Customer support
99%Target CSAT
Positive eligible survey responses ÷ all eligible responses. Agree the survey scale, reporting window, and minimum response volume at kickoff.
Reviewed in check 34Back to TrelvaraTrelvara’s 40-point
The partner standard
Trelvara’s 40-point
partner audit.
Trust starts with the questions you’re willing to ask—and the evidence behind the answers.
Security, infrastructure, people, and quality. The complete due-diligence checklist, with a concrete evidence request and review standard for every check.
40 evidence checks4 review areasEvidence over assurances
Checklist, not a certification. This page sets out review criteria, not completed partner audit results. Partner-specific evidence, review dates, findings, and approvals are not published here; request the relevant review during scoping. The examples below are illustrative, not named partners or verified outcomes.
What a useful review records
A claim is the starting point. Evidence is the next.
Inspect the evidence
Request documents, redacted records, and demonstrations for the proposed team and delivery setup—not an unrelated office.
Make the outcome explicit
Record pass, gap, or not applicable with a reason, reviewer, evidence date, and scope. Missing evidence is not a pass.
Follow through on gaps
Document the owner, corrective action, and retest evidence. Agree suitability and any exceptions for your workflow before onboarding.
Trelvara’s SOC 2 audit is in progress—not a completed certification. Partner controls are reviewed separately. Healthcare work requires a scope-specific review of safeguards and BAA arrangements; “HIPAA-ready” is not a blanket certification.
The complete checklist
40 questions worth asking.
Area 1 / 4
Security & compliance
Who can access your data, what they can do with it, and how incidents are handled.
Checks 01–1001Named accounts & least-privilege access
Evidence to request
Redacted account inventory, role matrix, and a sample access approval.
What to establish
Access is tied to a named person and limited to the tools and records their role needs; shared credentials are flagged.
02Multi-factor authentication
Evidence to request
Identity-provider settings and a demonstration of a sign-in to the proposed client systems.
What to establish
MFA is enforced for privileged accounts and supported client systems; exceptions need a documented compensating control.
03Joiner, mover & leaver controls
Evidence to request
Onboarding/offboarding procedure and a redacted termination access log.
What to establish
An owner approves access changes and can demonstrate revocation within the client's agreed window.
04Managed devices & endpoint protection
Evidence to request
Device inventory, encryption settings, patch reports, and endpoint protection status.
What to establish
Delivery devices are managed, encrypted, patched, and monitored; unmanaged devices are not silently permitted.
05Data handling & retention
Evidence to request
Data-flow map, retention schedule, and restrictions on downloads, USB storage, and personal email.
What to establish
Permitted data locations, deletion responsibilities, and export restrictions match the client's requirements.
06Secure workspace & physical access
Evidence to request
Facility walkthrough, visitor log process, badge controls, and clean-desk policy.
What to establish
Only authorized staff reach delivery areas; screens, paper records, visitors, and remote work are covered by controls.
07Confidentiality & lawful screening
Evidence to request
Redacted confidentiality agreements, screening procedure, and consent records where required.
What to establish
Staff confidentiality obligations are documented and screening is lawful, role-appropriate, and evidenced.
08Incident response & notification
Evidence to request
Incident playbook, escalation contacts, and a redacted exercise or incident record.
What to establish
Detection, containment, client notification, and recovery have named owners and agreed timelines.
09Privacy & subcontractor obligations
Evidence to request
Data-processing terms, subprocessor register, and cross-border data-handling review.
What to establish
Data roles, subprocessors, transfer arrangements, and client approval requirements are explicit before data is shared.
10Healthcare & certification scope
Evidence to request
For healthcare: BAA, training, risk review, and workflow controls. For SOC 2 claims: report scope, period, and exceptions.
What to establish
Healthcare suitability is checked for the actual workflow. A certification claim requires current evidence covering the proposed delivery; an audit in progress is not certification.
Area 2 / 4
Infrastructure
Whether the proposed desk can keep working when systems, connectivity, or power fail.
Checks 11–2011Primary connectivity capacity
Evidence to request
Connection specifications and latency, bandwidth, and packet-loss tests during a representative shift.
