Partner Support
Speak to Sales
[ Trust Center ]

IT By Design is SOC 2 Type II Compliant

Our most recent audit was completed in October 2026 by MHM Professional Corporation. Customers and prospects can request the full report through the form on this page.

Request the SOC 2 Report

What Was Examined

Scope and Standard of the Examination

A SOC 2 Type II report is an attestation issued by a licensed CPA firm under AICPA standards (SSAE 18, AT-C sections 105 and 205). The auditor tests our controls against the Trust Services Criteria across the full review period, and reports whether each control operated as designed.

Type I

Covers control design on one date.

Type II (Ours)

Includes the auditor's opinion, management's assertion, the system description, and the auditor's tests of controls with their results.

IT By Design engineers work inside customer PSA, RMM, and client documentation systems. That access puts IT By Design inside your vendor risk scope. This report is the evidence for assessing it.

Attestation

At a Glance

Report
SOC 2 Type II
Standard
AICPA SSAE 18 (AT-C 105 and 205), 2017 Trust Services Criteria
Independent auditor
MHM Professional Corporation
Audit completed
October 2026
Distribution
Restricted-use report, released under NDA

Why It Matters to Your MSP

How MSPs Use This Report in Client Due Diligence and Audits

An MSP uses a delivery partner's Type II report in two places: client contracts and its own audits.

Client due diligence

Co-managed and mid-market clients send security questionnaires down the supply chain, and those questionnaires cover every third party with access. A current SOC 2 Type II report answers the vendor-risk section during renewals and new enterprise bids.

Evidence for your auditor

If you are pursuing your own SOC 2 or ISO 27001, or serving HIPAA-covered clients, vendors with logical access sit inside your audit boundary. Our report serves as vendor monitoring evidence, and it states which controls remain your responsibility.

Access to your PSA and RMM

Our engineers work inside your ConnectWise, Autotask, or HaloPSA environment from managed devices on managed networks, in offices we own. You set the roles and permissions, and you can revoke them at any time.

Same controls on every shift

Documented procedures and structured escalation apply on every shift. Help desk and NOC coverage runs under the same controls round the clock.

Governed Delivery

Operating Controls Applied to Every Engagement

Facilities
100% in-office delivery from facilities owned and operated by IT By Design in India and the Philippines. Controlled facility access.
Remote access
No work-from-home and no hybrid access to customer systems. No exceptions.
Workforce
Every team member is a full-time IT By Design employee. No subcontractors, freelancers, or rotating contractor pools.
Networks and devices
Managed networks, managed devices, monitored access, and documented access governance.
Client authority
Engineers work inside your PSA, RMM, and SOPs. Your environment stays sovereign: you grant, scope, and revoke access.
Segregation
Teams are dedicated to one MSP and are not rotated across customers.
Continuity
Backup coverage for planned and unplanned absences, documented procedures, and structured escalation.
Liability
Team members are covered under IT By Design's Errors and Omissions insurance.

Governed AI

AI Engineering Runs Under the Same Access Controls

AI engineering for customers is delivered from the same IT By Design offices, under the same access rules. Data handling, automation boundaries, access control, and accountability are documented before any agent goes into production. Each build defines where the agent acts on its own and where a human reviews first. Your MSP keeps oversight of every client-facing output.

Governed AI
Data handling
Automation boundaries
Access control
Accountability

Enterprise Trust

IT By Design Delivery at a Glance

SOC 2
Type II Compliant

100%
In-Office Delivery

96%+
CSAT Across Delivery

900+
Engineers

20+
Years Serving MSPs

Trusted by 400+
Growth-Stage MSPs

FAQ

SOC 2 Questions MSP Leaders Ask Us

Yes. IT By Design holds a SOC 2 Type II report. The most recent audit was completed in October 2026 by MHM Professional Corporation.
MHM Professional Corporation, an independent audit firm. The firm issued the report in October 2026.
No. SOC 2 is an attestation. A licensed CPA firm examines the controls and issues a report with its opinion. There is no certificate. The report itself is the evidence.
Type I reports on control design at a single date. Type II also tests whether the controls operated effectively across a review period. IT By Design holds a Type II.
Submit the form on this page. The report is released under NDA to customers and qualified prospects.
Yes. Your auditor can use it as evidence of vendor monitoring for your own SOC 2 or ISO 27001 audit.
No. All delivery happens from offices owned and operated by IT By Design. No work-from-home and no hybrid access to customer systems.
Yes. For MSPs serving healthcare or other regulated clients, IT By Design executes BAAs.

Request the Report

See the Evidence for Yourself

Submit your details below. Requests go to our compliance team, which verifies the requester and releases the report under NDA.