Security & Compliance, Stated Plainly
What we do, what we sign, and what we can show you. No badges without substance.
Controls First, Claims Second
Procurement and compliance teams read a lot of vendor pages that say "certified" without saying what that means. We would rather tell you exactly what exists. Our CIO, David Fullwood, leads the program and walks every prospective client through it under NDA before any sensitive discussion begins.
Everything below applies to all three delivery centers: Kingston, Mandeville and Treasure Beach.
HIPAA, PCI DSS and SOC 2
HIPAA
There is no government HIPAA certification, and HHS does not recognize any private one. As a business associate we sign a Business Associate Agreement before handling protected health information, train every agent on HIPAA before go-live and annually, enforce minimum-necessary, role-based access inside your systems, log sessions, and keep documented administrative, physical and technical safeguards available for your review.
PCI DSS
Where agents take payments, they work inside your PCI-scoped payment flow so cardholder data stays in your environment and our scope is reduced. Our own controls follow the PCI DSS requirements for service providers: segmented networks, restricted and logged access, no storage of cardholder data, and annual review. Ask for our current validation documentation and attestation of compliance under NDA.
SOC 2
SOC 2 is an AICPA attestation issued by an independent CPA firm, either Type 1 (design at a point in time) or Type 2 (operating effectiveness over a period). Our controls are built to the SOC 2 Trust Services Criteria for security, availability and confidentiality. Ask us for our current attestation status and report availability; we will tell you exactly where we stand rather than wave a badge.
What Is in Place at Every Site
- Physical security. Access-controlled facilities with 24/7 CCTV monitoring and visitor logging.
- Connectivity. Dual fiber connections at each center, with programs split across sites for continuity.
- Hosting. Our infrastructure is hosted on US-based servers behind enterprise firewalls; client data stays in client systems wherever possible.
- Access control. Role-based access, least privilege, unique credentials, multi-factor authentication for administrative access.
- Logging and monitoring. Session and access logging with retention set to client requirements.
- Clean desk, clean screen. No personal devices, paper or removable media on the production floor.
- Training. Security and privacy training at onboarding and annually, with HIPAA and PCI modules for regulated programs.
- Business continuity. Multi-site redundancy across Kingston, Mandeville and Treasure Beach, generator power, and documented storm-season procedures. Jamaica's BPO sector recovered most capacity within weeks of the 2025 hurricane; we plan for that reality rather than pretend it does not exist.
- Agreements. NDA before sensitive discussions, BAA for healthcare, data processing terms and client-specific security addenda.
- Client visibility. Access to call recordings, scorecards and compliance metrics so you can audit us yourself.
Compliance FAQ
Can we audit you?
Yes. Clients can review documentation, interview our compliance lead, and with notice visit our centers. Many clients also audit through the recordings and scorecards they already have access to.
Will you complete our security questionnaire?
Yes. Send it with the NDA and our CIO's team will complete it, typically within a week.
Where is data stored?
In your systems wherever possible. Our own infrastructure is on US-based hosting. We do not store cardholder data.
What happens during a hurricane?
Programs are split across sites, each has generator power and dual connectivity, and we have documented storm-season procedures. We will show you the continuity plan for your program before launch.
Send Us Your Security Questionnaire
NDA first, then documentation. Our CIO's team usually turns questionnaires around within a week.