Security at Insaan Global
When you hand us part of your operation, you trust us with your systems, your data and your customers. We protect that trust through everyday practices: who gets access, which devices they use, where your data lives, and how you stay in control.
Our approach
Security in an outsourced operation is decided in ordinary moments: when an account is created, when someone changes role, when a customer shares something sensitive, when a person leaves. So this page describes those moments and what we do in them.
Every client is different. Your industry, your customers and your own security team will shape the rules for your account. We agree those rules with you before go-live and build them into training, access and quality review.
Your security team is welcome to review any of this in detail, and we expect to be asked hard questions.
Our practices
Who works on your account, and how they are trained.
The devices your team uses and what each role can reach.
Where your data lives and how much of it we touch.
Which AI tools are allowed, and who checks their output.
What you can see, and which changes need your approval.
Where your data lives
Wherever the work allows, your customer data stays in your systems. Our team reaches it through named, role-based access from managed workstations, and does the work there.
Select any part of the diagram to see how it works.
Performance and quality data, as agreed with you
Your environment
Wherever the work allows, our team works inside the tools you already own. Customer records, conversations and documents remain in your systems, under your retention settings and your logging.
The access lifecycle
Most access problems come from access that was never reviewed or never removed. So we manage it as a lifecycle, from a person’s first day on your account to their last.
Step 1 · Onboard
A new team member signs confidentiality agreements, completes security awareness training and learns your account’s specific rules. Access is requested only once that is done.
Step 2 · Grant
Access is set up for the role the person holds, with only the permissions that role needs. Roles and their permissions are agreed with you, and you can see every account in your own systems.
Step 3 · Review
We review who has access to what on a regular schedule, and whenever someone changes role. Anything no longer needed is removed. We can run these reviews together with your team.
Step 4 · Offboard
When someone leaves your account or the company, their access is removed promptly and their workstation is returned to a clean state. Confidentiality obligations continue after they leave.
Amman hubOn the floor
Workstations are set up, managed and monitored by the company. Personal devices aren’t used for client work.
Clean-desk rules apply to sensitive work, so customer information isn’t left out or copied onto paper.
Client teams sit together in dedicated rooms at the Amman hub.
If your work needs stricter rules at the desk, we agree them with you and build them into training.
Shared responsibility
If something goes wrong
Mistakes can happen in any operation. We aim to catch them early, tell you about them openly and fix the cause so they don’t recur. Notification terms are agreed in each client contract.
Anyone on the team can raise a concern, and Team Leads know to escalate quickly. Monitoring and quality review help surface issues early.
We act first to stop any harm from spreading, for example by pausing access or taking a workstation offline.
We notify your named contacts in line with what we agreed in your contract, and keep you updated as we learn more.
We work out what happened and why, and work with your team if your systems are involved.
We fix the root cause, update procedures and training, and share what changed with you.
For your security team
We invite your security and compliance teams to review how we work before you sign anything. We will complete your vendor security questionnaire, walk through our practices on a call, and talk through any requirements specific to your industry.
FAQ
This page sets out the practices we follow on every account. We’re happy to walk your security team through them in detail, answer your questionnaire and discuss any specific requirements your business has.
Wherever the work allows, your data stays in your own systems and our team works inside them through named, role-based accounts. Retention follows your policy. If a task needs data to move, we agree how with you first.
Yes. Send it to us during your review and we will complete it and walk your security team through our answers.
Only in the ways you approve. We agree with you which AI tools may be used, for which tasks, and people review AI output where it affects customers or decisions.
We contain it, tell your named contacts in line with our agreement, investigate the cause with you, fix it and update our procedures.
Yes. Many clients have specific rules for their industry or their customers. We agree them with you before go-live, build them into training and the quality scorecard, and check that they are followed.
Tell us what your business needs to be comfortable. We will walk your team through our practices and agree the rules for your account before go-live.