CX Horizon Services ("we," "us," "our") is committed to protecting client and visitor data. Our controls are designed to align with industry best practices and the Philippine Data Privacy Act of 2012 (DPA) and National Privacy Commission (NPC) guidelines.
1.Physical & site security
- Restricted access: RFID and biometric entry to controlled areas; visitor sign-in procedures.
- On-site security: 24/7 personnel and CCTV in partner facilities supporting delivery.
- Device restrictions: USB ports disabled on production machines; personal devices restricted in secure zones.
2.Network & infrastructure
- Segmentation and firewalls: Segregated environments and least-privilege network rules.
- Hardened endpoints: Baseline configurations, patching cadence, anti-malware and EDR.
- Secure connectivity: Encrypted transport (TLS) for data in transit.
3.Application & access controls
- Identity and access management: Role-based access, unique accounts, strong authentication.
- Principle of least privilege: Access granted on a need-to-know basis with periodic reviews.
- Change management: Documented change control for systems and configuration.
4.Data protection
- Data minimization: We collect only what's necessary to respond to inquiries and deliver services.
- Encryption: Data is encrypted in transit; encryption at rest is applied where technically feasible and risk-appropriate.
- Retention and disposal: Time-bound retention with secure deletion of records no longer required.
5.Business continuity & disaster recovery
- Backups: Routine, automated backups of critical systems.
- Multi-region DR (where applicable): Warm or hot standby capability in partner environments.
- Exercises: Periodic DR drills with documented outcomes and corrective actions.
6.Security monitoring & incident response
- Monitoring: 24/7 NOC and SOC-style coverage through partner facilities and tooling.
- Incident handling: Severity classification (SEV-1 to SEV-4), containment and eradication, and post-incident root-cause analysis shared with affected clients.
- Reporting channel: See "Report a security concern" below.
7.Vendor & subprocessor management
- Due diligence: Security and privacy reviews of hosting, tooling, and service providers.
- Contracts: Data-protection commitments and confidentiality obligations.
- Ongoing oversight: Re-assessment aligned to risk and material changes.
8.People & training
- Confidentiality: Staff NDAs and confidentiality obligations.
- Awareness: Security and privacy training upon onboarding and periodically.
- Acceptable use: Clear policies covering systems and data handling.
9.Compliance posture
- DPA / NPC: Program aligned with the Philippine Data Privacy Act and NPC guidance (data subject rights, breach notification, safeguards).
- Certifications: Our delivery operations may leverage partner facilities that maintain internationally recognized certifications such as ISO/IEC 27001 and SOC 2 Type II.
Note on certifications: Certifications referenced above are held by partner facilities. CX Horizon Services itself does not claim certification unless explicitly stated in a client agreement.
10.Client data processing
We can act as a data processor for clients. A Data Processing Addendum (DPA) is available on request, covering roles, instructions, confidentiality, security, breach notification, subprocessing, and cross-border transfers.
Report a security concern
If you believe you've found a security or privacy issue, please contact us at info@cxhorizon.com. Include a description of the issue, steps to reproduce, and any relevant URLs or request IDs. We will acknowledge receipt, investigate, and provide an appropriate response in line with our incident process.
