Data
Data: your systems, your data
Work is done in your systems, under logins you issue and control. Team members connect through a VPN or directly through your own platforms, depending on your IT setup, and Offshored holds no client data on its own infrastructure. Every candidate has a pre-screening interview and an NBI clearance, the Philippine national police check, and all client system logins are removed on the team member's last day. USB ports and personal cloud drives are blocked on company supplied devices. Offshored is not ISO 27001 certified (Offshored data security page).
The California Consumer Privacy Act (CCPA)
The CCPA applies to for-profit businesses that do business in California and meet any of three tests: gross annual revenue over $25 million; buying, selling or sharing the personal information of 100,000 or more California residents or households; or deriving 50% or more of annual revenue from selling California residents' personal information. The exemptions for employee data and business to business data expired on December 31, 2022 (California Attorney General, CCPA, updated August 28, 2026).
If the CCPA applies to you, the duty to respond to consumer requests sits with your business, not with a service provider you use (California Attorney General, CCPA). Because your team member works inside your systems, the requests are handled in the same systems you already answer them from.
HIPAA for healthcare businesses
The HIPAA Rules apply to covered entities (health care providers that transmit health information electronically in a standard transaction, health plans and health care clearinghouses) and to their business associates. If a covered entity engages a business associate to help carry out its health care activities, it must have a written business associate contract that sets out what the business associate has been engaged to do and requires it to protect protected health information (HHS, Covered Entities and Business Associates). HHS publishes sample provisions for that contract (HHS, Business Associate Contracts).
Offshored signs a business associate agreement with any US healthcare client that needs one (Offshored Terms of Service for US clients).
Philippine law that also applies
Unauthorized access, disclosure, copying, transmission, loss, misuse or theft of client data is a serious breach that may result in immediate termination, civil liability and criminal prosecution, including under the Philippine Data Privacy Act. You can also require a separate non-disclosure agreement (Offshored Terms of Service for US clients; National Privacy Commission, Data Privacy Act of 2012).