL, error) {
+	if err := req.Validate(); err != nil {
+		return nil, err
+	}
+
+	var item *coredata.ComplianceExternalURL
+
+	err := s.svc.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			item = &coredata.ComplianceExternalURL{}
+
+			if err := item.LoadByID(ctx, tx, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load compliance external URL: %w", err)
+			}
+
+			item.Name = req.Name
+			item.URL = req.URL
+			item.UpdatedAt = time.Now()
+
+			if req.Rank != nil {
+				item.Rank = *req.Rank
+				if err := item.UpdateRank(ctx, tx, s.svc.scope); err != nil {
+					return fmt.Errorf("cannot update compliance external URL rank: %w", err)
+				}
+			}
+
+			if err := item.Update(ctx, tx, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot update compliance external URL: %w", err)
+			}
+
+			return nil
+		},
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return item, nil
+}
+
+func (s ComplianceExternalURLService) Delete(
+	ctx context.Context,
+	req *DeleteComplianceExternalURLRequest,
+) error {
+	if err := req.Validate(); err != nil {
+		return err
+	}
+
+	return s.svc.pg.WithTx(
+		ctx,
+		func(tx pg.Conn) error {
+			item := &coredata.ComplianceExternalURL{}
+
+			if err := item.LoadByID(ctx, tx, s.svc.scope, req.ID); err != nil {
+				return fmt.Errorf("cannot load compliance external URL: %w", err)
+			}
+
+			if err := item.Delete(ctx, tx, s.svc.scope); err != nil {
+				return fmt.Errorf("cannot delete compliance external URL: %w", err)
+			}
+
+			return nil
+		},
+	)
+}
--- a/pkg/probo/service.go
+++ b/pkg/probo/service.go
@@ -101,6 +101,7 @@ type (
 		TrustCenterReferences             *TrustCenterReferenceService
 		TrustCenterFiles                  *TrustCenterFileService
 		ComplianceFrameworks              *ComplianceFrameworkService
+		ComplianceExternalURLs            *ComplianceExternalURLService
 		Nonconformities                   *NonconformityService
 		Obligations                       *ObligationService
 		Snapshots                         *SnapshotService
@@ -226,6 +227,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.TrustCenterAccesses = &TrustCenterAccessService{svc: tenantService}
 	tenantService.TrustCenterReferences = &TrustCenterReferenceService{svc: tenantService}
 	tenantService.ComplianceFrameworks = &ComplianceFrameworkService{svc: tenantService}
+	tenantService.ComplianceExternalURLs = &ComplianceExternalURLService{svc: tenantService}
 	tenantService.TrustCenterFiles = &TrustCenterFileService{
 		svc: tenantService,
 		fileValidator: filevalidation.NewValidator(
--- a/pkg/probo/trust_center_service.go
+++ b/pkg/probo/trust_center_service.go
@@ -178,7 +178,6 @@ func (s TrustCenterService) Update(
 			if req.Slug != nil {
 				trustCenter.Slug = *req.Slug
 			}
-
 			trustCenter.UpdatedAt = time.Now()

 			if err := trustCenter.Update(ctx, conn, s.svc.scope); err != nil {
--- a/pkg/server/api/console/v1/schema.graphql
+++ b/pkg/server/api/console/v1/schema.graphql
@@ -1227,6 +1227,20 @@ enum TrustCenterReferenceOrderField
        )
 }

+enum ComplianceExternalURLOrderField
+    @goModel(
+        model: "go.probo.inc/probo/pkg/coredata.ComplianceExternalURLOrderField"
+    ) {
+    CREATED_AT
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ComplianceExternalURLOrderFieldCreatedAt"
+        )
+    RANK
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ComplianceExternalURLOrderFieldRank"
+        )
+}
+
 enum ComplianceFrameworkOrderField
    @goModel(
        model: "go.probo.inc/probo/pkg/coredata.ComplianceFrameworkOrderField"
@@ -1491,6 +1505,14 @@ input TrustCenterFileOrder
    field: TrustCenterFileOrderField!
 }

+input ComplianceExternalURLOrder
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ComplianceExternalURLOrderBy"
+    ) {
+    direction: OrderDirection!
+    field: ComplianceExternalURLOrderField!
+}
+
 input ComplianceFrameworkOrder
    @goModel(
        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ComplianceFrameworkOrderBy"
@@ -1658,6 +1680,14 @@ type TrustCenter implements Node {
        orderBy: ComplianceFrameworkOrder
    ): ComplianceFrameworkConnection! @goField(forceResolver: true)

+    externalUrls(
+        first: Int
+        after: CursorKey
+        last: Int
+        before: CursorKey
+        orderBy: ComplianceExternalURLOrder
+    ): ComplianceExternalURLConnection! @goField(forceResolver: true)
+
    permission(action: String!): Boolean! @goField(forceResolver: true)
 }

@@ -2882,6 +2912,30 @@ type ComplianceFrameworkEdge {
    node: ComplianceFramework!
 }

+type ComplianceExternalURL implements Node {
+    id: ID!
+    name: String!
+    url: String!
+    rank: Int!
+    createdAt: Datetime!
+    updatedAt: Datetime!
+
+    permission(action: String!): Boolean! @goField(forceResolver: true)
+}
+
+type ComplianceExternalURLConnection
+    @goModel(
+        model: "go.probo.inc/probo/pkg/server/api/console/v1/types.ComplianceExternalURLConnection"
+    ) {
+    edges: [ComplianceExternalURLEdge!]!
+    pageInfo: PageInfo!
+}
+
+type ComplianceExternalURLEdge {
+    cursor: CursorKey!
+    node: ComplianceExternalURL!
+}
+
 type TrustCenterFile implements Node {
    id: ID!
    name: String!
@@ -3330,6 +3384,15 @@ type Mutation {
    deleteComplianceFramework(
        input: DeleteComplianceFrameworkInput!
    ): DeleteComplianceFrameworkPayload!
+    createComplianceExternalURL(
+        input: CreateComplianceExternalURLInput!
+    ): CreateComplianceExternalURLPayload!
+    updateComplianceExternalURL(
+        input: UpdateComplianceExternalURLInput!
+    ): UpdateComplianceExternalURLPayload!
+    deleteComplianceExternalURL(
+        input: DeleteComplianceExternalURLInput!
+    ): DeleteComplianceExternalURLPayload!
    # Trust Center File mutations
    createTrustCenterFile(
        input: CreateTrustCenterFileInput!
@@ -3738,6 +3801,23 @@ input DeleteComplianceFrameworkInput {
    id: ID!
 }

+input CreateComplianceExternalURLInput {
+    trustCenterId: ID!
+    name: String!
+    url: String!
+}
+
+input UpdateComplianceExternalURLInput {
+    id: ID!
+    name: String!
+    url: String!
+    rank: Int
+}
+
+input DeleteComplianceExternalURLInput {
+    id: ID!
+}
+
 input CreateTrustCenterFileInput {
    organizationId: ID!
    name: String!
@@ -4561,6 +4641,18 @@ type DeleteComplianceFrameworkPayload {
    deletedComplianceFrameworkId: ID!
 }

