Trust
Our SOC 2 report, and what it means.
Every year an independent CPA firm examines how we run the systems that hold our clients' data, and tests across a full year that our controls worked. The result is a SOC 2 Type 2 report. Here is what it is, what ours covers, how to read it, and how to get your copy.
SOC 2 is the standard the American Institute of CPAs wrote for companies that run systems on behalf of others. An independent CPA firm examined ours against it and tested, across a full year, that our controls actually operated. The opinion came back unqualified, and no test noted an exception. That is the sentence behind the words "SOC 2 Type II audited" across our site. The rest of this page is the longer version.
- 12 monthstested by the auditor, not a one-day snapshot
- 2 criteriaSecurity and Confidentiality, the two that describe our promise
- 0exceptions noted on any test
Get the report
It comes by a link prepared for you, by name, and it takes about two minutes.
What you receive. The report itself, 84 pages, with your organization's name and the date on every page. Your signed copy of the one-page confidentiality agreement, countersigned by us. And the current bridge letter, which says that nothing material has changed in the months since the report's period ended.
Why a link and not a download. The auditor's restricted-use paragraph names who may read the report, and the report describes how our systems are built and defended. A link prepared for one person, behind a one-page agreement that binds us to you the same way, honors both.
What the agreement asks. Use the report to evaluate us, or to keep watch over us as your provider. Share it inside your organization and with the auditors, insurers, regulators and advisors who serve it. Do not publish it. That is the whole of it.
Get the report
The report is confidential by the auditor's terms, so it comes by a link prepared for you, not from a public page.
Already a client? Ask your team. They prepare the link in a minute, and it comes with a note from them.
Not a client yet? Pick a time to talk and we prepare one for you, or write to hello@protectedtrust.com with "SOC 2" in the subject.
The link opens a one-page confidentiality agreement, and the report and your signed copy download right after.
A note from Ingram
We did not get audited because a client demanded it. We did it because we wanted someone whose job is to doubt us to spend a year looking at how we work, and to write down what they found.
That is what the report is: not our word, theirs. When you ask whether your data is safe with us, you do not have to take my word for it. Read the opinion, then call me with whatever is still on your mind.
Ingram Leedy, Founder and CEO, Protected Trust
What the auditor did
- Set the period. December 1, 2024 to November 30, 2025. Twelve months, not a day.
- Read how we say we work. Our description of the system: the people, the infrastructure, the software, the data, the processes, the vendors, and what is outside the scope.
- Tested it against the Trust Services Criteria. Security and Confidentiality. Access reviews, change records, backup logs, training records and vendor reviews, sampled from across the year.
- Wrote the opinion. Issued April 13, 2026 by Holbrook & Manter, CPAs, of Columbus, Ohio. Unqualified, with no exceptions noted on any test.
- Started again. The next period began December 1, 2025 and runs to November 30, 2026. The next report follows in the spring of 2027, and a bridge letter covers the months between.
What ours covers
The system
Our managed services, and Send It Secure, our encrypted email service.
The criteria
Security and Confidentiality, from the AICPA Trust Services Criteria. Your systems protected, your information kept private.
The auditor
Holbrook & Manter, CPAs, of Columbus, Ohio. Independent of us. They choose the samples, and they write the opinion.
The opinion
Unqualified. The description is fair, the controls were suitably designed, and they operated effectively through the period.
Also inside
A mapping of every control to the HIPAA Security Rule, and the short list of things you do on your side.
The hosting
Microsoft Azure, carved out in the usual way. Microsoft's own SOC reports cover the data centers; ours covers what we do on top of them.
How to read the 84 pages
- The auditor's report. Two pages near the front, and the ones that matter most. Look for the words "In our opinion" and read what follows.
- Management's assertion. Our signed statement that the description of our system is accurate and that the controls did what we say they did.
- The description of the system. How the company is run. Read the complementary user entity controls, which are your part, and the subservice organization, which is Azure.
- The criteria, the controls and the tests. The long table. For each criterion: our control, what the auditor did to test it, and the result.
- The HIPAA mapping. For medical practices and anyone who holds a business associate agreement with us.
