Security & trust

Your data doesn't live on our servers. That's by design.

The biggest security question to ask any IT provider isn't "what tools do you sell?" It's "what happens if you get breached?" Our answer is structural: Resource One doesn't host or store client data on its own systems, and every platform we manage you through is independently SOC 2 audited.

Start with a free IT review How we protect access

The short version

Security posture at a glance
Client data on ROI systemsNone
Platform stackSOC 2 audited
MFAEvery platform
Remote accessLogged & tracked
How we're built

We manage your systems. We don't warehouse your data.

When an IT provider stores client data on its own infrastructure, every one of its clients inherits that provider's risk. A single breach upstream becomes everyone's breach downstream — and that has made IT providers themselves one of the most targeted businesses in the country.

Resource One was deliberately built the other way. Your data stays in your environment and in the secure, independently audited platforms that protect it: your Microsoft 365 tenant, your backup vault, your systems. We monitor, secure, patch and support all of it, but we never become a second copy of it. There is no Resource One data center holding your files, and no client data warehouse to breach.

Our house rules

How we hold ourselves accountable
  • No client data hosted on Resource One systems
  • MFA required on every platform we touch
  • Team background checked & re-checked annually
  • Unique admin credentials at every client site
  • MDR running on our own systems, 24/7
  • All remote sessions logged & tracked
  • Cyber liability & E&O insured
The platforms behind the practice

Every platform we run carries its own SOC 2 attestation.

The platforms we use to monitor, protect, back up, and support your business undergo independent SOC 2 audits. Public SOC 3 reports are linked where available, and full SOC 2 reports are generally shared under NDA. We will help you obtain the documentation your auditor, insurer, or vendor-review process requires.

NinjaOne · RMM

Remote monitoring and management with full session logging. SOC 2 Type II, SOC 3, ISO 27001 and FedRAMP Moderate authorized.

View trust center →

IT Glue · Credentials & Docs

Encrypted credential vaulting and documentation with an immutable audit trail and complete change history. SOC 2 Type II audited.

View security overview →

ConnectWise PSA · Service Management

Ticketing and account management on ConnectWise's SOC 2 Type II-audited platform, with publicly downloadable SOC 3 reports.

View trust center →

Microsoft 365 · Email & Identity

Email, files and identity, secured in Microsoft's audited cloud — SOC 2, ISO 27001 and dozens of additional attestations.

View trust center →

Datto · Backup & Continuity

Backup and business continuity in SOC 2 Type II-audited vaults, with public SOC 3 reports via the Kaseya Trust Center.

View trust center →

Axcient · Backup & Continuity

SOC 2- and ISO 27001-audited backup and disaster recovery, with compliance documentation available through its trust profile.

View compliance info →

Sophos · Endpoint & MDR

Endpoint protection and Managed Detection & Response backed by a 24/7 security operations center.

View trust center →

Barracuda · Email Security

Email filtering that stops phishing, harmful attachments and bad links before they reach an inbox.

View trust center →

Commvault · Data Protection

Enterprise data protection and recovery, SOC 2 Type II audited for Commvault Cloud and managed services, with ISO 27001 certification and FIPS 140-3 validated encryption.

View trust center →

Access is a responsibility before it's a convenience.

Due diligence, welcomed

Send us the security questionnaire.

If your firm, your auditor or your cyber-insurance carrier needs a vendor risk review before we work together, good — that's exactly the diligence we'd recommend. We answer these routinely for clients in law, finance and accounting, and we'll respond to yours in plain English.

Does Resource One store our data?
No. Your data stays in your environment and in the SOC 2-audited platforms that serve it — your Microsoft 365 tenant, your backup vault, your systems. Resource One doesn’t host or store client data on its own infrastructure, which means a problem on our side can never become a copy-of-your-data problem.
Is Resource One itself SOC 2 certified?
SOC 2 audits apply to organizations that host and process customer data — and by design, we don’t. Every platform in our stack that touches your data carries its own SOC 2 attestation, and we’re happy to help you access that documentation (public SOC 3 reports directly, full SOC 2 reports under the vendor’s NDA). What we can show you about Resource One itself: mandatory MFA, background-checked staff, MDR on our own systems, and fully logged access to every client environment.
What happens if Resource One were breached?
Because we hold no client data, there’s no client data to take from us. The realistic risk for any MSP is misuse of access — which is why our access is the most protected thing we have: MFA on every platform, every remote session logged and tracked in NinjaOne, and every credential vaulted in IT Glue with a full, immutable change history.
Is Resource One insured?
Yes. Resource One carries both cyber liability and errors & omissions (E&O) coverage, and we’ll provide certificates of insurance for your vendor or compliance file on request.
Can you help us meet our own compliance requirements?
Yes — as the implementer. We build and maintain environments that support frameworks like CMMC and HIPAA, and many of the platforms in our stack meet or exceed the requirements of common compliance frameworks. What we deliberately don’t do is act as your auditor: we believe the firm that implements your controls should never be the one grading them. For formal assessments, we’ll connect you with an independent compliance partner we recommend without any financial interest — no referral fees, no kickbacks, no conflict.
What happens if we ever decide to leave?
You leave cleanly. Every agreement is month-to-month, and when a client moves on we hand over all credentials and documentation and cooperate fully with the incoming IT vendor to make the transition smooth. We’d rather be remembered as the easiest part of the change.
Let's talk

Security questions? Ask away.

Need our certificates of insurance, platform SOC reports for your vendor file, or just a straight answer about how we'd protect your business? Start the conversation.

Request my free IT review Call 503-640-5100