+type CreateComplianceExternalURLPayload {
+    complianceExternalUrlEdge: ComplianceExternalURLEdge!
+}
+
+type UpdateComplianceExternalURLPayload {
+    complianceExternalUrl: ComplianceExternalURL!
+}
+
+type DeleteComplianceExternalURLPayload {
+    deletedComplianceExternalUrlId: ID!
+}
+
 type CreateTrustCenterFilePayload {
    trustCenterFileEdge: TrustCenterFileEdge!
 }
--- a/pkg/server/api/console/v1/schema/schema.go
+++ b/pkg/server/api/console/v1/schema/schema.go
--- a/pkg/server/api/console/v1/types/compliance_external_url.go
+++ b/pkg/server/api/console/v1/types/compliance_external_url.go
@@ -0,0 +1,44 @@
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type ComplianceExternalURLOrderBy = OrderBy[coredata.ComplianceExternalURLOrderField]
+
+type ComplianceExternalURLConnection struct {
+	Edges    []*ComplianceExternalURLEdge `json:"edges"`
+	PageInfo *PageInfo                    `json:"pageInfo"`
+}
+
+func NewComplianceExternalURL(c *coredata.ComplianceExternalURL) *ComplianceExternalURL {
+	return &ComplianceExternalURL{
+		ID:        c.ID,
+		Name:      c.Name,
+		URL:       c.URL,
+		Rank:      c.Rank,
+		CreatedAt: c.CreatedAt,
+		UpdatedAt: c.UpdatedAt,
+	}
+}
+
+func NewComplianceExternalURLConnection(
+	p *page.Page[*coredata.ComplianceExternalURL, coredata.ComplianceExternalURLOrderField],
+) *ComplianceExternalURLConnection {
+	edges := make([]*ComplianceExternalURLEdge, len(p.Data))
+	for i := range edges {
+		edges[i] = NewComplianceExternalURLEdge(p.Data[i], p.Cursor.OrderBy.Field)
+	}
+	return &ComplianceExternalURLConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+	}
+}
+
+func NewComplianceExternalURLEdge(c *coredata.ComplianceExternalURL, orderBy coredata.ComplianceExternalURLOrderField) *ComplianceExternalURLEdge {
+	return &ComplianceExternalURLEdge{
+		Cursor: c.CursorKey(orderBy),
+		Node:   NewComplianceExternalURL(c),
+	}
+}
--- a/pkg/server/api/console/v1/types/types.go
+++ b/pkg/server/api/console/v1/types/types.go
@@ -149,6 +149,24 @@ type CancelSignatureRequestPayload struct {
 	DeletedDocumentVersionSignatureID gid.GID `json:"deletedDocumentVersionSignatureId"`
 }

+type ComplianceExternalURL struct {
+	ID         gid.GID   `json:"id"`
+	Name       string    `json:"name"`
+	URL        string    `json:"url"`
+	Rank       int       `json:"rank"`
+	CreatedAt  time.Time `json:"createdAt"`
+	UpdatedAt  time.Time `json:"updatedAt"`
+	Permission bool      `json:"permission"`
+}
+
+func (ComplianceExternalURL) IsNode()             {}
+func (this ComplianceExternalURL) GetID() gid.GID { return this.ID }
+
+type ComplianceExternalURLEdge struct {
+	Cursor page.CursorKey         `json:"cursor"`
+	Node   *ComplianceExternalURL `json:"node"`
+}
+
 type ComplianceFrameworkEdge struct {
 	Cursor page.CursorKey       `json:"cursor"`
 	Node   *ComplianceFramework `json:"node"`
@@ -255,6 +273,16 @@ type CreateAuditPayload struct {
 	AuditEdge *AuditEdge `json:"auditEdge"`
 }

+type CreateComplianceExternalURLInput struct {
+	TrustCenterID gid.GID `json:"trustCenterId"`
+	Name          string  `json:"name"`
+	URL           string  `json:"url"`
+}
+
+type CreateComplianceExternalURLPayload struct {
+	ComplianceExternalURLEdge *ComplianceExternalURLEdge `json:"complianceExternalUrlEdge"`
+}
+
 type CreateComplianceFrameworkInput struct {
 	TrustCenterID gid.GID `json:"trustCenterId"`
 	FrameworkID   gid.GID `json:"frameworkId"`
@@ -793,6 +821,14 @@ type DeleteAuditReportPayload struct {
 	Audit *Audit `json:"audit"`
 }

+type DeleteComplianceExternalURLInput struct {
+	ID gid.GID `json:"id"`
+}
+
+type DeleteComplianceExternalURLPayload struct {
+	DeletedComplianceExternalURLID gid.GID `json:"deletedComplianceExternalUrlId"`
+}
+
 type DeleteComplianceFrameworkInput struct {
 	ID gid.GID `json:"id"`
 }
@@ -1864,19 +1900,20 @@ type TransferImpactAssessmentFilter struct {
 }

 type TrustCenter struct {
-	ID                   gid.GID                         `json:"id"`
-	Active               bool                            `json:"active"`
-	LogoFileURL          *string                         `json:"logoFileUrl,omitempty"`
-	DarkLogoFileURL      *string                         `json:"darkLogoFileUrl,omitempty"`
-	NdaFileName          *string                         `json:"ndaFileName,omitempty"`
-	NdaFileURL           *string                         `json:"ndaFileUrl,omitempty"`
-	CreatedAt            time.Time                       `json:"createdAt"`
-	UpdatedAt            time.Time                       `json:"updatedAt"`
-	Organization         *Organization                   `json:"organization"`
-	Accesses             *TrustCenterAccessConnection    `json:"accesses"`
-	References           *TrustCenterReferenceConnection `json:"references"`
-	ComplianceFrameworks *ComplianceFrameworkConnection  `json:"complianceFrameworks"`
-	Permission           bool                            `json:"permission"`
+	ID                   gid.GID                          `json:"id"`
+	Active               bool                             `json:"active"`
+	LogoFileURL          *string                          `json:"logoFileUrl,omitempty"`
+	DarkLogoFileURL      *string                          `json:"darkLogoFileUrl,omitempty"`
+	NdaFileName          *string                          `json:"ndaFileName,omitempty"`
+	NdaFileURL           *string                          `json:"ndaFileUrl,omitempty"`
+	CreatedAt            time.Time                        `json:"createdAt"`
+	UpdatedAt            time.Time                        `json:"updatedAt"`
+	Organization         *Organization                    `json:"organization"`
+	Accesses             *TrustCenterAccessConnection     `json:"accesses"`
+	References           *TrustCenterReferenceConnection  `json:"references"`
+	ComplianceFrameworks *ComplianceFrameworkConnection   `json:"complianceFrameworks"`
+	ExternalUrls         *ComplianceExternalURLConnection `json:"externalUrls"`
+	Permission           bool                             `json:"permission"`
 }

 func (TrustCenter) IsNode()             {}
@@ -2006,6 +2043,17 @@ type UpdateAuditPayload struct {
 	Audit *Audit `json:"audit"`
 }

