Clients do not lose sleep over “the cloud.” They lose sleep over a screenshot, a forwarded spreadsheet, or an account that still works after someone has left. On a remote floor those failures are easier, not harder. So the controls have to be dull and sampled — not a one-time training video.
This is the operating view behind our data security and protection work. It is also how we run every other service line. Security is not a product we bolt on after go-live.
Least privilege is a weekly habit
Agents receive named accounts for the systems in their SOP. Shared “training” logins do not survive into production. When someone changes role, we change the group. When they leave, access is cut the same day — not at month-end when Finance remembers the licence fee.
We keep a simple access register: who, which system, who approved, last review date. If you audit us, that register is the artefact you should ask for first. A policy that says “least privilege” without a register is theatre.
The home endpoint is in scope
We specify Windows machines that can take updates, enough memory to run your tools, and a wired network. We do not treat a phone hotspot as a production network. Idle lock, no family sharing of the work profile, and no client data on personal chat apps are written rules, not suggestions.
Files that must move do so through the tools you approve. Emailing a CSV “just this once” is an incident, even if the agent was trying to be helpful.
Monitoring and incidents
Unusual download size, login from a new place, or a burst of failed passwords is a reason to pause the account and call the agent — then you. We would rather false-alarm than discover a leak in a client’s complaint.
The incident path is a one-pager: who the agent tells, who we tell you, what we freeze, and what we write down. Speed matters more than a pretty severity matrix. If you have a legal or compliance contact, they are on that page before go-live.
What we will not do
- Put production data on a personal Gmail or WhatsApp thread
- Give a new joiner admin rights “so they can explore”
- Keep alumni accounts “in case they come back”
- Hide a suspected incident until we have a perfect root-cause essay
Our public legal summary is the privacy notice. How the rest of the remote floor runs is in How a 100% WFH BPO in India works.