Is Colo Solutions SOC 2 certified?
There is no such thing as SOC 2 certification — SOC 2 produces an examination report, not a certificate. Colo Solutions holds an unqualified SOC 2 Type 2 report covering its Orlando Colocation Services for the period October 1, 2024 through September 30, 2025, examined by 360 Advanced against the Security and Availability trust services criteria. A SOC 1 Type 2 report covers the same period.
| Report | SOC 2 Type 2 — unqualified opinion — 360 Advanced, Inc. |
|---|---|
| Trust services categories | Security and Availability (2 of 5) |
| Period | October 1, 2024 – September 30, 2025 |
| Also held | SOC 1 Type 2, same scope and period, unqualified opinion |
| Availability | Reports and bridge letters provided under NDA |
Why “certified” is the wrong word
SOC 2 is an attestation engagement performed under AICPA standards. An independent CPA firm examines a description of the system and the controls in it, then issues an opinion. There is no certificate and no certifying body. A vendor advertising “SOC 2 certification” is describing something that does not exist, which is a useful thing to notice when comparing providers.
What the report actually covers
| Type | Type 2 — design and operating effectiveness, tested across the period |
| Categories | Security and Availability |
| Scope | Colocation Services |
| Period | October 1, 2024 – September 30, 2025 |
| Opinion | Unqualified, in all material respects |
| Examiner | 360 Advanced, Inc., St. Petersburg, FL |
Two of the five trust services categories are in scope. Confidentiality, Processing Integrity and Privacy are not. Providers rarely spell this out, and “SOC 2” unqualified is widely assumed to mean all five — so it is worth checking on any provider you are comparing, including this one.
What is deliberately not in scope
The report records that certain criteria were not applicable because Colo Solutions does not have logical access to customer environments, does not manage or monitor customer infrastructure, and does not develop or manage changes to customer systems or data.
For a colocation customer that is the point: your environment stays yours. It also means your own controls — encryption, access management, logging, workforce training — remain inside your compliance program, not delegated to the facility.
Between reports
The engagement runs October to September and the report is issued in the following months. Colo Solutions issues bridge letters covering the interval, confirming no material change to controls since the end of the reported period. Vendor risk teams generally ask for these; they are available on request.
Getting a copy
SOC reports are restricted-use documents, so they are provided under NDA. Call (407) 210-2480 or use the contact form.