+type UpdateComplianceExternalURLInput struct {
+	ID   gid.GID `json:"id"`
+	Name string  `json:"name"`
+	URL  string  `json:"url"`
+	Rank *int    `json:"rank,omitempty"`
+}
+
+type UpdateComplianceExternalURLPayload struct {
+	ComplianceExternalURL *ComplianceExternalURL `json:"complianceExternalUrl"`
+}
+
 type UpdateComplianceFrameworkInput struct {
 	ID   gid.GID `json:"id"`
 	Rank int     `json:"rank"`
--- a/pkg/server/api/console/v1/v1_resolver.go
+++ b/pkg/server/api/console/v1/v1_resolver.go
@@ -324,6 +324,11 @@ func (r *auditConnectionResolver) TotalCount(ctx context.Context, obj *types.Aud
 	return count, nil
 }

+// Permission is the resolver for the permission field.
+func (r *complianceExternalURLResolver) Permission(ctx context.Context, obj *types.ComplianceExternalURL, action string) (bool, error) {
+	return r.Resolver.Permission(ctx, obj, action)
+}
+
 // Framework is the resolver for the framework field.
 func (r *complianceFrameworkResolver) Framework(ctx context.Context, obj *types.ComplianceFramework) (*types.Framework, error) {
 	if err := r.authorize(ctx, obj.FrameworkID, probo.ActionFrameworkGet); err != nil {
@@ -2141,6 +2146,74 @@ func (r *mutationResolver) DeleteComplianceFramework(ctx context.Context, input
 	}, nil
 }

+// CreateComplianceExternalURL is the resolver for the createComplianceExternalURL field.
+func (r *mutationResolver) CreateComplianceExternalURL(ctx context.Context, input types.CreateComplianceExternalURLInput) (*types.CreateComplianceExternalURLPayload, error) {
+	if err := r.authorize(ctx, input.TrustCenterID, probo.ActionComplianceExternalURLCreate); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, input.TrustCenterID.TenantID())
+
+	item, err := prb.ComplianceExternalURLs.Create(
+		ctx,
+		&probo.CreateComplianceExternalURLRequest{
+			TrustCenterID: input.TrustCenterID,
+			Name:          input.Name,
+			URL:           input.URL,
+		},
+	)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot create compliance external URL", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.CreateComplianceExternalURLPayload{
+		ComplianceExternalURLEdge: types.NewComplianceExternalURLEdge(item, coredata.ComplianceExternalURLOrderFieldRank),
+	}, nil
+}
+
+// UpdateComplianceExternalURL is the resolver for the updateComplianceExternalURL field.
+func (r *mutationResolver) UpdateComplianceExternalURL(ctx context.Context, input types.UpdateComplianceExternalURLInput) (*types.UpdateComplianceExternalURLPayload, error) {
+	if err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLUpdate); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, input.ID.TenantID())
+
+	item, err := prb.ComplianceExternalURLs.Update(ctx, &probo.UpdateComplianceExternalURLRequest{
+		ID:   input.ID,
+		Name: input.Name,
+		URL:  input.URL,
+		Rank: input.Rank,
+	})
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot update compliance external URL", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.UpdateComplianceExternalURLPayload{
+		ComplianceExternalURL: types.NewComplianceExternalURL(item),
+	}, nil
+}
+
+// DeleteComplianceExternalURL is the resolver for the deleteComplianceExternalURL field.
+func (r *mutationResolver) DeleteComplianceExternalURL(ctx context.Context, input types.DeleteComplianceExternalURLInput) (*types.DeleteComplianceExternalURLPayload, error) {
+	if err := r.authorize(ctx, input.ID, probo.ActionComplianceExternalURLDelete); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, input.ID.TenantID())
+
+	if err := prb.ComplianceExternalURLs.Delete(ctx, &probo.DeleteComplianceExternalURLRequest{ID: input.ID}); err != nil {
+		r.logger.ErrorCtx(ctx, "cannot delete compliance external URL", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return &types.DeleteComplianceExternalURLPayload{
+		DeletedComplianceExternalURLID: input.ID,
+	}, nil
+}
+
 // CreateTrustCenterFile is the resolver for the createTrustCenterFile field.
 func (r *mutationResolver) CreateTrustCenterFile(ctx context.Context, input types.CreateTrustCenterFileInput) (*types.CreateTrustCenterFilePayload, error) {
 	if err := r.authorize(ctx, input.OrganizationID, probo.ActionTrustCenterFileCreate); err != nil {
@@ -7887,6 +7960,36 @@ func (r *trustCenterResolver) ComplianceFrameworks(ctx context.Context, obj *typ
 	return types.NewComplianceFrameworkConnection(result), nil
 }

+// ExternalUrls is the resolver for the externalUrls field.
+func (r *trustCenterResolver) ExternalUrls(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.ComplianceExternalURLOrderField]) (*types.ComplianceExternalURLConnection, error) {
+	if err := r.authorize(ctx, obj.ID, probo.ActionComplianceExternalURLList); err != nil {
+		return nil, err
+	}
+
+	prb := r.ProboService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.ComplianceExternalURLOrderField]{
+		Field:     coredata.ComplianceExternalURLOrderFieldRank,
+		Direction: page.OrderDirectionAsc,
+	}
+	if orderBy != nil {
+		pageOrderBy = page.OrderBy[coredata.ComplianceExternalURLOrderField]{
+			Field:     orderBy.Field,
+			Direction: orderBy.Direction,
+		}
+	}
+
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	result, err := prb.ComplianceExternalURLs.List(ctx, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list compliance external URLs", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewComplianceExternalURLConnection(result), nil
+}
+
 // Permission is the resolver for the permission field.
 func (r *trustCenterResolver) Permission(ctx context.Context, obj *types.TrustCenter, action string) (bool, error) {
 	return r.Resolver.Permission(ctx, obj, action)
@@ -8868,6 +8971,11 @@ func (r *Resolver) AuditConnection() schema.AuditConnectionResolver {
 	return &auditConnectionResolver{r}
 }

