When the bank audits you,
we produce the evidence
Managed IT and cybersecurity for debt purchase, collections and consumer credit firms across London and the South East. We support the systems your agents work in, and the paperwork your clients' auditors ask for.
Most IT providers treat a collections firm like any other office
It isn't. You get audited by the people who place work with you. Banks and originators don't just check your FCA permissions — they want to see how your systems are controlled, who can reach customer data, how you patch, what happens when someone leaves, and what you'd do if you were breached. The questionnaire arrives, the deadline is short, and most of the answers have to come from your IT.
Meanwhile your dialler and case management system are the business. If agents can't work, recoveries stop that day and the backlog doesn't go away. Your call recordings are evidence. Your records include people in genuine financial difficulty, and how you flag and handle them is something you may have to demonstrate rather than describe.
We already support firms in debt purchase, collections and consumer lending — including one that goes through bank audits regularly, where producing the IT evidence is part of what we do.
The difference between a painful audit and a routine one
It is whether the evidence already exists. We keep the things auditors ask for in a state where they can be produced, not reconstructed.
Documented environment — kept current, not rebuilt the week before an audit
Patch and vulnerability status — produced on request, with dates
Endpoint detection — with retained alert history
Access reviews — starters and leavers handled as a process, not an email
Phishing simulation and training — with per-user results
Dark web monitoring — for credentials tied to your domain
Penetration testing and vulnerability scanning — when a client's due diligence requires it
When the questionnaire lands, send it to us. We'll fill in the IT sections and give you the supporting evidence, rather than leaving your operations manager to guess at answers about patching cadence and endpoint protection — and that part is included.
The controls above are priced on top of a support agreement, not bundled into it. We would rather say that here than have it appear as a surprise on a quote. How many of them you actually need depends on your size, your regulator and what the firms placing work with you demand, and we will tell you plainly which ones you can skip.
The systems your agents work in
Keeping agents working
Most collections platforms are hosted by someone else — Connex One runs in their cloud, and your case management vendor owns the application. What we own is everything between your agent and that platform: the connection, the network, the endpoint, the identity. When a dialler is slow or sessions are dropping, that is usually where the fault is, and that is where we look first. We take it up with your platform vendor when it is not.
Telephony and dialler
We support Connex One and Callcent from DDI Software, and we install and manage 3CX — with a third-party dialler layered on where a firm needs one. Not every collections operation needs a predictive dialler, and we will not sell you one you do not.
Call recording
We manage recording and retention where it sits in systems we control. Where recording lives inside a hosted platform it is the vendor's to retain, and ours to make sure you can actually get at it — access, export, and knowing who holds what.
The SFTP server your data moves through
Portfolios and case data move between you, your clients and the solicitors acting for you, and that usually means an SFTP server of your own. We have built these for collections firms and we run them afterwards — patched, monitored, backed up, with accounts and permissions reviewed rather than quietly accumulating. The point is that transfers stay encrypted, access-controlled and auditable, instead of becoming attachments and shared links nobody can account for a year later.
Subject access and data retrieval
When a DSAR lands, the work is finding everything — mailboxes, shared files, line-of-business systems — inside the deadline. We make sure the data is discoverable and the search is defensible.
Vulnerable customer data
Flags and notes about customers in difficulty are among the most sensitive records you hold. Access controls, audit logging and retention handled accordingly.
Homeworking agents
Agents handling customer data from home need the same controls as agents on the floor: managed devices, encrypted endpoints, enforced MFA, and no customer data sitting on a personal laptop.
Four steps, no surprises
Environment audit
What you are running, where the risk sits, and what an auditor would find.
Findings and priorities
Plain English, costed, sequenced. No pressure and no scare tactics.
Transition
Planned around your collection cycles rather than ours.
Steady state
Proactive monitoring, a named point of contact, quarterly review.
Firms in this sector and the ones around it
We support firms across debt purchase, collections and consumer lending, from single-office operations to multi-site teams, alongside clients in law, property, pharmaceuticals and the charity sector.
The things firms ask us first
Will you help with our clients' due diligence questionnaires?
Yes. Send us the IT sections and we will complete them and supply the supporting evidence. It is a normal part of supporting firms in this sector, not a chargeable extra every time a bank asks.
Is security included in your support agreement?
No, and be careful of providers who imply it is. Endpoint detection, phishing simulation and training, dark web monitoring and penetration testing are priced separately from day-to-day support. What is included is keeping your systems patched, monitored, backed up and documented, and completing the IT sections of the questionnaires your clients and insurers send you. We would rather you knew the shape of that before a quote lands than after.
Do you understand FCA requirements?
We are an IT provider, not a compliance consultancy. What we do is make sure your systems, access controls and records support the obligations your compliance function is accountable for — and that you can evidence it. We work with your compliance lead rather than around them.
Can you support our dialler?
We support firms running Connex One and Callcent from DDI Software. Connex One is hosted by the vendor, so the application is theirs; we look after the network, endpoints, identity and connectivity your agents depend on, and we take it up with the vendor when the fault is at their end. For firms on 3CX we can add a third-party dialler, or leave it out if you do not need one.
We already have an internal IT person. Is that a problem?
No. We work alongside in-house IT as well as replacing an outgoing provider — out-of-hours cover, security monitoring and project work are common reasons firms bring us in.
Do you handle PCI compliance?
Not as a consultancy service. We do the testing side and keep the environment in good order, and we work alongside your QSA or self-assessment. Anyone promising full PCI scope management as part of a managed IT agreement is overselling.
Are you certified?
We hold Cyber Essentials and renew annually. We're a Microsoft 365 specialist and provide licensing as a Cloud Solution Provider.
Where are you based?
Croydon, supporting clients across London, Surrey, Kent, Essex and the South East.
Let's look at what an auditor would find
A 20-minute call and a free environment audit. You'll get a clear picture of where you stand, whether or not you work with us.
Book your call — hello@starma.it