Security certifications for offshore development
What to ask an offshore development company about security, and our honest answer on each item.
Global BrainForce holds no SOC 2 report or ISO 27001 certificate yet. Our controls are aligned to both, and we say exactly what is in place.
- 7 practices in place for every professional
- Controls aligned to SOC 2 and ISO 27001
- Your data stays in your systems
What to ask, and where we stand
Ask for evidence rather than logos. A report or certificate names its scope and its auditor; a provider without one should say so. These are the questions, and our status on each.
- Aligned, no certificate
- controls in place, no certificate or report
- In place
- standard for every professional
- On request
- not standard today, agreed per client
SOC 2
Aligned, no certificateAsk
Can you share a SOC 2 report, and what is its scope?
What it is
An independent auditor's report on a provider's security controls against the AICPA Trust Services Criteria. It names its scope, its period and its auditor.
Global BrainForce
Controls aligned to the Trust Services Criteria. Global BrainForce holds no SOC 2 report yet.
ISO 27001
Aligned, no certificate: certification in progressAsk
Do you hold an ISO 27001 certificate, and for which scope?
What it is
The international standard for an information security management system. A certificate is issued by an accredited body after an audit and names its scope.
Global BrainForce
Controls aligned to ISO 27001, and a certification project is underway. No certificate is held yet.
GDPR and Data Processing Agreement
On requestAsk
How do you handle GDPR, and will you sign a Data Processing Agreement?
What it is
The EU data protection regulation. When a provider processes personal data on your behalf, a Data Processing Agreement (DPA) sets out how.
Global BrainForce
GDPR-compliant operations. A DPA is signed when your engagement requires one; it is not a standard document today.
Confidentiality (NDA)
In placeAsk
Is every person who works on our code under an NDA?
What it is
A confidentiality agreement that binds each individual, not only the company.
Global BrainForce
Every Global BrainForce professional is an employee and signs an NDA before starting. No freelancers.
IP assignment
In placeAsk
Who owns the code and other work product?
What it is
The contract clause that transfers the rights in everything the team produces to you.
Global BrainForce
Employment contracts assign all work product to the client.
Background checks
In placeAsk
What do you check before someone gets access to our systems?
What it is
Pre-hire checks on identity, criminal record, references and credentials.
Global BrainForce
Standard pre-hire screening for every candidate: NBI clearance, references and credentials.
Managed devices
In placeAsk
Whose laptop does the work run on, and how is it secured?
What it is
Company-managed, encrypted hardware with central control over updates and security software.
Global BrainForce
A Global BrainForce-managed laptop per professional, encrypted, with endpoint management and antivirus.
Access control
In placeAsk
How is access granted, protected and revoked?
What it is
Multi-factor authentication on accounts, and a fixed moment when access ends.
Global BrainForce
MFA on mail and tools. Access is revoked on the professional's last working day.
Workplace
In placeAsk
Where does the team work, and under which rules?
What it is
Physical security of the office, and rules for working from home.
Global BrainForce
A Makati office with access control. Work-from-home rules: no public Wi-Fi, VPN required.
HIPAA
On requestAsk
Can you work with protected health information?
What it is
US rules for protected health information. There is no official HIPAA certificate; a provider that handles health data signs a Business Associate Agreement (BAA).
Global BrainForce
HIPAA-aware processes for US clients handling health data. No BAA by default.
Incident procedure
On requestAsk
What happens when a laptop is lost or an account is compromised?
What it is
The steps a provider takes when something goes wrong, and who leads.
Global BrainForce
Global BrainForce does not host or store client data: professionals work inside your systems. A procedure for device loss and account compromise applies, and your own breach process leads.
Continuity
In placeAsk
What happens during a power cut, or when a professional is unavailable?
What it is
Backup for the workplace, and cover for the people.
Global BrainForce
Power and internet backup at the office, and a replacement arrangement when a professional is unavailable.
Status as of 22 October 2026. How our professionals use AI tools safely is on AI tools security; how we run every engagement is on enterprise-grade operations.
Answers for buyers
Can an offshore team in the Philippines work with US health data?
Yes, with care. Global BrainForce runs HIPAA-aware processes for US clients handling health data. There is no HIPAA certificate, and a Business Associate Agreement is not signed by default: it is agreed per engagement.
How are offshore developers screened and bound to confidentiality?
Every Global BrainForce professional is an employee, not a freelancer, and signs an NDA before starting. Pre-hire screening covers NBI clearance, references and credentials, and employment contracts assign all work product to the client.
Does an offshore development team from Global BrainForce store our data?
No. Global BrainForce does not host or store client data: professionals work inside the client’s own systems. Each works on an encrypted, GBF-managed laptop with endpoint management, MFA on mail and tools, and access revoked on their last working day.
Does Global BrainForce have a SOC 2 report?
No. Global BrainForce holds no SOC 2 report yet. Its controls are aligned to the AICPA Trust Services Criteria, ISO 27001 certification is underway, and the security page lists the status of every item rather than showing a logo.
What security certifications should an offshore development company have?
Ask for evidence rather than logos: a SOC 2 report or an ISO 27001 certificate names its scope and its auditor, and a provider without one should say so. Global BrainForce holds no SOC 2 report or ISO 27001 certificate yet: it runs SOC 2- and ISO 27001-aligned controls, ISO 27001 certification is underway, and a GDPR data processing agreement is signed when an engagement requires one. Healthcare work is HIPAA-aware; there is no HIPAA certificate.
Bring your security questionnaire
Get matched with developers within 4 hours
No upfront commitment
Fully managed setup
Want a recommendation and cost estimate first? Get matched