+// ComplianceExternalURL returns schema.ComplianceExternalURLResolver implementation.
+func (r *Resolver) ComplianceExternalURL() schema.ComplianceExternalURLResolver {
+	return &complianceExternalURLResolver{r}
+}
+
 // ComplianceFramework returns schema.ComplianceFrameworkResolver implementation.
 func (r *Resolver) ComplianceFramework() schema.ComplianceFrameworkResolver {
 	return &complianceFrameworkResolver{r}
@@ -9175,6 +9283,7 @@ type assetResolver struct{ *Resolver }
 type assetConnectionResolver struct{ *Resolver }
 type auditResolver struct{ *Resolver }
 type auditConnectionResolver struct{ *Resolver }
+type complianceExternalURLResolver struct{ *Resolver }
 type complianceFrameworkResolver struct{ *Resolver }
 type continualImprovementResolver struct{ *Resolver }
 type continualImprovementConnectionResolver struct{ *Resolver }
--- a/pkg/server/api/trust/v1/schema.graphql
+++ b/pkg/server/api/trust/v1/schema.graphql
@@ -573,6 +573,30 @@ type TrustCenter implements Node {
    last: Int
    before: CursorKey
  ): ComplianceFrameworkConnection! @goField(forceResolver: true)
+
+  externalUrls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): ComplianceExternalURLConnection! @goField(forceResolver: true)
+}
+
+type ComplianceExternalURL implements Node {
+  id: ID!
+  name: String!
+  url: String!
+  rank: Int!
+}
+
+type ComplianceExternalURLConnection {
+  edges: [ComplianceExternalURLEdge!]!
+  pageInfo: PageInfo!
+}
+
+type ComplianceExternalURLEdge {
+  cursor: CursorKey!
+  node: ComplianceExternalURL!
 }

 type TrustCenterAccess implements Node {
--- a/pkg/server/api/trust/v1/schema/schema.go
+++ b/pkg/server/api/trust/v1/schema/schema.go
@@ -78,6 +78,23 @@ type ComplexityRoot struct {
 		Node   func(childComplexity int) int
 	}

+	ComplianceExternalURL struct {
+		ID   func(childComplexity int) int
+		Name func(childComplexity int) int
+		Rank func(childComplexity int) int
+		URL  func(childComplexity int) int
+	}
+
+	ComplianceExternalURLConnection struct {
+		Edges    func(childComplexity int) int
+		PageInfo func(childComplexity int) int
+	}
+
+	ComplianceExternalURLEdge struct {
+		Cursor func(childComplexity int) int
+		Node   func(childComplexity int) int
+	}
+
 	ComplianceFramework struct {
 		Framework func(childComplexity int) int
 		ID        func(childComplexity int) int
@@ -236,6 +253,7 @@ type ComplexityRoot struct {
 		ComplianceFrameworks   func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
 		DarkLogoFileURL        func(childComplexity int) int
 		Documents              func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
+		ExternalUrls           func(childComplexity int, first *int, after *page.CursorKey, last *int, before *page.CursorKey) int
 		ID                     func(childComplexity int) int
 		LogoFileURL            func(childComplexity int) int
 		NonDisclosureAgreement func(childComplexity int) int
@@ -376,6 +394,7 @@ type TrustCenterResolver interface {
 	References(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TrustCenterReferenceConnection, error)
 	TrustCenterFiles(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.TrustCenterFileConnection, error)
 	ComplianceFrameworks(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.ComplianceFrameworkConnection, error)
+	ExternalUrls(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.ComplianceExternalURLConnection, error)
 }
 type TrustCenterFileResolver interface {
 	IsUserAuthorized(ctx context.Context, obj *types.TrustCenterFile) (bool, error)
@@ -460,6 +479,57 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin

 		return e.ComplexityRoot.AuditEdge.Node(childComplexity), true

+	case "ComplianceExternalURL.id":
+		if e.ComplexityRoot.ComplianceExternalURL.ID == nil {
+			break
+		}
+
+		return e.ComplexityRoot.ComplianceExternalURL.ID(childComplexity), true
+	case "ComplianceExternalURL.name":
+		if e.ComplexityRoot.ComplianceExternalURL.Name == nil {
+			break
+		}
+
+		return e.ComplexityRoot.ComplianceExternalURL.Name(childComplexity), true
+	case "ComplianceExternalURL.rank":
+		if e.ComplexityRoot.ComplianceExternalURL.Rank == nil {
+			break
+		}
+
+		return e.ComplexityRoot.ComplianceExternalURL.Rank(childComplexity), true
+	case "ComplianceExternalURL.url":
+		if e.ComplexityRoot.ComplianceExternalURL.URL == nil {
+			break
+		}
+
+		return e.ComplexityRoot.ComplianceExternalURL.URL(childComplexity), true
+
+	case "ComplianceExternalURLConnection.edges":
+		if e.ComplexityRoot.ComplianceExternalURLConnection.Edges == nil {
+			break
+		}
+
+		return e.ComplexityRoot.ComplianceExternalURLConnection.Edges(childComplexity), true
+	case "ComplianceExternalURLConnection.pageInfo":
+		if e.ComplexityRoot.ComplianceExternalURLConnection.PageInfo == nil {
+			break
+		}
+
+		return e.ComplexityRoot.ComplianceExternalURLConnection.PageInfo(childComplexity), true
+
+	case "ComplianceExternalURLEdge.cursor":
+		if e.ComplexityRoot.ComplianceExternalURLEdge.Cursor == nil {
+			break
+		}
+
+		return e.ComplexityRoot.ComplianceExternalURLEdge.Cursor(childComplexity), true
+	case "ComplianceExternalURLEdge.node":
+		if e.ComplexityRoot.ComplianceExternalURLEdge.Node == nil {
+			break
+		}
+
+		return e.ComplexityRoot.ComplianceExternalURLEdge.Node(childComplexity), true
+
 	case "ComplianceFramework.framework":
 		if e.ComplexityRoot.ComplianceFramework.Framework == nil {
 			break
@@ -1053,6 +1123,17 @@ func (e *executableSchema) Complexity(ctx context.Context, typeName, field strin
 		}

 		return e.ComplexityRoot.TrustCenter.Documents(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey)), true
+	case "TrustCenter.externalUrls":
+		if e.ComplexityRoot.TrustCenter.ExternalUrls == nil {
+			break
+		}
+
+		args, err := ec.field_TrustCenter_externalUrls_args(ctx, rawArgs)
+		if err != nil {
+			return 0, false
+		}
+
+		return e.ComplexityRoot.TrustCenter.ExternalUrls(childComplexity, args["first"].(*int), args["after"].(*page.CursorKey), args["last"].(*int), args["before"].(*page.CursorKey)), true
 	case "TrustCenter.id":
 		if e.ComplexityRoot.TrustCenter.ID == nil {
 			break
@@ -2020,6 +2101,30 @@ type TrustCenter implements Node {
    last: Int
    before: CursorKey
  ): ComplianceFrameworkConnection! @goField(forceResolver: true)
+
+  externalUrls(
+    first: Int
+    after: CursorKey
+    last: Int
+    before: CursorKey
+  ): ComplianceExternalURLConnection! @goField(forceResolver: true)
+}
+
+type ComplianceExternalURL implements Node {
+  id: ID!
+  name: String!
+  url: String!
+  rank: Int!
+}
+
+type ComplianceExternalURLConnection {
+  edges: [ComplianceExternalURLEdge!]!
+  pageInfo: PageInfo!
+}
+
+type ComplianceExternalURLEdge {
+  cursor: CursorKey!
+  node: ComplianceExternalURL!
 }

 type TrustCenterAccess implements Node {
@@ -2595,6 +2700,32 @@ func (ec *executionContext) field_TrustCenter_documents_args(ctx context.Context
 	return args, nil
 }

