Secure by design. Certified to prove it.

Offshore staffing under a SOC 2 Type II attestation, with the documented controls your legal and IT teams will ask for.

Every framework your legal and IT teams ask about already covered

Clutch Top BPO Company Philippines 2023Clutch Top Back Office Outsourcing Company Philippines 2023Best Workplace Culture 2023AICPA SOC 2Inc. 5000 Vet100OA500 Global Outsourcing Firm Index Top 500 2025
Connext security and compliance overview

SOC 2 Type II took six months of work to earn, and it changed how Connext handles data internally. Every framework below applies to all four delivery centers — the Philippines, India, Colombia and Mexico not to a single head office.

AICPA SOC 2 Type II
SOC 2 Type II

Connext operates under a SOC 2 Type II attestation report: independently audited controls over security, availability and confidentiality, renewed every year at every delivery site. Available under NDA.

HIPAA compliant
HIPAA

Protected health information handled under signed Business Associate Agreements, with HIPAA training renewed quarterly.

Philippines National Privacy Commission
NPC Registration

Data Protection Officer and Data Processing Systems registered with the Philippines' National Privacy Commission under the Data Privacy Act of 2012.

GDPR

Data protection standards for companies with EU exposure.

PCI DSS

Card payment workflows run on processes aligned with the PCI DSS standard, under the same access controls and monitoring applied across every delivery center.

ISO 27001

Information security management follows controls aligned with the ISO 27001 framework, applied the same way across all four delivery centers.

The controls behind every team

Physical access

Biometric entry, CCTV monitoring, a clean desk policy, locker rooms for personal electronics and private rooms on request. Every office runs on redundant internet and power. Not “secure facilities” as a claim — a walkthrough you can request before signing.

Device and network

Connext-provisioned hardware only, no personal devices on client systems, encrypted connectivity over a VPN tunnel and antivirus enforced fleet-wide.

People and process

Every hire passes a background check before starting, signs an NDA and is trained on your specific data-handling requirements — not a generic security course. On top of that, every employee takes IT security training each quarter.

Data residency

No client data is ever stored on offshore devices. Your team works inside your systems, on your side of the perimeter.

Audit cadence

Access controls are documented and independently audited every year, at every delivery site that touches your data.

Least privilege

Specialists reach only the records and fields their task requires. The work happens inside your systems, under your access controls and your audit logging.

Onboarding and offboarding

Connext runs IT setup and access provisioning against a checklist on day one. When someone leaves your account, facility access and device provisioning are revoked and documented — an answer you can put in writing before moving data offshore.

How the workstation is locked down.

Hardware

Every seat ships from Connext: a desktop with 16 GB of RAM, two 24-inch monitors, Windows and enforced antivirus. No personal machine ever touches your systems.

Encryption

Workstations are encrypted and provisioned before the first login, so protected data is covered at the device level and not only in transit.

Access

Logins use multi-factor authentication and each account runs on its own segregated network, monitored around the clock.

Monitoring

Connext's own monitoring software tracks equipment health and working hours, so compliance is measured rather than assumed.

What your vendor review will ask

(I)Who is the legal employer?

(II)Will you sign a BAA?

(III)Where does our data live?

(IV)Who can walk into the room?

1/4

The same four questions come up in every security questionnaire we get. Here are the answers, before you have to ask for them.

Connext International Inc. is the in-country employer of record, holding the contracts, payroll and benefits under local law.

Yes, on every healthcare engagement, and before the first hire starts.

In your systems. Nothing is stored on offshore devices, and every workstation is provisioned and monitored by Connext.

Only the staff assigned to your account. Biometric entry and CCTV on every floor, and a walkthrough you can book before signing.

←
→

Your vendor review shouldn't be the hard part

Extending your team offshore shouldn't mean extending your risk. Connext gives your IT and legal teams documented controls and straight answers before your first hire starts.

Build a Secure Offshore Team
Connext team reviewing security documentation
Connext operations centre monitoring equipment uptime

24/7 IT support and equipment monitoring

Connext-provided hardware, monitored for uptime, backed by a 24/7 Operations Center — so security doesn't stop when the workday does.

Teams  we can help you build
Every client receives the full suite of Connext outsourcing services, enabling you to easily build and manage your offshore team

Our case studies

Scale Behavioral Health Revenue Cycle Operations Without Compromising Quality

See how a behavioral health billing company scaled from 37 to 66 facilities with strong reimbursement, compliance, and quality performance.

Find out more

Scaling Order Processing and Accounting Support for a Hawaii-Based Food Distributor

Build offshore teams for order processing, invoicing, picking tickets, and accounting support. Scale your food distribution business faster.

Find out more

They Were Already Offshoring. It Just Wasn't Working

See how a U.S. IT company replaced a costly contractor with a structured offshore service desk — starting with just two hires. Download the case study.

Find out more