Security Posture

Upstream BPO Sdn. Bhd. is certified to ISO/IEC 27001:2022. The certificate is held by the Malaysian legal entity and covers the certified location listed below. We provide the certificate itself to reviewers on request.

The Statement of Applicability governing the certified management system is SOA-UBSB-01, dated 12 February 2023. Reviewers who need to map our declared controls against their own control framework request the Statement of Applicability through the same route as the certificate.

The certificate carries an explicit scope statement. We reproduce it here verbatim so that a reviewer compares our certified scope against their intended service scope without relying on a paraphrase:

“Information Security Management System applicable to Inbound Call Centre Services, Outbound Telesales, Lead Generation, Appointment Setting Services, IT Support & Security, Back Office Services and Business Processing Outsourcing Services”

Services outside that wording sit outside the certified scope. Where a proposed engagement falls outside it, we say so during scoping rather than extending the certificate by implication.

Upstream BPO conducts penetration testing annually. The 2026 testing round was carried out by Altream, a cybersecurity practice affiliated with Upstream BPO. We describe this as internal testing rather than independent third-party assurance, because the tester is an affiliated party.

Reviewers who require testing by an unaffiliated assessor raise that during security review, and we address it as part of engagement scoping.

Upstream BPO operates a coordinated vulnerability disclosure programme. It covers security vulnerabilities affecting Upstream BPO services and infrastructure.

Report a vulnerability to dpo@upstreambpo.com using the subject line “Security Vulnerability Report”. We acknowledge every report within 5 business days of receipt. We work to a coordinated disclosure timeline of 90 days from acknowledgement, and we extend that window by mutual agreement where an issue is complex to remediate.

Good-faith security research conducted under this programme does not violate Upstream BPO's terms of service. We will not pursue legal action against researchers who follow the rules of engagement below.

Upstream BPO does not operate a paid bug bounty. We recognise researchers who report valid findings through named acknowledgement, with the researcher's consent and under the name they choose.

We will publish a security acknowledgements page carrying those names. Until that page is published, we confirm recognition directly with the researcher when a report is resolved.