+func (ec *executionContext) field_TrustCenter_externalUrls_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
+	var err error
+	args := map[string]any{}
+	arg0, err := graphql.ProcessArgField(ctx, rawArgs, "first", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["first"] = arg0
+	arg1, err := graphql.ProcessArgField(ctx, rawArgs, "after", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["after"] = arg1
+	arg2, err := graphql.ProcessArgField(ctx, rawArgs, "last", ec.unmarshalOInt2ᚖint)
+	if err != nil {
+		return nil, err
+	}
+	args["last"] = arg2
+	arg3, err := graphql.ProcessArgField(ctx, rawArgs, "before", ec.unmarshalOCursorKey2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey)
+	if err != nil {
+		return nil, err
+	}
+	args["before"] = arg3
+	return args, nil
+}
+
 func (ec *executionContext) field_TrustCenter_references_args(ctx context.Context, rawArgs map[string]any) (map[string]any, error) {
 	var err error
 	args := map[string]any{}
@@ -3102,6 +3233,264 @@ func (ec *executionContext) fieldContext_AuditEdge_node(_ context.Context, field
 	return fc, nil
 }

+func (ec *executionContext) _ComplianceExternalURL_id(ctx context.Context, field graphql.CollectedField, obj *types.ComplianceExternalURL) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ComplianceExternalURL_id,
+		func(ctx context.Context) (any, error) {
+			return obj.ID, nil
+		},
+		nil,
+		ec.marshalNID2goᚗproboᚗincᚋproboᚋpkgᚋgidᚐGID,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_ComplianceExternalURL_id(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ComplianceExternalURL",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type ID does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _ComplianceExternalURL_name(ctx context.Context, field graphql.CollectedField, obj *types.ComplianceExternalURL) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ComplianceExternalURL_name,
+		func(ctx context.Context) (any, error) {
+			return obj.Name, nil
+		},
+		nil,
+		ec.marshalNString2string,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_ComplianceExternalURL_name(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ComplianceExternalURL",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _ComplianceExternalURL_url(ctx context.Context, field graphql.CollectedField, obj *types.ComplianceExternalURL) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ComplianceExternalURL_url,
+		func(ctx context.Context) (any, error) {
+			return obj.URL, nil
+		},
+		nil,
+		ec.marshalNString2string,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_ComplianceExternalURL_url(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ComplianceExternalURL",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type String does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _ComplianceExternalURL_rank(ctx context.Context, field graphql.CollectedField, obj *types.ComplianceExternalURL) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ComplianceExternalURL_rank,
+		func(ctx context.Context) (any, error) {
+			return obj.Rank, nil
+		},
+		nil,
+		ec.marshalNInt2int,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_ComplianceExternalURL_rank(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ComplianceExternalURL",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type Int does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _ComplianceExternalURLConnection_edges(ctx context.Context, field graphql.CollectedField, obj *types.ComplianceExternalURLConnection) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ComplianceExternalURLConnection_edges,
+		func(ctx context.Context) (any, error) {
+			return obj.Edges, nil
+		},
+		nil,
+		ec.marshalNComplianceExternalURLEdge2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceExternalURLEdgeᚄ,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_ComplianceExternalURLConnection_edges(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ComplianceExternalURLConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "cursor":
+				return ec.fieldContext_ComplianceExternalURLEdge_cursor(ctx, field)
+			case "node":
+				return ec.fieldContext_ComplianceExternalURLEdge_node(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type ComplianceExternalURLEdge", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _ComplianceExternalURLConnection_pageInfo(ctx context.Context, field graphql.CollectedField, obj *types.ComplianceExternalURLConnection) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ComplianceExternalURLConnection_pageInfo,
+		func(ctx context.Context) (any, error) {
+			return obj.PageInfo, nil
+		},
+		nil,
+		ec.marshalNPageInfo2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐPageInfo,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_ComplianceExternalURLConnection_pageInfo(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ComplianceExternalURLConnection",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "hasNextPage":
+				return ec.fieldContext_PageInfo_hasNextPage(ctx, field)
+			case "hasPreviousPage":
+				return ec.fieldContext_PageInfo_hasPreviousPage(ctx, field)
+			case "startCursor":
+				return ec.fieldContext_PageInfo_startCursor(ctx, field)
+			case "endCursor":
+				return ec.fieldContext_PageInfo_endCursor(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type PageInfo", field.Name)
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _ComplianceExternalURLEdge_cursor(ctx context.Context, field graphql.CollectedField, obj *types.ComplianceExternalURLEdge) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ComplianceExternalURLEdge_cursor,
+		func(ctx context.Context) (any, error) {
+			return obj.Cursor, nil
+		},
+		nil,
+		ec.marshalNCursorKey2goᚗproboᚗincᚋproboᚋpkgᚋpageᚐCursorKey,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_ComplianceExternalURLEdge_cursor(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ComplianceExternalURLEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			return nil, errors.New("field of type CursorKey does not have child fields")
+		},
+	}
+	return fc, nil
+}
+
+func (ec *executionContext) _ComplianceExternalURLEdge_node(ctx context.Context, field graphql.CollectedField, obj *types.ComplianceExternalURLEdge) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_ComplianceExternalURLEdge_node,
+		func(ctx context.Context) (any, error) {
+			return obj.Node, nil
+		},
+		nil,
+		ec.marshalNComplianceExternalURL2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceExternalURL,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_ComplianceExternalURLEdge_node(_ context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "ComplianceExternalURLEdge",
+		Field:      field,
+		IsMethod:   false,
+		IsResolver: false,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "id":
+				return ec.fieldContext_ComplianceExternalURL_id(ctx, field)
+			case "name":
+				return ec.fieldContext_ComplianceExternalURL_name(ctx, field)
+			case "url":
+				return ec.fieldContext_ComplianceExternalURL_url(ctx, field)
+			case "rank":
+				return ec.fieldContext_ComplianceExternalURL_rank(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type ComplianceExternalURL", field.Name)
+		},
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _ComplianceFramework_id(ctx context.Context, field graphql.CollectedField, obj *types.ComplianceFramework) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -5660,6 +6049,8 @@ func (ec *executionContext) fieldContext_Query_currentTrustCenter(_ context.Cont
 				return ec.fieldContext_TrustCenter_trustCenterFiles(ctx, field)
 			case "complianceFrameworks":
 				return ec.fieldContext_TrustCenter_complianceFrameworks(ctx, field)
+			case "externalUrls":
+				return ec.fieldContext_TrustCenter_externalUrls(ctx, field)
 			}
 			return nil, fmt.Errorf("no field named %q was found under type TrustCenter", field.Name)
 		},
@@ -6732,6 +7123,53 @@ func (ec *executionContext) fieldContext_TrustCenter_complianceFrameworks(ctx co
 	return fc, nil
 }

