Every vendor deck from the Philippines now promises AI, analytics, cloud and security, so the buyer’s job is to separate the desks that run that technology from the desks that merely list it. The technology behind modern customer support falls into seven areas, and each one has a specific piece of evidence a provider can show during due diligence and a specific red flag that shows up when it cannot. This checklist is written for the COO or VP of CX evaluating the customer service outsourcing service a Philippine provider is proposing, and it assumes you will spend a day, on site or over a shared screen, verifying rather than listening.
Start with the human-machine split: AI and automation
The first question is which contacts the machine resolves alone, which it hands to a person and how the hand-off feels to the customer, because that split defines the program’s cost and its experience at the same time. Chatbots and virtual assistants should own the routine intents (order status, password reset, balance, appointment change) end to end, and the Filipino agents should own everything that needs judgment, empathy or authority to make an exception.
Evidence to request: the intent list the bot handles today, the containment rate for each intent and the rate at which contained contacts come back on another channel within 48 hours. Red flag: a single blended “automation rate” with no breakdown, or a bot that hands off without passing the transcript, forcing the customer to start over. A hand-off that arrives with full context is the clearest sign the vendor designed the split around the customer rather than around a deflection target.
Machine learning and personalization: does the desk know the customer?
What personalization should mean
Personalization means the agent in Cebu opens the contact already knowing the customer’s tenure, last three interactions, open orders and likely reason for calling, and the routing engine sent the contact to the agent best placed to resolve it. It does not mean the bot uses the customer’s first name. Machine learning models score intent, churn risk and complexity at the moment of contact, and the results should be visible on the agent’s screen, not buried in a monthly report.
How to verify it
Ask an agent to take a live or recorded contact and narrate what the screen told them before they said hello. Ask the operations lead how routing rules changed in the last quarter and what data drove the change. Red flag: routing is still by skill group only, and “personalization” is a CRM field the agent has to search for.
Data analytics: from big data to a fixed process
Analytics pay for themselves when they remove contacts, so the evidence you want is a process the vendor’s data changed, not a dashboard. Speech and text analytics tag every interaction for reason, sentiment, compliance phrases and outcome, and a mature desk turns that into a weekly ranked list of upstream root causes the client can fix: a confusing invoice line, a returns page that fails on mobile, a policy the website explains badly.
Evidence to request: an anonymized contact-reason report from an existing client, and one example of a client-side change that reduced volume. Red flag: sentiment gauges and word clouds with no owner and no action log. Buyers should also secure the raw data contractually; the interaction record is yours, and the analysis of it should not disappear if you change providers. The way the strongest operations have moved from analytics to emotionally intelligent service design is covered in the piece on designing emotionally intelligent service delivery.
Cloud: scale without capital, and continuity without drama
A cloud contact-center platform is what lets a Philippine provider add forty seats for your peak season in weeks, move a program between a Manila site and agents’ homes during a typhoon and give you the same reporting whichever site is live. It also means the vendor is not amortizing a hardware investment into your rate. Hybrid staffing became a permanent design option when the CREATE MORE Act, signed in November 2024, allowed registered enterprises to run work-from-home arrangements for up to half their workforce while keeping their incentives.
Evidence to request: the platform name and tenancy model, the on-site, remote and hybrid split proposed for your program, and the last business-continuity test report with the time it took to fail over. Red flag: a continuity plan that exists as a document but has never been exercised, or a platform the vendor cannot name because it differs by client.
Cybersecurity and compliance: the non-negotiables
Security is the one area where a description is never acceptable and a certificate is only the beginning. The frameworks that matter for a North American program delivered from the Philippines are SOC 2 Type II for the operation as a whole, PCI DSS wherever a card number can be spoken or typed, HIPAA for any health information and GDPR for European customers; PITON-Global’s own delivery network is governed under HITRUST CSF, SOC 2 Type II, ISO 27001, PCI DSS, HIPAA and GDPR, which is the standard a buyer should expect any shortlisted provider to meet or explain.
