Identity and Access
Access is aligned to assigned responsibilities, client-approved systems, and the least level of permission needed for the work.
Information Security Built Into the Delivery Model
CF applies risk-based security and access practices to the people, systems, facilities, and workflows used in each engagement. The controls used for a specific engagement depend on the service scope, client systems, data access, and contractual responsibilities.
Certified Philippine Operations
ISO/IEC 27001:2022
Delivery is supported by CF Solutions Philippines Inc., whose Philippine operations are certified to ISO/IEC 27001:2022 within the certificate scope.
Certification applies only to the legal entity, location, activities, and scope stated on certificate PH26/00000076. It does not mean every CF entity, website, service, client environment, or healthcare engagement is separately certified.
Security Practices Defined Around the Engagement
Workforce and Workspace
Documented confidentiality, acceptable-use, workstation, and facility practices support the approved delivery environment.
Operational Controls
Defined procedures, quality review, exception handling, escalation paths, and continuity planning help keep responsibilities visible.
Technology and Monitoring
Client-approved tools, logging, monitoring, backup, and technical controls are applied as appropriate to the system and agreed scope.
Protected health information
Healthcare Data and PHI
CF discusses Business Associate Agreements where applicable to the parties, service, and data access involved. CF website forms are not intended to collect protected health information.
Do not submit patient names, medical record numbers, diagnoses, dates of service, claim numbers, or other protected health information through this website.
Request Security Documents
Prospective clients may request the certificate and scope, a security overview, and other available due-diligence materials. Document availability may depend on confidentiality requirements and the stage of the engagement.
Review the Certificate Alongside the Delivery Model
Confirm the certified entity and scope, then discuss the controls and contractual requirements relevant to the intended engagement.