# Is Colo Solutions SOC 2 certified?

Source: https://www.colosolutions.com/answers/is-colo-solutions-soc-2-certified/
Updated: 2026-08-27
Reviewed by: James San Filippo

There is no such thing as SOC 2 certification — SOC 2 produces an examination report, not a certificate. Colo Solutions holds an unqualified SOC 2 Type 2 report covering its Orlando Colocation Services for the period October 1, 2024 through September 30, 2025, examined by 360 Advanced against the Security and Availability trust services criteria. A SOC 1 Type 2 report covers the same period.

## Key figures

- **Report:** SOC 2 Type 2 — unqualified opinion (360 Advanced, Inc.)
- **Trust services categories:** Security and Availability (2 of 5)
- **Period:** October 1, 2024 – September 30, 2025
- **Also held:** SOC 1 Type 2, same scope and period, unqualified opinion
- **Availability:** Reports and bridge letters provided under NDA

## Why "certified" is the wrong word

SOC 2 is an attestation engagement performed under AICPA standards. An
independent CPA firm examines a description of the system and the controls in it,
then issues an opinion. There is no certificate and no certifying body. A vendor
advertising "SOC 2 certification" is describing something that does not exist,
which is a useful thing to notice when comparing providers.

## What the report actually covers

| | |
| --- | --- |
| Type | Type 2 — design **and** operating effectiveness, tested across the period |
| Categories | Security and Availability |
| Scope | Colocation Services |
| Period | October 1, 2024 – September 30, 2025 |
| Opinion | Unqualified, in all material respects |
| Examiner | 360 Advanced, Inc., St. Petersburg, FL |

Two of the five trust services categories are in scope. Confidentiality,
Processing Integrity and Privacy are not. Providers rarely spell this out, and
"SOC 2" unqualified is widely assumed to mean all five — so it is worth checking
on any provider you are comparing, including this one.

## What is deliberately not in scope

The report records that certain criteria were not applicable because Colo
Solutions **does not have logical access to customer environments**, does not
manage or monitor customer infrastructure, and does not develop or manage changes
to customer systems or data.

For a colocation customer that is the point: your environment stays yours. It
also means your own controls — encryption, access management, logging, workforce
training — remain inside your compliance program, not delegated to the facility.

## Between reports

The engagement runs October to September and the report is issued in the
following months. Colo Solutions issues **bridge letters** covering the interval,
confirming no material change to controls since the end of the reported period.
Vendor risk teams generally ask for these; they are available on request.

## Getting a copy

SOC reports are restricted-use documents, so they are provided under NDA. Call
(407) 210-2480 or use the contact form.