In recent years, heterogeneous SoCs, embedding multiple processor cores and programmable logic, have progressed in terms of complexity and performance. They embed more and more components of different natures. From a security point of view, this leads to an increase of the attack surface exploitable by an attacker. The goals of these attacks are to take control of the system and/or have access to sensitive data. To address this issue, in this article, we propose a novel heterogeneous SoC architecture called TrustSoC, which is secure-by-design. Our proposition presents an innovative way of partitioning the system into worlds to provide the designer with different levels of exclusion for the provision of security. Tiny and distributed hardware security wrappers apply policies and actively monitor the SoC communication bus to enforce these levels of security and prevent any unwanted behavior. TrustSoC is a novel proposition that considers both software and hardware approaches to secure the device. We demonstrate our approach by prototyping the security wrappers as well as their operating rules and show that TrustSoC requires minimal changes while significantly improving the state of the art on secure-by-design architectures.