No SOC2 - how to build trust?

One of the challenges I have been facing with growing Currents.dev is building trust without investing $$ into formal certification with SOC / ISO.

I believe it is a common problem for bootstrapped SaaS companies.

Here's what somewhat worked for me:

• complete and publish https://cloudsecurityalliance.org/star CSA STAR level 1 assessment
• get and publish an independent review from protective.ai: https://protective.ai/safety-report/currents
• create a https://currents.dev/security "trust" page that highlights the practices used to ensure proper level of security and reliability.

How do you build trust and satisfy your clients compliance / due diligence concerns?