Security, privacy and technology
Trust is built into the operating model.
CallServ protects client, customer and workforce information through administrative, technical, physical and contractual controls designed around each engagement. We describe implemented controls and improvement work precisely, and provide supporting evidence for the applicable scope and period.
Core controls
Identity and access
Individually assigned accounts, role-based permissions, least-privilege practices and access review according to program requirements.
Managed endpoints
Company-managed device controls include approved configuration, encryption, automatic updates, screen lock and endpoint protection appropriate to risk.
Remote connectivity
Authorized remote connections use encrypted access, including Fortinet VPN where applicable, and are restricted to approved users, devices and program conditions.
Monitoring and evidence
Relevant access, device, quality and security evidence is collected according to the system, risk, contract and requested review period.
Incident response
Suspected security and privacy events are escalated, assessed, contained, communicated and reviewed under documented procedures.
Continuity planning
Connectivity, workforce, platform and recovery dependencies are planned according to the service design, including dual-ISP capability where included.
Security, privacy and compliance status
CallServ maintains a HIPAA compliance programme for applicable, in-scope healthcare services. Our HIPAA controls, policies, risk-management activities and supporting evidence are managed and continuously monitored through the Drata governance, risk and compliance platform. CallServ is also advancing formal readiness programmes for SOC 2, PCI DSS and ISO/IEC 27001. Until the applicable independent assessment, report, validation or certification has been completed, CallServ will describe these programmes accurately as in progress and will not represent them as completed certifications or attestations.
| Area | Current position | Safe website disclosure |
|---|---|---|
| Core security controls | Implemented and evidence-managed | CallServ maintains administrative, technical and physical controls designed to protect client information and support contractual, regulatory and security requirements. Evidence for applicable controls may be provided under appropriate confidentiality arrangements. |
| HIPAA | Compliance programme implemented and managed through Drata for applicable, in-scope services | CallServ maintains HIPAA-aligned administrative, physical and technical safeguards for applicable services involving protected health information. Policies, controls, risks and supporting evidence are managed and monitored through Drata. Client-specific requirements, permitted uses of protected health information and Business Associate Agreement obligations are confirmed before service commencement. |
| SOC 2 | Readiness and evidence programme in progress | CallServ is working toward an independent SOC 2 examination. CallServ does not currently claim to hold a SOC 2 Type I or Type II report unless a current report is separately supplied for the relevant service and period. |
| PCI DSS v4.0.1 | Readiness and scope validation in progress | CallServ is working toward the applicable PCI DSS validation for services that store, process, transmit or may affect the security of payment-account data. The required assessment method and Attestation of Compliance will depend on CallServ's confirmed role and payment-data environment. No current PCI DSS Attestation of Compliance is claimed unless separately supplied. |
| ISO/IEC 27001 | Information-security management system readiness in progress | CallServ is developing its information-security management system toward ISO/IEC 27001 certification. CallServ does not currently claim ISO/IEC 27001 certification unless a current certificate is separately supplied for CallServ and the relevant scope. |
| Privacy and data protection | Contract, processing-role and jurisdiction-specific | Privacy obligations are assessed according to the information processed, the locations involved, CallServ's role as controller or processor, applicable law and client contractual requirements. Appropriate privacy and data-processing terms are established before processing begins. |
CallServ will provide evidence for implemented controls and will describe improvement work as 'in progress.' A roadmap, policy or software platform does not by itself establish certification, compliance or operating effectiveness. The positions above are those of the CallServ Security, Privacy and Compliance Statement, version 1.0, effective September 5, 2026, which is reviewed at least annually and after material control, regulatory or service changes.
Technology model
Technology selected for the workflow, visibility and control the program requires.
CallServ can operate in approved client systems or combine approved contact-center, CRM, workforce, quality, collaboration and reporting platforms. System ownership, licensing, configuration, access, support, integration and data-location responsibilities are confirmed before launch.
Platform categories
- Telephony, IVR, routing and call-recording platforms
- CRM, ticketing and customer-workflow systems
- Workforce planning, quality and performance reporting
- Approved collaboration, monitoring and remote-work tools
- Client-approved AI voice and workflow automation
Data protection and privacy
Data handling is confirmed for the actual program.
Before launch, CallServ and the client document the permitted information, systems, users, processing purpose, storage, recordings, support access, retention, deletion, subprocessors, cross-border access and incident-notification responsibilities. CallServ does not state that all data is stored in the United States or Canada by default.
Applicable obligations may include Trinidad and Tobago's Data Protection Act, 2011; Canada's PIPEDA and relevant provincial privacy laws; United States federal, state and sector requirements; and other laws expressly included in the contract. Applicability is determined for the actual data, people, industry, locations and processing role.
Incident and continuity
Prepare for disruption before production begins.
Program plans identify critical services, contacts, dependencies, escalation routes, workarounds and recovery priorities. Incident notification follows the agreed contract and applicable law; no universal notification promise replaces a program-specific requirement.
Evidence request
Procurement teams can request evidence matched to the opportunity.
Subject to confidentiality and client restrictions, CallServ can assemble policies, risk and asset records, access reviews, workforce training evidence, device-control reports, continuity and incident records, vendor assessments and current assurance-status documentation for the relevant scope and period.
A policy demonstrates intent. Procurement proof should also show operating evidence for the requested period - for example tickets, logs, approvals, training records, review results, test outputs and remediation closure.