What to establish
Capacity supports concurrent staff and the client's actual voice, CRM, and ticketing workloads.
12Independent internet failover
Evidence to request
Provider details, network diagram, and an observed failover test.
What to establish
A working fallback is demonstrated; two connections with the same failure path are flagged.
13Power continuity
Evidence to request
UPS/generator inventory, maintenance records, and outage test results.
What to establish
Backup power supports the planned delivery equipment for the documented continuity window.
14Voice quality & telephony
Evidence to request
Test calls, routing configuration, and voice-quality measurements from delivery locations.
What to establish
Calls are intelligible, routing works, and failures reach the agreed escalation path.
15Client-tool readiness
Evidence to request
Sandbox walkthrough of the proposed CRM, ticketing, and back-office systems.
What to establish
Staff can reach and use required tools without unapproved workarounds or personal accounts.
16Network separation
Evidence to request
Network layout, guest Wi-Fi configuration, firewall rules, and remote-access settings.
What to establish
Guest, delivery, and administrative access are separated; client connectivity follows agreed restrictions.
17Workstation & headset readiness
Evidence to request
Seat inventory, equipment specifications, and a representative desk demonstration.
What to establish
The proposed seats have supported equipment suitable for the work, with a replacement process.
18Monitoring & support ownership
Evidence to request
Alert configuration, support roster, and a redacted outage ticket.
What to establish
Connectivity and tool issues are detected, assigned, and escalated during every proposed delivery shift.
19Business continuity & recovery
Evidence to request
Continuity plan, recovery exercise, and the client's required recovery objectives.
What to establish
Fallback location, communication, staffing, and recovery steps are workable and tested against the agreed objectives.
20Capacity & coverage feasibility
Evidence to request
Seat plan, licenses, shift roster, and contingency capacity for the proposed start date.
What to establish
Available infrastructure supports the requested staffing and hours, including handoffs and planned growth.
Area 3 / 4
People & language
The hiring, training, and management behind the people who will represent your business.
Checks 21–3021English proficiency
Evidence to request
Role-specific spoken/written assessments and documented CEFR-aligned results.
What to establish
Proposed hires meet the site's C1+ English requirement; a recruiting claim alone does not establish proficiency.
22Bilingual capability where needed
Evidence to request
Spanish/English scenario assessment using the client's customer situations.
What to establish
Required language ability is demonstrated in the channel and subject matter the person will handle.
23Role-specific work samples
Evidence to request
Anonymized ticket responses, reconciliation tasks, or sales role-play scorecards.
What to establish
Candidates demonstrate the actual job's judgment and accuracy, not just interview confidence.
24Recruitment & client approval
Evidence to request
Hiring funnel, role brief, interview rubric, and client approval handoff.
What to establish
Selection follows a clear role specification and gives the client the agreed interview and approval steps.
25Employment & labor compliance
Evidence to request
Employment model, local compliance review, and redacted payroll/benefit records.
What to establish
Contracts, working hours, pay, and statutory obligations are reviewed for the delivery jurisdiction.
26Structured onboarding
Evidence to request
Training plan, attendance records, practice tasks, and readiness assessment.
What to establish
Staff demonstrate playbook and tool readiness before handling live customer or business records.
27Team-lead capacity
Evidence to request
Organization chart, supervisor schedules, and coaching workload.
What to establish
Supervisors can cover the proposed shifts and coaching load; supervision is not assumed from headcount alone.
28Retention & absence planning
Evidence to request
Dated attrition/absence reports with definitions and a staffing contingency plan.
What to establish
Reported rates can be reconciled to headcount and departures; coverage and replacement plans are documented.
29Schedule & handoff discipline
Evidence to request
Rosters, attendance method, and a sample Colombia–Philippines handoff.
What to establish
Ownership transfers clearly between shifts and hubs, with unresolved work and escalations recorded.
30Communication & cultural fit
Evidence to request
Client-facing role-play, escalation scenario, and team-lead working session.
What to establish
People show empathy, clear written communication, sound escalation judgment, and compatibility with the client's working style.
Area 4 / 4
Quality & reporting
How work is measured, reviewed, corrected, and made visible to you.
