Back to all articles

Keeping your data safe when you outsource: 8 questions to ask

Handing work to an outside team means giving them access to your systems and your customers' information. These eight questions help you check a provider takes security seriously.

Outsourcing admin or customer support means giving another team access to your inbox, your systems and often your customers' personal information. That is a reasonable thing to do, as long as you know how the provider protects it. Here are eight questions to ask before you sign.

1. Are the people your employees?

A provider who employs its staff directly can train them, supervise them and hold them to company policies. If the work is passed on to freelancers or subcontractors, ask who they are and how they are vetted.

2. Does everyone sign a confidentiality agreement?

Every person working on your account should sign an NDA before they start. Ask to see the template.

3. Where does the work happen?

Work done from a managed office, on company computers, is far easier to control than work done on personal laptops at home. Ask about the setup, and whether staff can use personal devices or USB drives.

4. How is access controlled?

Good providers follow the principle of least access: each person can reach only the systems and data their role needs. Ask whether they use individual logins rather than shared passwords, and whether two-factor authentication is switched on.

5. What happens when someone leaves?

Access should be removed on the same day a team member leaves the account. Ask how quickly this happens and who is responsible.

6. How is customer information handled?

Ask what rules staff follow for personal data: for example, never copying card details, never taking screenshots of customer records and never sending data to personal email or messaging apps.

7. Who checks the work?

Supervision is a security control as well as a quality one. A supervisor reviewing conversations and activity spots problems early.

8. What happens if something goes wrong?

Ask how incidents are reported to you, how quickly, and who your point of contact is.

How we handle it

At Vero, every team member is our own trained employee. They sign NDAs, work supervised shifts from our managed office and are given role-based access only to the systems they need. You can read more about how we work or ask us anything about security before you start.

Want help with this in your business?

Talk to us about building a dedicated team.

Get in touch