+func (ec *executionContext) _TrustCenter_externalUrls(ctx context.Context, field graphql.CollectedField, obj *types.TrustCenter) (ret graphql.Marshaler) {
+	return graphql.ResolveField(
+		ctx,
+		ec.OperationContext,
+		field,
+		ec.fieldContext_TrustCenter_externalUrls,
+		func(ctx context.Context) (any, error) {
+			fc := graphql.GetFieldContext(ctx)
+			return ec.Resolvers.TrustCenter().ExternalUrls(ctx, obj, fc.Args["first"].(*int), fc.Args["after"].(*page.CursorKey), fc.Args["last"].(*int), fc.Args["before"].(*page.CursorKey))
+		},
+		nil,
+		ec.marshalNComplianceExternalURLConnection2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceExternalURLConnection,
+		true,
+		true,
+	)
+}
+
+func (ec *executionContext) fieldContext_TrustCenter_externalUrls(ctx context.Context, field graphql.CollectedField) (fc *graphql.FieldContext, err error) {
+	fc = &graphql.FieldContext{
+		Object:     "TrustCenter",
+		Field:      field,
+		IsMethod:   true,
+		IsResolver: true,
+		Child: func(ctx context.Context, field graphql.CollectedField) (*graphql.FieldContext, error) {
+			switch field.Name {
+			case "edges":
+				return ec.fieldContext_ComplianceExternalURLConnection_edges(ctx, field)
+			case "pageInfo":
+				return ec.fieldContext_ComplianceExternalURLConnection_pageInfo(ctx, field)
+			}
+			return nil, fmt.Errorf("no field named %q was found under type ComplianceExternalURLConnection", field.Name)
+		},
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			err = ec.Recover(ctx, r)
+			ec.Error(ctx, err)
+		}
+	}()
+	ctx = graphql.WithFieldContext(ctx, fc)
+	if fc.Args, err = ec.field_TrustCenter_externalUrls_args(ctx, field.ArgumentMap(ec.Variables)); err != nil {
+		ec.Error(ctx, err)
+		return fc, err
+	}
+	return fc, nil
+}
+
 func (ec *executionContext) _TrustCenterAccess_id(ctx context.Context, field graphql.CollectedField, obj *types.TrustCenterAccess) (ret graphql.Marshaler) {
 	return graphql.ResolveField(
 		ctx,
@@ -9822,6 +10260,13 @@ func (ec *executionContext) _Node(ctx context.Context, sel ast.SelectionSet, obj
 			return graphql.Null
 		}
 		return ec._ComplianceFramework(ctx, sel, obj)
+	case types.ComplianceExternalURL:
+		return ec._ComplianceExternalURL(ctx, sel, &obj)
+	case *types.ComplianceExternalURL:
+		if obj == nil {
+			return graphql.Null
+		}
+		return ec._ComplianceExternalURL(ctx, sel, obj)
 	case types.Audit:
 		return ec._Audit(ctx, sel, &obj)
 	case *types.Audit:
@@ -10079,6 +10524,148 @@ func (ec *executionContext) _AuditEdge(ctx context.Context, sel ast.SelectionSet
 	return out
 }

+var complianceExternalURLImplementors = []string{"ComplianceExternalURL", "Node"}
+
+func (ec *executionContext) _ComplianceExternalURL(ctx context.Context, sel ast.SelectionSet, obj *types.ComplianceExternalURL) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, complianceExternalURLImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("ComplianceExternalURL")
+		case "id":
+			out.Values[i] = ec._ComplianceExternalURL_id(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "name":
+			out.Values[i] = ec._ComplianceExternalURL_name(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "url":
+			out.Values[i] = ec._ComplianceExternalURL_url(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "rank":
+			out.Values[i] = ec._ComplianceExternalURL_rank(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.Deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.ProcessDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var complianceExternalURLConnectionImplementors = []string{"ComplianceExternalURLConnection"}
+
+func (ec *executionContext) _ComplianceExternalURLConnection(ctx context.Context, sel ast.SelectionSet, obj *types.ComplianceExternalURLConnection) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, complianceExternalURLConnectionImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("ComplianceExternalURLConnection")
+		case "edges":
+			out.Values[i] = ec._ComplianceExternalURLConnection_edges(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "pageInfo":
+			out.Values[i] = ec._ComplianceExternalURLConnection_pageInfo(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.Deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.ProcessDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
+var complianceExternalURLEdgeImplementors = []string{"ComplianceExternalURLEdge"}
+
+func (ec *executionContext) _ComplianceExternalURLEdge(ctx context.Context, sel ast.SelectionSet, obj *types.ComplianceExternalURLEdge) graphql.Marshaler {
+	fields := graphql.CollectFields(ec.OperationContext, sel, complianceExternalURLEdgeImplementors)
+
+	out := graphql.NewFieldSet(fields)
+	deferred := make(map[string]*graphql.FieldSet)
+	for i, field := range fields {
+		switch field.Name {
+		case "__typename":
+			out.Values[i] = graphql.MarshalString("ComplianceExternalURLEdge")
+		case "cursor":
+			out.Values[i] = ec._ComplianceExternalURLEdge_cursor(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		case "node":
+			out.Values[i] = ec._ComplianceExternalURLEdge_node(ctx, field, obj)
+			if out.Values[i] == graphql.Null {
+				out.Invalids++
+			}
+		default:
+			panic("unknown field " + strconv.Quote(field.Name))
+		}
+	}
+	out.Dispatch(ctx)
+	if out.Invalids > 0 {
+		return graphql.Null
+	}
+
+	atomic.AddInt32(&ec.Deferred, int32(len(deferred)))
+
+	for label, dfs := range deferred {
+		ec.ProcessDeferredGroup(graphql.DeferredGroup{
+			Label:    label,
+			Path:     graphql.GetPath(ctx),
+			FieldSet: dfs,
+			Context:  ctx,
+		})
+	}
+
+	return out
+}
+
 var complianceFrameworkImplementors = []string{"ComplianceFramework", "Node"}

 func (ec *executionContext) _ComplianceFramework(ctx context.Context, sel ast.SelectionSet, obj *types.ComplianceFramework) graphql.Marshaler {
@@ -12027,6 +12614,42 @@ func (ec *executionContext) _TrustCenter(ctx context.Context, sel ast.SelectionS
 				continue
 			}