Checks 31–4031Version-controlled playbooks
Evidence to request
Sample SOP, change history, owner, and staff acknowledgment process.
What to establish
Agents use the approved workflow and changes have an owner, approval, and training trail.
32QA rubric & sampling
Evidence to request
Channel-specific scorecard, sample-selection method, and redacted reviewed work.
What to establish
QA checks accuracy, compliance, and customer handling; sampling covers shifts, agents, and higher-risk work.
33Reviewer calibration
Evidence to request
Two reviewers scoring the same sample and a calibration discussion record.
What to establish
Disagreements are reconciled against the rubric so scores are comparable and not just subjective.
34CSAT definition & survey integrity
Evidence to request
Survey trigger, response counts, reporting window, and a calculation from redacted source data.
What to establish
The 99% CSAT target is distinguished from actual results; eligible responses and the denominator are disclosed.
35Record-accuracy measurement
Evidence to request
Completed-record sample, error taxonomy, and QA reconciliation.
What to establish
The 99.5% accuracy target uses an agreed record-level definition, sample size, and reporting period.
36HR & payroll error measurement
Evidence to request
Redacted transaction QA log, correction trail, and calculation method.
What to establish
The <0.1% error-rate target names the unit being checked and counts errors consistently, including material exceptions.
37SLA & KPI definitions
Evidence to request
Draft service-level schedule, dashboard definitions, and escalation thresholds.
What to establish
Coverage, response windows, exclusions, and any 99.5% SLA target are defined in the engagement—not treated as blanket guarantees.
38Reporting & traceability
Evidence to request
Dashboard walkthrough and reconciliation of a metric to redacted source records.
What to establish
Clients can see agreed metrics, reporting freshness, owners, and how numbers were calculated.
39Weekly review & corrective action
Evidence to request
Redacted review agenda, action log, coaching record, and follow-up verification.
What to establish
Missed targets lead to assigned actions and follow-through; a dashboard alone is not oversight.
40Escalation & transition readiness
Evidence to request
Escalation matrix, client communication plan, and exit/transition checklist.
What to establish
Urgent issues have accountable contacts and the client's playbooks, records, and access can be handed over safely.
From the service-target panel
The number needs a definition.
These are the same targets shown on our homepage—not past client results. Measurement, reporting windows, and engagement-specific service levels are agreed at kickoff.
Data processing
99.5%Accuracy target
Records meeting the agreed accuracy criteria ÷ records checked. Report the sampling method and error categories alongside the result.
Reviewed in check 35HR & payroll
<0.1%Error-rate target
Units with an error ÷ units checked. Define the transaction or record, material errors, and reporting period before work begins.
Reviewed in check 36Weekly reviews and live dashboards should connect these definitions to source records and corrective actions. Review checks 37–39 for SLA definitions, reporting traceability, and follow-through.
Partner review examples
What this looks like in practice.
Illustrative scenarios for Colombia and the Philippines. No partner identities, certifications, or audit outcomes are implied.
Colombia · Illustrative example
Bilingual support team
A US business needs English/Spanish support inside its own ticketing system.
- Evidence to inspect
- Request MFA settings, a failover demonstration, language assessments, and the CSAT survey method.
- A gap to challenge
- Example gap: a backup line shares the primary connection's failure path.
- Follow-through
- Request an independent fallback and a repeat failover test before approving that delivery setup.
Relevant checks: 02 · 12 · 21 · 22 · 34
Philippines · Illustrative example
Order & reconciliation desk
A growing retailer needs order processing and reconciliation with an overnight handoff.
- Evidence to inspect
- Request a restricted role matrix, a redacted reconciliation work sample, retention rules, and a shift-handoff log.
- A gap to challenge
- Example gap: the accuracy dashboard has no agreed denominator or sampling method.
- Follow-through
- Agree the record-level metric and run a QA sample before relying on the dashboard.
Relevant checks: 01 · 05 · 23 · 29 · 35
Before you hand over the work
Ask to see the evidence for your team.
Bring your security requirements, systems, and workflows. We’ll discuss the relevant partner review, open questions, and next steps with you.
Scope a vetted team