Handing your phone line to a company you have never met, in a country you have never visited, is a reasonable thing to feel careful about. The calls coming in are the ones that turn into jobs, and the person answering them is speaking as your business.
The good news is that most of what separates a solid provider from a risky one can be checked before you commit. Some of it is paperwork you can ask to see. Some of it is a straight question with an answer that either comes back specific or comes back vague. The checks below work whether you run an HVAC shop, a plumbing company, or a portfolio of rental units.
Start with whether the company is registered to do what it says it does.
Philippine outsourcing companies handling customer data fall under the Data Privacy Act of 2012. The National Privacy Commission requires businesses that employ 250 or more people, or that process sensitive personal information on 1,000 or more individuals, or whose processing is likely to pose a risk to data subjects, to register their data processing systems and their Data Protection Officer with the Commission. That requirement is set out in NPC Circular No. 2022-04. Companies below those thresholds still have to file a sworn declaration of exemption.
Registered companies receive a Certificate of Registration and an NPC Seal of Registration. Asking to see one is a short question with a documentary answer. Ask for the name of their Data Protection Officer while you are at it, since the same rules require one to be appointed and registered.
There is a real difference between a dedicated team and a shared pool, and it shows up in how calls sound.
Questions worth asking directly:
A provider running dedicated teams can answer all four in a minute. A provider running a shared queue tends to answer in generalities about capacity and coverage. Neither model is wrong for every business, but you want to know which one you are buying.
Most home service accounts involve outbound calls as well as inbound, for confirmations, follow-ups, and scheduling.
Under the Truth in Caller ID Act, FCC rules prohibit transmitting misleading or inaccurate caller ID information with intent to defraud, cause harm, or wrongfully obtain anything of value. Displaying a business’s own call-back number is a legitimate and common practice. The FCC also requires a telemarketer to transmit its own number or the number of the business on whose behalf the call is being made, along with a number that is answered during business hours so a consumer can ask not to be called again. The Commission’s guide to spoofing covers both points.
So the question is simple. When your team calls a customer back, does your business number appear, and does that number reach a live person during your hours? A provider that cannot say clearly which number goes out has not thought this through.
Recording is standard in this business, and the disclosure that goes with it is where providers differ. Ask to hear an actual recorded greeting rather than reading the script on a slide.
Beyond the disclosure, the useful questions are about what happens to recordings afterward:
Quality review that happens on a schedule leaves a paper trail. Quality review that happens when a client complains does not.
If any of the calls your team places count as telemarketing, the FTC’s Telemarketing Sales Rule sets recordkeeping requirements that reach both the seller and the telemarketer. Under the current version of 16 CFR 310.5, records must be kept for five years, and the call detail records required include the calling number, the called number, the time and date, the duration, and the disposition of the call.
Whether or not your account falls under that rule, the standard it describes is a good one to hold a provider to. A system that can produce a call-by-call record with times, durations, and outcomes is a system you can audit. A monthly summary report is not the same thing.
Vendor websites carry a lot of security language. What you want is a document with an auditor’s name on it.
SOC 2 is the one most commonly asked for. It is an examination report issued by an independent CPA firm against the AICPA’s Trust Services Criteria, covering security and, depending on scope, availability, processing integrity, confidentiality, and privacy. A Type 1 report looks at whether controls were designed properly on a given date. A Type 2 report looks at whether they actually operated over a period of months. Type 2 tells you more. SOC 2 produces a report rather than a certificate, so a provider that says it is “SOC 2 certified” without offering the report is describing something that does not exist in that form.
If your team will handle card payments over the phone, ask separately for an Attestation of Compliance against PCI DSS, the standard maintained by the PCI Security Standards Council. Many home service companies sidestep this by keeping card entry away from the agent entirely, using a payment link sent to the customer instead.
This is the question US buyers skip most and regret most.
The Philippines sits in the most cyclone-exposed part of the world. PAGASA, the national weather agency, reports an average of 20 tropical cyclones entering the Philippine Area of Responsibility each year, with about eight or nine of them crossing the country, and nearly 70% of them developing between July and October. That information is on PAGASA’s tropical cyclone page.
An established provider has planned for this and can describe the plan without hedging. Ask what backup power the site runs on and how long it lasts. Ask whether there is a second internet provider and how failover happens. Ask whether agents can work from home during a storm and whether they have the equipment to do it. Ask what happens if the whole site goes down, and whether another location or another shift picks up your calls.
Then ask when they last used the plan. A provider that has been through a storm season has a story, and the story is more useful than the policy document.
Put structure around the start so you are evaluating something rather than hoping.
A workable setup includes a defined start date with a named account manager, a call review session in the first two weeks with recordings you have picked yourself, agreed answers for your ten most common call types before the team goes live, a written escalation path covering after-hours emergencies, and clear notice terms on both sides.
Escalation deserves the most attention. Write down what counts as an emergency for your business, who gets called, in what order, and how long the team waits before moving to the next name. A burst pipe at 2am is not the moment to discover that the rule was never written.
A few patterns are worth a second look:
None of these is proof of a problem on its own. Two or three together usually means the operation is younger or thinner than the website suggests.
Most of these checks take a single email each. Working through them before you sign puts you in a much better position than working through them after a missed emergency call.
For a broader look at how Philippine support teams are structured for repair and property management companies, including which roles transfer well and how coverage is set up, see our guide to offshore support for home service businesses.