SECURITY & COMPLIANCE
A SOC 2 call
center you can
actually inspect
Every provider on your shortlist will tell you they are SOC 2 compliant. Most of them are telling the truth. Almost none of them will tell you which type of report they hold, when the audit period ended, or what happens on their floor on an ordinary Tuesday between audits.
World Connection runs its own nearshore call center in Guatemala City, more than 1,200 people across Guatemala and Boise, under US ownership. We hold SOC 2 Type II and PCI DSS attestations, and we run HIPAA programs.
This page publishes the controls underneath those, because the certificate is the summary and the controls are the thing being summarized.
What we hold, and what you should ask us for
A framework name on a web page is a starting point, not evidence. Here is what each one actually covers and what to make us produce.
Framework
What it actually covers
What to ask us for
SOC 2 Type II
Security controls tested across a period of time, not confirmed on a single day
The report itself, and the end date of the audit period
PCI DSS
How cardholder data is handled, stored and kept out of places it should not be
The attestation and its date
HIPAA
How protected health information is handled on healthcare call center programs
The controls applied to your specific program, in writing
One distinction is worth more than the rest of this table. A Type I report says the controls existed on one day. A Type II says they were tested over a period. They are not close to the same thing, and a provider who says only "SOC 2" without naming the type is usually holding Type I. Ask. We hold Type II and we will send you the report.
Where the work physically happens
The largest security variable in this industry is no longer encryption. It is whether the person handling your customer's data is sitting in a controlled room or at a kitchen table.
World Connection runs in office. Our teams work from our building in Guatemala City, and that single fact is what makes every control below enforceable rather than aspirational.
Physical access
Entry is badged at both pedestrian and vehicle points, and badge access is segregated. An employee can enter the production areas they are authorized for and no others, so somebody working on one program cannot walk onto the floor of another. That applies to our own staff, not only to visitors.
Clean desk, enforced rather than posted
No paper at workstations. No personal electronics at workstations. Clear water containers only, so that what is on the desk can be seen to be a water container.
No phones on any production floor
Lockers sit outside the floor and phones stay in them. Where a manager holds an operational exception, that exception is printed on their badge, so the rule is enforceable by anybody looking rather than by anybody remembering. A policy that depends on memory is not a control.
Cameras, visitors and training
Camera coverage runs across the common areas, every floor entrance and the production floors. Visitors sign in, carry visitor identification, remain escorted for the length of the visit, and cannot enter a floor belonging to an account they are not part of. That applies to visiting clients too, which is the same protection working in your direction. Training runs on a separate floor from live production, so people who are not yet certified are never in the room where live customer data is handled.
Data, access and accountability
-
Role-based access on least privilege. People hold the access their role requires and nothing beyond it, and the badge segregation above is the physical expression of the same rule.
-
Encryption in transit and at rest across core systems.
-
Documented policies and procedures for every CX workflow, with regular internal audits and control testing between external audits.
-
Incident response playbooks with defined response times, so the answer to "what happens if" is a document rather than an improvisation.
-
Executive ownership. Security and compliance are owned at executive level, not delegated to whoever is free.
-
Ongoing training for agents, supervisors and support staff, and third-party risk management for the vendors behind us.
Connectivity, power and continuity
Availability is a security control. A team that cannot reach your systems is a team that is not protecting anything.
Connectivity. Two international circuits on separate carriers, over separate fiber rings, one routed through Miami and one through Panama, with automatic failover. Two circuits from one carrier on one ring is a single point of failure wearing a disguise.
Power. Centralized UPS backed by a diesel generator rated past twenty-four hours. Generators are tested weekly and the UPS monthly, because equipment that is never tested is a plan rather than a capability.
Governance. Our Business Continuity Plan is at revision 4.0, reviewed annually, owned by a standing Emergency Management Operations Committee rather than by whoever is available when something happens.
Every one of those is checkable. Ask us for the carrier names, the generator rating, the test logs and the revision date on the plan. A continuity plan is a document. A second carrier on a separate ring and a generator that was tested last week are what make the document true.
How to evaluate any provider's security claims
Including ours. Put these to everyone on your list and compare the answers rather than the logos.
Ask whether the report is Type I or Type II, and when the period ended. A hesitation here is the answer.
Ask to see the report, not a claim that one exists. An expired attestation and a current one look identical in a slide deck.
Ask whether agents work from home. Then ask how that is verified, because a policy is not a control.
Ask what stops an employee walking onto another client's floor. If the answer is a general access policy rather than segregated badges, there is nothing stopping them.
Ask what their continuity plan actually covers, when it was last revised, and who owns it. Then ask when the generator was last tested. A plan nobody has revised and equipment nobody has started is a document, not a capability.
Ask whether you can visit the floor, then go. An hour in the building settles more than any questionnaire.
Frequently asked questions
Are you SOC 2 Type I or Type II?
Can we see the actual report, not just a claim that one exists?
Do your agents work from home?
Do you subcontract any of the work?
Can an employee access a client program they are not assigned to?
What happens before a new agent touches live customer data?
What happens if the site loses power or connectivity?
Can we audit you, or visit the floor?
Talk to the people who own this
Send us the program, the volume and the framework you have to satisfy, and you will get a straight answer about whether we can carry it, from someone senior enough to commit to the answer.
If your security team wants the SOC 2 Type II report before anything else happens, ask for it and we will send it, with the end date of the audit period.