+			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
+		case "externalUrls":
+			field := field
+
+			innerFunc := func(ctx context.Context, fs *graphql.FieldSet) (res graphql.Marshaler) {
+				defer func() {
+					if r := recover(); r != nil {
+						ec.Error(ctx, ec.Recover(ctx, r))
+					}
+				}()
+				res = ec._TrustCenter_externalUrls(ctx, field, obj)
+				if res == graphql.Null {
+					atomic.AddUint32(&fs.Invalids, 1)
+				}
+				return res
+			}
+
+			if field.Deferrable != nil {
+				dfs, ok := deferred[field.Deferrable.Label]
+				di := 0
+				if ok {
+					dfs.AddField(field)
+					di = len(dfs.Values) - 1
+				} else {
+					dfs = graphql.NewFieldSet([]graphql.CollectedField{field})
+					deferred[field.Deferrable.Label] = dfs
+				}
+				dfs.Concurrently(di, func(ctx context.Context) graphql.Marshaler {
+					return innerFunc(ctx, dfs)
+				})
+
+				// don't run the out.Concurrently() call below
+				out.Values[i] = graphql.Null
+				continue
+			}
+
 			out.Concurrently(i, func(ctx context.Context) graphql.Marshaler { return innerFunc(ctx, out) })
 		default:
 			panic("unknown field " + strconv.Quote(field.Name))
@@ -13156,6 +13779,56 @@ func (ec *executionContext) marshalNBoolean2bool(ctx context.Context, sel ast.Se
 	return res
 }

+func (ec *executionContext) marshalNComplianceExternalURL2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceExternalURL(ctx context.Context, sel ast.SelectionSet, v *types.ComplianceExternalURL) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._ComplianceExternalURL(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNComplianceExternalURLConnection2goᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceExternalURLConnection(ctx context.Context, sel ast.SelectionSet, v types.ComplianceExternalURLConnection) graphql.Marshaler {
+	return ec._ComplianceExternalURLConnection(ctx, sel, &v)
+}
+
+func (ec *executionContext) marshalNComplianceExternalURLConnection2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceExternalURLConnection(ctx context.Context, sel ast.SelectionSet, v *types.ComplianceExternalURLConnection) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._ComplianceExternalURLConnection(ctx, sel, v)
+}
+
+func (ec *executionContext) marshalNComplianceExternalURLEdge2ᚕᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceExternalURLEdgeᚄ(ctx context.Context, sel ast.SelectionSet, v []*types.ComplianceExternalURLEdge) graphql.Marshaler {
+	ret := graphql.MarshalSliceConcurrently(ctx, len(v), 0, false, func(ctx context.Context, i int) graphql.Marshaler {
+		fc := graphql.GetFieldContext(ctx)
+		fc.Result = &v[i]
+		return ec.marshalNComplianceExternalURLEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceExternalURLEdge(ctx, sel, v[i])
+	})
+
+	for _, e := range ret {
+		if e == graphql.Null {
+			return graphql.Null
+		}
+	}
+
+	return ret
+}
+
+func (ec *executionContext) marshalNComplianceExternalURLEdge2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceExternalURLEdge(ctx context.Context, sel ast.SelectionSet, v *types.ComplianceExternalURLEdge) graphql.Marshaler {
+	if v == nil {
+		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
+			graphql.AddErrorf(ctx, "the requested element is null which the schema does not allow")
+		}
+		return graphql.Null
+	}
+	return ec._ComplianceExternalURLEdge(ctx, sel, v)
+}
+
 func (ec *executionContext) marshalNComplianceFramework2ᚖgoᚗproboᚗincᚋproboᚋpkgᚋserverᚋapiᚋtrustᚋv1ᚋtypesᚐComplianceFramework(ctx context.Context, sel ast.SelectionSet, v *types.ComplianceFramework) graphql.Marshaler {
 	if v == nil {
 		if !graphql.HasFieldError(ctx, graphql.GetFieldContext(ctx)) {
--- a/pkg/server/api/trust/v1/types/compliance_external_url.go
+++ b/pkg/server/api/trust/v1/types/compliance_external_url.go
@@ -0,0 +1,51 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package types
+
+import (
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/page"
+)
+
+func NewComplianceExternalURL(c *coredata.ComplianceExternalURL) *ComplianceExternalURL {
+	return &ComplianceExternalURL{
+		ID:   c.ID,
+		Name: c.Name,
+		URL:  c.URL,
+		Rank: c.Rank,
+	}
+}
+
+func NewComplianceExternalURLConnection(
+	p *page.Page[*coredata.ComplianceExternalURL, coredata.ComplianceExternalURLOrderField],
+) *ComplianceExternalURLConnection {
+	edges := make([]*ComplianceExternalURLEdge, len(p.Data))
+
+	for i, item := range p.Data {
+		edges[i] = NewComplianceExternalURLEdge(item, p.Cursor.OrderBy.Field)
+	}
+
+	return &ComplianceExternalURLConnection{
+		Edges:    edges,
+		PageInfo: NewPageInfo(p),
+	}
+}
+
+func NewComplianceExternalURLEdge(c *coredata.ComplianceExternalURL, orderBy coredata.ComplianceExternalURLOrderField) *ComplianceExternalURLEdge {
+	return &ComplianceExternalURLEdge{
+		Cursor: c.CursorKey(orderBy),
+		Node:   NewComplianceExternalURL(c),
+	}
+}
--- a/pkg/server/api/trust/v1/types/types.go
+++ b/pkg/server/api/trust/v1/types/types.go
@@ -44,6 +44,26 @@ type AuditEdge struct {
 	Node   *Audit         `json:"node"`
 }

+type ComplianceExternalURL struct {
+	ID   gid.GID `json:"id"`
+	Name string  `json:"name"`
+	URL  string  `json:"url"`
+	Rank int     `json:"rank"`
+}
+
+func (ComplianceExternalURL) IsNode()             {}
+func (this ComplianceExternalURL) GetID() gid.GID { return this.ID }
+
+type ComplianceExternalURLConnection struct {
+	Edges    []*ComplianceExternalURLEdge `json:"edges"`
+	PageInfo *PageInfo                    `json:"pageInfo"`
+}
+
+type ComplianceExternalURLEdge struct {
+	Cursor page.CursorKey         `json:"cursor"`
+	Node   *ComplianceExternalURL `json:"node"`
+}
+
 type Document struct {
 	ID               gid.GID               `json:"id"`
 	Title            string                `json:"title"`
@@ -222,19 +242,20 @@ type SendMagicLinkPayload struct {
 }

