Is an offshore team safe? NDA, access control and data handling
“Safe” is not a property of the country. It is the result of a few controls you set up before data moves. Here is what Lydon provides and what you should do on your side.
What can actually go wrong
When business owners ask whether an offshore team is safe, they usually mean four different risks:
- Data leaving the business: documents, customer lists or financial records copied or shared.
- Access that outlasts the person: logins that still work after someone leaves.
- Intellectual property: who owns what the team produces.
- Continuity: what happens to the work if the person disappears.
Each has a practical control. None depends on where the person sits.
What Lydon puts in place
- A mutual NDA before any data moves.
- A signed Service Agreement with an SLA attached.
- Ownership of all work product stated in writing.
- A supervised office, with CCTV, access control and backup power as standard.
- Biometric daily attendance, and a named escalation contact.
- Your systems and your logins, so data stays in your tools and you keep control of access.
These are listed on the risk page and the transparency page.
What you should do on your side
Contracts and an office help, but the strongest controls are the ones in your own systems:
- Create a named login for each team member. Never share your own.
- Give access to the minimum folders and tools the role needs, and nothing else.
- Turn on two-step verification wherever your tools support it.
- Keep sensitive data in your systems rather than in files sent by email or chat.
- Write an offboarding checklist: remove each login, collect any shared passwords and rotate them.
- Review who has access to what every quarter.
These are the same controls you would use for a new local employee. They are simply easier to apply when you set them up on day one.
Questions to ask any offshore provider
- Who employs the person, and who is responsible if they leave?
- Is there a mutual NDA, and when is it signed relative to access being given?
- Who owns the work product, and is it in writing?
- Where does the person work, and who supervises the workplace?
- How is attendance recorded?
- What certifications or audits do you hold, and can you show them? If your industry requires a specific one, ask for it in writing before you sign.
A good provider answers these directly. Be cautious of any provider that answers with a general assurance and no specifics.
A note on legal advice
An NDA and a services agreement are legal documents, and how they are enforced depends on the countries and the wording. Have your own lawyer read them before you sign, especially if your data is regulated or particularly sensitive. This article is practical guidance, not legal advice.
Questions, answered
Who owns the work the team produces?
Ownership of all work product is stated in writing in the agreement.
Will the team keep my data on their own computers?
The model is built around your systems and your logins. Ask for work to be done inside your tools, and keep downloads to a minimum.
Is monitoring included?
Monitoring software is available as an optional add-on. It is not the default.
Start with one seat
Tell us the role. We send screened candidates together with the complete monthly cost. If it works, add a second. If it doesn’t, you’ve lost 30 days’ notice and nothing else.