Security and Access
Agree the systems, information and permissions your role needs before onboarding. You control access to your business systems; Covela handles access on the devices and tools we manage.
Security Certification
Does Covela have security certification?
Covela’s staffing service is covered by ISO 27001 certification. You still decide which systems, information and permissions the role needs. Share those requirements with us before access is provided.
Devices and System Access
Who provides software licences?
You provide and manage licences for the day-to-day business tools your team member needs. We supply our required device and security tools, including Intune. Include business software costs in your own budget.
Who changes access to our systems?
You handle access changes in your own systems, including when someone’s responsibilities change or they leave. We handle access in Intune and on devices we manage. A change in job responsibilities does not normally change the person’s access level in our Intune arrangement.
Who holds administrator credentials and recovery keys?
We hold administrator credentials and recovery keys for Covela-owned devices. Your business holds them for devices it owns, including those bought on your behalf. Arrangements for personal devices are agreed separately before work begins.
Incidents and Offboarding
When will Covela tell us about a security incident?
We report security incidents to you as we become aware of them. Your business remains responsible for any notifications it needs to make to its customers or other parties.
What happens if a device is lost or stolen?
Locking and replacement responsibilities follow device ownership: we handle Covela-owned devices and you handle yours. We coordinate local reporting in the Philippines. Costs and security arrangements depend on the device involved.
How quickly is access removed when someone leaves?
We follow your instructions to remove access in Intune and on devices we manage. We aim to act the same day, ideally by close of business on the person’s last day. This is an internal target, not a contractual guarantee. You remove access to your own systems.