 type TrustCenter struct {
-	ID                     gid.GID                         `json:"id"`
-	Active                 bool                            `json:"active"`
-	Slug                   string                          `json:"slug"`
-	LogoFileURL            *string                         `json:"logoFileUrl,omitempty"`
-	DarkLogoFileURL        *string                         `json:"darkLogoFileUrl,omitempty"`
-	NonDisclosureAgreement *NonDisclosureAgreement         `json:"nonDisclosureAgreement,omitempty"`
-	Organization           *Organization                   `json:"organization"`
-	Documents              *DocumentConnection             `json:"documents"`
-	Audits                 *AuditConnection                `json:"audits"`
-	Vendors                *VendorConnection               `json:"vendors"`
-	References             *TrustCenterReferenceConnection `json:"references"`
-	TrustCenterFiles       *TrustCenterFileConnection      `json:"trustCenterFiles"`
-	ComplianceFrameworks   *ComplianceFrameworkConnection  `json:"complianceFrameworks"`
+	ID                     gid.GID                          `json:"id"`
+	Active                 bool                             `json:"active"`
+	Slug                   string                           `json:"slug"`
+	LogoFileURL            *string                          `json:"logoFileUrl,omitempty"`
+	DarkLogoFileURL        *string                          `json:"darkLogoFileUrl,omitempty"`
+	NonDisclosureAgreement *NonDisclosureAgreement          `json:"nonDisclosureAgreement,omitempty"`
+	Organization           *Organization                    `json:"organization"`
+	Documents              *DocumentConnection              `json:"documents"`
+	Audits                 *AuditConnection                 `json:"audits"`
+	Vendors                *VendorConnection                `json:"vendors"`
+	References             *TrustCenterReferenceConnection  `json:"references"`
+	TrustCenterFiles       *TrustCenterFileConnection       `json:"trustCenterFiles"`
+	ComplianceFrameworks   *ComplianceFrameworkConnection   `json:"complianceFrameworks"`
+	ExternalUrls           *ComplianceExternalURLConnection `json:"externalUrls"`
 }

 func (TrustCenter) IsNode()             {}
--- a/pkg/server/api/trust/v1/v1_resolver.go
+++ b/pkg/server/api/trust/v1/v1_resolver.go
@@ -1108,6 +1108,25 @@ func (r *trustCenterResolver) ComplianceFrameworks(ctx context.Context, obj *typ
 	return types.NewComplianceFrameworkConnection(cfPage), nil
 }

+// ExternalUrls is the resolver for the externalUrls field.
+func (r *trustCenterResolver) ExternalUrls(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.ComplianceExternalURLConnection, error) {
+	trustService := r.TrustService(ctx, obj.ID.TenantID())
+
+	pageOrderBy := page.OrderBy[coredata.ComplianceExternalURLOrderField]{
+		Field:     coredata.ComplianceExternalURLOrderFieldRank,
+		Direction: page.OrderDirectionAsc,
+	}
+	cursor := types.NewCursor(first, after, last, before, pageOrderBy)
+
+	result, err := trustService.ComplianceExternalURLs.ListForTrustCenterID(ctx, obj.ID, cursor)
+	if err != nil {
+		r.logger.ErrorCtx(ctx, "cannot list compliance external URLs", log.Error(err))
+		return nil, gqlutils.Internal(ctx)
+	}
+
+	return types.NewComplianceExternalURLConnection(result), nil
+}
+
 // IsUserAuthorized is the resolver for the isUserAuthorized field.
 func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *types.TrustCenterFile) (bool, error) {
 	trustService := r.TrustService(ctx, obj.ID.TenantID())
--- a/pkg/trust/compliance_external_url_service.go
+++ b/pkg/trust/compliance_external_url_service.go
@@ -0,0 +1,55 @@
+// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package trust
+
+import (
+	"context"
+	"fmt"
+
+	"go.gearno.de/kit/pg"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/gid"
+	"go.probo.inc/probo/pkg/page"
+)
+
+type ComplianceExternalURLService struct {
+	svc *TenantService
+}
+
+func (s ComplianceExternalURLService) ListForTrustCenterID(
+	ctx context.Context,
+	trustCenterID gid.GID,
+	cursor *page.Cursor[coredata.ComplianceExternalURLOrderField],
+) (*page.Page[*coredata.ComplianceExternalURL, coredata.ComplianceExternalURLOrderField], error) {
+	var items coredata.ComplianceExternalURLs
+
+	err := s.svc.pg.WithConn(
+		ctx,
+		func(conn pg.Conn) error {
+			err := items.LoadByTrustCenterID(ctx, conn, s.svc.scope, trustCenterID, cursor)
+			if err != nil {
+				return fmt.Errorf("cannot load compliance external URLs: %w", err)
+			}
+
+			return nil
+		},
+	)
+
+	if err != nil {
+		return nil, err
+	}
+
+	return page.NewPage(items, cursor), nil
+}
--- a/pkg/trust/service.go
+++ b/pkg/trust/service.go
@@ -50,29 +50,30 @@ type (
 	}

 	TenantService struct {
-		pg                    *pg.Client
-		s3                    *s3.Client
-		bucket                string
-		scope                 coredata.Scoper
-		proboSvc              *probo.Service
-		baseURL               string
-		iam                   *iam.Service
-		esign                 *esign.Service
-		html2pdfConverter     *html2pdf.Converter
-		fileManager           *filemanager.Service
-		logger                *log.Logger
-		TrustCenters          *TrustCenterService
-		Documents             *DocumentService
-		Audits                *AuditService
-		Vendors               *VendorService
-		Frameworks            *FrameworkService
-		ComplianceFrameworks  *ComplianceFrameworkService
-		TrustCenterAccesses   *TrustCenterAccessService
-		TrustCenterReferences *TrustCenterReferenceService
-		TrustCenterFiles      *TrustCenterFileService
-		Reports               *ReportService
-		Organizations         *OrganizationService
-		SlackMessages         *slack.SlackMessageService
+		pg                     *pg.Client
+		s3                     *s3.Client
+		bucket                 string
+		scope                  coredata.Scoper
+		proboSvc               *probo.Service
+		baseURL                string
+		iam                    *iam.Service
+		esign                  *esign.Service
+		html2pdfConverter      *html2pdf.Converter
+		fileManager            *filemanager.Service
+		logger                 *log.Logger
+		TrustCenters           *TrustCenterService
+		Documents              *DocumentService
+		Audits                 *AuditService
+		Vendors                *VendorService
+		Frameworks             *FrameworkService
+		ComplianceFrameworks   *ComplianceFrameworkService
+		TrustCenterAccesses    *TrustCenterAccessService
+		TrustCenterReferences  *TrustCenterReferenceService
+		TrustCenterFiles       *TrustCenterFileService
+		Reports                *ReportService
+		Organizations          *OrganizationService
+		ComplianceExternalURLs *ComplianceExternalURLService
+		SlackMessages          *slack.SlackMessageService
 	}
 )

@@ -130,6 +131,7 @@ func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
 	tenantService.TrustCenterFiles = &TrustCenterFileService{svc: tenantService}
 	tenantService.Reports = &ReportService{svc: tenantService}
 	tenantService.Organizations = &OrganizationService{svc: tenantService}
+	tenantService.ComplianceExternalURLs = &ComplianceExternalURLService{svc: tenantService}
 	tenantService.SlackMessages = s.slack.WithTenant(tenantID).SlackMessages

 	return tenantService