Evidence to request: the current SOC 2 Type II report itself (not the badge), the scope statement showing your program’s sites are inside it, the PCI attestation and the endpoint controls for remote agents (virtual desktop, device management, screen and clipboard restrictions, clean-desk monitoring). Red flag: a report more than a year old, a scope that covers headquarters but not the delivery site, or remote agents on personal devices. Insist that the security schedule in the contract references the specific controls, because that is what you will enforce against.
Training technology and the human element
Technology in training should shorten time to proficiency and make quality consistent across cohorts; it is not a substitute for the empathy and judgment the agents themselves bring. Simulation platforms let a new hire in a Philippine delivery city handle a distressed customer or a complex billing dispute before a real one is on the line, and gamified practice keeps tenured agents sharp on rare scenarios. The warmth and communication skill of the Filipino workforce is the reason the human side of the split works so well, and the training layer should sharpen it rather than script it out.
Evidence to request: time to proficiency by cohort for the last two hiring waves, and the quality scores of agents at 30 and 90 days. Red flag: a training program measured only by completion, or a nesting period that ends on a calendar date rather than on a quality threshold.
Omnichannel: one experience across bot, call and social
Omnichannel is a single customer timeline that every channel writes to and reads from, so the person who chatted with a bot yesterday and calls today is not asked to repeat anything. Multichannel is five tools with five histories, and it is still sold under the better name. Social channels raise the stakes because they are public; the discussion of real-time customer care on social channels explains why a slow or inconsistent public reply is a brand event, not a queue statistic.
Evidence to request: a live demonstration of a unified timeline for a customer who used at least two channels in the past week. Red flag: the agent switches applications to find the second channel’s history. For context on how the sector built this capability, the overview of how the Philippine CX sector became a global center of gravity is a useful companion read.
The one-page checklist and what it costs
The seven areas above compress into a single table a buyer can carry into a site visit.
| Area | Evidence to see | Red flag |
|---|---|---|
| AI and automation | Containment by intent; 48-hour recontact rate | One blended automation figure |
| ML and personalization | Agent screen before “hello”; routing change log | Skill-group routing only |
| Analytics | Contact-reason report; a process it changed | Dashboards with no action log |
| Cloud and continuity | Platform name; last failover test result | Untested continuity plan |
| Security | SOC 2 Type II report and scope; PCI attestation | Report over a year old; personal devices |
| Training | Time to proficiency by cohort; 30/90-day quality | Completion-only metrics |
| Omnichannel | Live unified timeline demo | Agent switches applications |
None of this technology should add to the rate. PITON-Global’s 2026 pricing calculator uses a $12 per hour fully-loaded base rate that already includes team-lead and QA supervision, against a US in-house benchmark of $33 per hour, for typical savings of 50 to 70 percent; the platform, security and training layers sit inside that loaded figure at any Philippine provider worth shortlisting. Vendors that pass this checklist are also the ones a structured vetting process surfaces, which is why the seven-step vendor vetting framework puts forensic diligence and workflow stress-testing before contract negotiation.
Frequently asked questions
How much of this can I verify remotely?
Almost all of it. Reports, scope statements and demonstrations work over a shared screen. The site visit adds the floor walk, the coaching sessions and the physical security check, which are worth a trip for a program of any size.
What if the vendor uses my platform rather than its own?
Then the platform questions shift to integration: how the vendor’s WFM, QA and analytics tools connect to your tenant, and who owns the configuration. Security questions stay exactly the same, because the agents and their endpoints are still the vendor’s.
Is a provider without SOC 2 Type II ever acceptable?
For a North American consumer program, no. A Type I report or an “in progress” audit is a reason to wait for the Type II, not a reason to compromise.
How long does due diligence on these seven areas take?
Plan a full day per finalist, plus a week for document review. Providers that are ready will have the evidence assembled before you arrive; the ones that need to “get back to you” on the SOC 2 scope have told you something already.