Why it matters to you
Vendor due diligence
Your own clients, your auditor, your bank or your board may ask who has access to your systems and whether anyone independent has checked them. One document answers.
Cyber insurance
Applications and renewals ask about your IT provider. An audited SOC 2 Type 2 is one of the answers underwriters want to see.
HIPAA
If we are your business associate, the Security Rule expects you to have reasonable assurance about us. Section 5 of the report maps our controls to the rule. Microsoft's own business associate agreement for the services underneath is part of its Data Protection Addendum.
The FTC Safeguards Rule
CPA and accounting practices, financial and insurance offices, and auto dealers must oversee their service providers. The report is the evidence that you do.
Procurement
Government and larger buyers ask for it by name on their vendor questionnaires.
Peace of mind
Someone whose job is to doubt us spent a year checking, and wrote down what they found.
Your part
Every SOC 2 report lists a few things the client is expected to do, called complementary user entity controls. Ours, in plain words:
- Tell us when your technical or administrative contacts change.
- Keep your own copies of the records that matter to you.
- Supervise how your people use the services we provide.
- Have your own plan for a disaster or an interruption. We will help you write it.
- Give logins only to the people who should have them, and tell us the day someone leaves.
- Keep the user IDs and passwords for our systems confidential.
- Know and keep your side of our agreement.
Three things it is not
Not a certificate
There is no SOC 2 certificate and no pass or fail. There is an opinion from a CPA firm and the report behind it. When a company says it is "SOC 2 certified," ask to see the report.
Not Microsoft's audit
Our report covers what we do. Microsoft's own SOC reports, on its Service Trust Portal, cover their data centers and services. Together they cover the whole stack.
Not a promise that nothing goes wrong
"No exceptions" means the controls operated as designed through the year, including the ones that catch and fix problems. It is evidence, not a guarantee.
Questions people ask
Plain answers.
Why Security and Confidentiality, and not all five criteria?
Because those two describe what we promise. Availability is governed by Microsoft's platform commitments and by our agreement with you. Processing Integrity and Privacy are written for companies that process transactions or consumer data at scale.
Does it cover Send It Secure?
Yes, by name. Send It Secure is part of the system the auditor examined.
How does SOC 2 compare to ISO 27001?
ISO 27001 certifies a security management system against a standard and issues a certificate. SOC 2 is an audit opinion with the test results attached. Buyers in the United States ask for SOC 2.
How often is it done?
Every year, back to back. The next period began December 1, 2025 and ends November 30, 2026, and the report follows a few months after that.
The period ended months ago. Is the report stale?
Reports are issued months after the period ends, ours in April for a November close, so a gap is normal. Readers generally accept a report whose period ended within the last twelve months, with a bridge letter for the months since.
What is a bridge letter?
A short letter from our management, for the months between the end of the audited period and the next report, stating that there have been no material changes to the controls the report describes. It is not audited. Most auditors and insurers accept it for the gap. The current one comes with the report, and a new one is issued at the close of each quarter.
Can I share it with my auditor, insurer or bank?
Yes. Within your organization and with the advisors who serve it, they are among the intended readers. Not publicly, not with a competitor of ours, and not on a website.
Why can't I just download it?
The auditor's terms, and what is inside: the report describes how our systems are built and defended. So it comes as a link prepared for you, with your name on the copy.
Who is Holbrook & Manter?
A CPA firm in Columbus, Ohio with an audit, assurance and technology risk practice. They are independent of us. They choose the samples, and they write the opinion.
Is there a SOC 3 we could publish?
Not today. If a public summary would help you, tell your team.
What happens if something goes wrong between audits?
The controls include monitoring, incident response and vendor review, and a material change would be disclosed in the next report and in any bridge letter. In the meantime, ask us. The answer will be a plain one.
Let's talk
Questions about the report? Thirty minutes with a real person.
Tell us what's going on with your technology, what's working and what isn't. We'll listen, ask a few questions, and tell you honestly whether we're the right fit. No slides, no pitch. If we can help, we'll say how. If we can't, we'll point you to someone who can.
Reach out, any way you like. A real person takes it from there.
Based in downtown Winter Haven since 1996, with offices in Orlando, Tampa, St. Petersburg, and Miami, serving businesses across Florida.