Intelos | Trust Center

Intelos Trust & Security Center

Great partnerships are built on more than good intentions. They're built on proof. Every MSP says they're secure. Intelos is one of the elite 5% who can prove it.

See section

Resources

intelos.com

Master Services Agreement

Service Level Agreement

FAQs

SOC 2 (System and Organization Controls 2) is an independent auditing framework developed by the American Institute of CPAs (AICPA). It evaluates whether a service organization has the security controls, policies, and processes in place to protect the confidentiality, integrity, and availability of the data it manages on behalf of clients. Unlike vendor badges or self-assessments, SOC 2 is performed by a licensed, independent third-party CPA firm that issues a formal attestation report based on evidence — not claims.

SOC 2 audits are structured around five Trust Service Criteria (TSC): Security, Availability, Processing Integrity, Confidentiality, and Privacy. For Intelos, our audit focused on Security, Availability, and Confidentiality — the three criteria most relevant to protecting your business data. The auditor independently tested our policies, controls, access management practices, incident response procedures, vendor risk management, and operational continuity programs.

SOC 2 Type I is a point-in-time assessment — it confirms that controls are designed correctly at a specific moment. SOC 2 Type II is a far more rigorous evaluation: it covers an extended audit period (in Intelos's case, a full quarter — July 1 through September 30, 2026) and validates that controls were not only designed correctly but were operating effectively and consistently throughout the entire period. Intelos completed a SOC 2 Type II attestation.

SOC 2 was originally designed for SaaS companies and cloud service providers, but it translates exceptionally well to managed service providers. MSPs are entrusted with some of the most sensitive assets a business has — your cybersecurity infrastructure, your data backups, your cloud environments, your email systems, and your business continuity. SOC 2 gives your business verifiable proof that Intelos has the documented policies, enforced controls, and independent oversight in place to protect those assets — not just the promise that we do.

No — and that is exactly the problem. There is currently no federal or state regulatory requirement for MSPs in the United States to hold any specific certification, license, or undergo any independent audit. Any individual or company can operate as an MSP with zero accountability to a governing body. There is no minimum security standard. No continuing education requirement. No oversight at all. Intelos pursued SOC 2 because we believe the businesses we serve deserve better than the industry's default standard — which is no standard at all.

Approximately 5% of MSPs in the United States have earned a SOC 2 attestation. That means roughly 95% of managed service providers — including many well-established names — have never submitted their operations to independent external scrutiny. Intelos is proud to be in the top 5%. It is an elite group of providers who have made a deliberate investment in accountability, transparency, and the businesses they serve.

Every MSP says they take security seriously — and many genuinely do. The challenge is that without independent verification, you have no way to distinguish a provider with a truly robust and audited security posture from one that has great marketing language. SOC 2 removes that ambiguity. It replaces "trust us" with "here is a formal report from an independent CPA firm that tested and validated our controls." That is a fundamentally different level of assurance.

Many MSPs hold vendor-issued certifications — Microsoft Partner status, various cybersecurity product certifications, or internal compliance badges. These are valuable and signal product expertise, but they evaluate knowledge of a vendor's platform, not the MSP's own internal security practices. SOC 2 is the only widely recognized framework that independently audits the MSP's own operations — its internal policies, how it manages access to your data, how it would respond to an incident, and whether its security commitments are consistently enforced over time.

When Intelos holds a SOC 2 attestation, it means the security frameworks we apply to our own operations have been independently verified. Those same frameworks — our access controls, our data handling policies, our incident response procedures, our vendor risk practices — are the foundation of the service we extend to your environment every single day. You are not just getting a vendor who claims to be secure. You are getting a partner whose security posture has been tested and documented by an independent auditor.

Yes. Intelos is committed to full transparency. Our trust profile is publicly available at secure.intelos.com. Our full SOC 2 attestation report is available upon request for clients and qualified prospects. We encourage you to review it, ask questions about it, and use it as part of your due diligence process. Transparency is a core part of why we pursued SOC 2 in the first place.

View all

Subprocessors

Intelos uses and engages third-parties or data processors with access to certain Customer Data (each, a "Subprocessor"). This page lists all possible third-party vendors that may be resold to the Customer as well as each potential data Subprocessor. Intelos currently uses third party Subprocessors to provide infrastructure services, security service, and IT customer support services. Prior to engaging any third party or data Subprocessor, Intelos performs due diligence to evaluate their privacy, security and confidentiality practices, and executes an agreement implementing its applicable obligations. Any product or vendor that is used in delivering services to our customers undergoes a process that may include some or all of the following: • Formal evaluation and comparison framework is established based on business requirements. • Top providers are researched and chosen based on independent third-party reviews and industry surveys. • Providers undergo our internal third-party risk management process and which may include a security risk assessment or review of the recent SOC2 or ISO27001 reports. • The product or solution is tested for appropriate interoperability with existing solutions and service processes. • The solution is tested in a sandbox or isolated test environment. • A product owner or champion is assigned to own the solution internally. • Deployment of the solution internally within our own business. • Training and relevant certifications are obtained to support and deploy the product. Intelos may use the following Third-Parties or Subprocessors to perform functions or resale of products or services to customers: