TL;DR
- Four common models, four different device answers. Settle which one you are actually buying before you discuss equipment at all.
- Provider-supplied is the default in seat-based work and it is usually fine. The problems start where your security policy is stricter than their standard build.
- The question that decides everything later is who owns the hardware, which is separate from who controls the data on it.
- A seat price almost always includes a device. What it rarely specifies is the specification, the refresh cycle or who replaces a failure.
- Exit is where this gets expensive. Devices, data and access all have to come apart, and most contracts describe only the first.
- Build-operate-transfer has a device transfer inside it that almost nobody prices at the start.
A company signs a managed services agreement with a provider in Manila. Twelve engineers, a seat rate, a start date six weeks out. The commercial conversation covers headcount, rates, escalation paths and service levels in some detail. The word laptop appears nowhere in the document.
Eight months later the company needs to prove to a customer that every device touching their data is encrypted and centrally managed. It asks the provider for a list. The provider supplies one, which is helpful, and it shows a mix of machines, several older than the engagement, running a build the provider standardised on years ago, enrolled in the provider’s management tooling rather than the client’s. None of that breaches anything. None of it was agreed either, because nobody specified it.
This is the normal outcome of IT outsourcing philippines arrangements, and it is not a failure of the provider. Equipment is one of the few parts of an outsourcing agreement that both sides reasonably assume the other has thought about. The client assumes the provider equips its own people. The provider assumes the client will say if it has requirements. Both are right, and nothing gets written down.
Best tools for Device Management
A boundary. This article describes common commercial practice and the questions worth asking. It does not say what any contract requires, what any law requires of you, or what any arrangement transfers. Those depend on specifics and jurisdiction. Take local advice in the Philippines before you rely on any structure described here.
Why the Philippines, and what that means for equipment
Some context, because the device decisions follow from what the market actually is rather than from outsourcing in general. Philippine outsourcing has a particular shape, and it is the shape that determines the right equipment answer.
The Philippines has been a major destination for international service delivery for decades, which means the supplier base is deep and experienced. Providers here have run equipment operations at scale for a long time, hold stock, have repair relationships, and have seen every variation of the questions in this article. That maturity is the strongest argument for letting them supply the devices: you are buying into an operation that already works rather than building one remotely.
It also means the supplier base is wide, ranging from large established operators with thousands of seats to small firms running teams of ten. The equipment maturity varies enormously across that range, and a proposal from a twelve-person firm and one from a multinational can read similarly while describing very different realities. The questions in this article separate them quickly.
Two market characteristics bear directly on devices. Geography. This is an archipelago, and delivery, replacement and recovery all behave differently outside the main urban centres. A provider operating only in Metro Manila and Cebu is a different proposition from one with provincial reach, and the difference only shows up when somebody needs a machine replaced in a province.
And weather
Typhoon season affects courier networks, power and connectivity, with provincial routes degrading first. For a facility-based team this is a business continuity question the provider owns. For a home-based team it is a question about whether anyone can work, and the equipment answer to it is whether there is any local spare capacity at all. Ask how the last significant disruption was handled rather than whether there is a plan.
Four models, and why the device answer differs in each
Outsourcing is one word covering four quite different commercial shapes, and most confusion about equipment traces back to two parties using the word to mean different things. Anybody comparing proposals for it outsourcing philippines work should settle which of the four they are actually buying before the equipment conversation starts, because the right answer on devices is different in each.
Business process outsourcing
You buy an outcome. Calls answered, tickets closed, transactions processed. The provider decides how, including with what equipment, and it is their operation end to end. Device ownership is theirs and asking otherwise is usually a misunderstanding of what you bought.
Staff augmentation
You buy people who work in your systems, to your direction, inside your team. The provider employs them and bills a rate. This is where equipment gets genuinely ambiguous, because the person operates as part of your team while being equipped by somebody else.
Managed services
You buy a function with a service level attached. The provider runs it. Equipment is typically theirs, but your security requirements may well be stricter than their default, and that gap is yours to identify.
Build, operate, transfer
The provider stands up a team, runs it, and at an agreed point the whole thing moves to you. Devices are supposed to move with it. What that means in practice is covered below, because it is the model where equipment is most often an afterthought and most expensive to get wrong.
The question that disambiguates all four is simple: whose systems does the work happen in, and whose policy applies to the device it happens on. Where those two answers point at different parties, you have an equipment conversation to have.
Provider-supplied devices: what you get and what you do not
Provider-supplied is the default in most outsourcing in the Philippines and it is usually the right answer. The provider buys locally, holds stock, replaces failures from a buffer, and has done it hundreds of times. That is a genuinely better operation than most clients could run remotely.
What you get is reliability and speed. A failed machine in a provider’s Manila facility is replaced the same day from a shelf. A failed machine you shipped from Amsterdam is replaced in three weeks.
What you do not get, unless you ask, is specification control. Providers standardise for their own economics, which generally means adequate rather than generous, sized for the median task across their client base. If your work is heavier than that median, the machines will be a constraint nobody mentions and everybody feels.
You also do not get your management tooling on the device. The machine is enrolled in the provider’s, which is reasonable because they support it, and which means you cannot independently verify encryption state, patch level or disk contents. Where a customer asks you to evidence those things, you are relaying an answer rather than producing one.
Nor do you get a refresh commitment by default. A three year old machine is still a working machine from the provider’s perspective, and there is no reason for them to replace it early at their own cost. If you want a refresh cycle, it is a commercial term, not an assumption.
None of this is a reason to avoid provider-supplied equipment. It is a list of things to specify if they matter, and most of them cost very little to specify at the start.
Client-supplied devices: what you take on
Supplying your own equipment into a Philippine outsourcing arrangement gives you exactly what the previous section lacks: your specification, your build, your management tooling, your evidence. It also gives you five problems the provider was absorbing.
Getting the machines there
Either a local purchase, which is clean, or an import, which brings a customs declaration, 12 per cent VAT assessed on a base that includes your freight, and a lead time measured in weeks.
Replacing failures
Your machine, your problem, in a market where you have no stock. Either you hold a buffer locally, which means somewhere to hold it, or somebody is not working for several weeks.
Supporting them
The provider’s technicians support the provider’s build. A different build with different tooling is frequently outside what their support covers, which has to be agreed rather than assumed.
Tracking them
Devices in somebody else’s facility, held by people who are not your employees, with turnover you do not control. Your asset register now depends on a third party telling you about changes they have no particular reason to report promptly.
Getting them back
At the end of the engagement, from a provider who is no longer being paid by you, possibly in a relationship that ended badly. More on this below.
Client-supplied is the right answer when your security or specification requirements genuinely cannot be met otherwise. It is the wrong answer when it was chosen because it felt more controlled, without anybody pricing the five items above.
Home-based or facility-based, and why it changes everything
Philippine outsourcing used to mean a building. A large share of it no longer does, and the equipment consequences of that shift are larger than the commercial ones.
Facility-based
means the provider’s premises. Devices live there, are physically secured there, are supported by technicians on site, and are frequently shared across shifts. Replacement is fast because stock is in the same building. Physical security is somebody’s job. The machine does not leave, which removes an entire class of problem.
Home-based
means the device is in somebody’s house, across a country of more than seven thousand islands. Nothing about the device is physically controlled. Replacement means a courier. Recovery means a courier and a cooperative former worker. Connectivity is whatever the person has. And the machine is in a household rather than a controlled space, which matters for both physical security and for who else can see the screen.
Most arrangements now are hybrid, which is the hardest version to specify because the answer differs per person and changes over time. A seat rate quoted on a facility assumption and delivered home-based is not the same service, and the difference lands mostly on equipment: replacement times stretch, recovery becomes a real risk, and shared-device practices that were fine in a building stop being appropriate in a house.
The question to ask explicitly is what proportion of the team is home-based today, what it is expected to be, and how the replacement and recovery commitments differ between the two. Providers answer this readily. It is just rarely asked, because the proposal describes a service rather than a location.
The cost comparison nobody actually runs
The choice between provider-supplied and client-supplied usually gets made on instinct, which favours whichever one the person deciding is more worried about. It is worth doing the arithmetic, because the result is frequently counterintuitive.
Take a hypothetical team of twelve, on a three year engagement. The figures below are illustrative placeholders for your own numbers rather than quoted market rates, and the only verified figure in them is the Philippine VAT rate of 12 per cent.
Client-supplied, imported
Twelve machines at whatever your corporate rate is, plus freight, plus 12 per cent VAT assessed on the goods and the freight together. Then two spare machines so a failure is not a three week outage, which is fourteen devices bought to equip twelve people. Then the recovery cost at the end, for twelve machines from wherever those people are by then. Then somebody’s time maintaining the register across three years of turnover.
Client-supplied, bought locally
The same twelve plus two, with no freight, no VAT at a border and no customs delay, at Philippine retail or corporate pricing. This is almost always cheaper than importing and it is the option most often skipped, because the instinct when supplying your own equipment is to supply it from where you already buy.
Provider-supplied
Embedded in the seat rate, so it looks like nothing. The real comparison is the uplift a provider would charge for a higher specification and a stated refresh cycle, against the total above. That uplift is usually modest, because they are buying locally at volume and replacing from stock they already hold.
Run with real numbers, provider supply with a specified minimum specification frequently wins on cost and almost always wins on replacement speed. Client supply wins where you need control you cannot otherwise get. Importing your own machines into the Philippines wins in very few scenarios, and it is the one people reach for first.
Who owns the hardware is a separate question from who controls the data
These two get conflated constantly and they have different answers and different consequences.
Hardware ownership
decides whose balance sheet the asset sits on, who depreciates it, who replaces it when it fails, and critically who can require its return. It is a property question.
Data control
decides what can be stored on the device, who may access it, what happens when somebody leaves, and what evidence of deletion you receive. It is an information question and it does not follow ownership automatically.
You can own a device that a provider’s technician administers. A provider can own a device on which your data may not be stored locally at all. Both are coherent designs. The failure is assuming that settling one settles the other, which is how companies end up owning hardware they have no visibility into, or having strong data terms on machines they cannot get back.
The practical version of this is three questions asked separately. Who buys and owns it. Who administers it and holds the management enrolment. And what may be stored on it locally, versus what must stay in your systems. The third question is frequently the most useful, because a device on which nothing is stored locally is a much smaller problem at exit than one that has accumulated two years of files.
What a seat price actually includes
Seat-based pricing is the norm, and a seat almost always includes a device. What it rarely specifies is which device, how old, and what happens to it.
Five things worth pinning down in the commercial conversation, none of which is unusual to ask.
Specification
A stated minimum, in writing, matched to the work. Not a model number, which will change, but memory, storage and processor class. Development and data work routinely need more than a default seat assumes.
Age and refresh
Maximum age at assignment, and a refresh cycle. Without this, long engagements accumulate old machines, because there is no moment at which anybody is obliged to replace a working one.
Failure replacement
The time to replace a dead machine, and whether a spare is held locally. This is the single most useful service level in the whole equipment conversation and it is almost never in the contract.
Peripherals
Monitor, headset, chair where relevant. Cheap, easy to forget, and a recurring source of friction because everybody assumed it was included.
Connectivity
In home-based arrangements, who provides and pays for internet, and what the minimum is. Philippine home connectivity varies considerably and a seat rate that assumes office connectivity does not transfer cleanly to a home-based model.
None of these is expensive to agree before signing. All of them are awkward to raise eighteen months in, when the answer has become whatever has been happening.
The security gap between your policy and their standard
Providers run a security baseline. It is usually reasonable and it is built for their client base in general rather than for you in particular. The gap between that baseline and your policy is yours to find, because they have no way to know your policy unless you give it to them.
The items that most often differ are specific. Whether full disk encryption is enforced rather than available. Whether local administrator rights are granted to the worker. Whether removable storage is permitted. Whether personal accounts can be signed into on the device. Whether the machine is shared across shifts, which is common in facility-based operations and has obvious consequences for attributing activity. And what happens to local data when a person rotates off your account onto a different client’s.
That last one deserves attention because it is specific to outsourcing and has no equivalent in direct employment. A technician who worked on your account last month is working on somebody else’s this month, frequently on the same machine. Whatever was stored locally is still there unless something removed it. Ask what that something is.
The useful approach is not to send a policy document and ask for compliance. It is to list the five or six controls you actually need evidenced, ask how each is currently handled, and negotiate only the gaps. A provider can usually accommodate specific controls. They cannot usefully respond to forty pages written for your own staff.
Shared devices and shift work
Round the clock coverage is one of the main reasons companies come to this market, and the equipment pattern that supports it gets very little scrutiny.
In facility-based operations, a workstation covering three shifts is often used by three people. That is efficient and it is normal, and it has two consequences worth thinking about before somebody asks you about them.
Attribution
If three people use one machine, activity on that device cannot be attributed to a person by the device alone. It has to come from the account, which means per-person accounts with no sharing, enforced rather than encouraged. Shared accounts on shared machines is the combination that makes an incident genuinely difficult to investigate, and it is more common than anyone admits.
Local data
Anything saved locally by the morning shift is available to the evening shift, including people who may work on a different client’s account. The structural answer is to prevent local storage rather than to clear it between shifts, because a clearing process depends on somebody running it.
This is not an argument against shared devices. For many operations they are the right design and the alternative costs more for no security gain. It is an argument for knowing which model you are buying, since a seat rate quoted against a shared workstation and a seat rate quoted against a dedicated one are different products that look identical on a proposal.
The question is one sentence: is the device dedicated to a named person or shared across shifts, and if shared, how is activity attributed and what prevents local storage persisting between them.
When the engagement ends
Exit is where it outsourcing philippines arrangements are tested on equipment, and most contracts describe only the easiest part of it.
Three things have to come apart and they are usually treated as one. Access has to stop, which means accounts disabled across your systems on a known date. Data has to be dealt with, which means whatever is stored locally on provider devices is removed and you receive something that says so. And hardware has to go somewhere, which only matters where you own it.
Where the provider owns the devices, hardware is simple and data is the whole question. You will not get the machines, nor should you expect to, and what you need instead is per-device evidence that your data was removed. Agree the form of that evidence at the start, because asking afterwards means asking a company you no longer pay to produce records about machines they still own.
Where you own the devices, you need them back, from a facility you do not control, during a wind-down. The cheap control is a device list reconciled quarterly during the engagement rather than constructed at the end. Reconciling fifty machines during an exit, against a list nobody maintained, is where the real losses happen.
The worst version is an engagement that ends badly. Commercial disputes and device recovery do not combine well, and a device that is also the only copy of something is a negotiating position rather than an asset. Keeping local storage minimal throughout removes that problem entirely, which is a good reason to settle the storage question early.
Build, operate, transfer has a device transfer inside it
In this model the provider recruits, equips and runs a team, and at an agreed point the team becomes yours. The commercial attention goes to the people and the timing. The devices move too, and almost nobody prices that.
Several questions arrive at once at the transfer point. Do the machines transfer, and at what value, since they are second hand by then and a book value agreed three years earlier may bear no relation to what they are worth. Are they re-imaged and re-enrolled into your tooling, which is a project rather than a step, and who does it. What is their remaining useful life, since transferring a fleet that is two thirds through its life means a refresh cost arriving immediately after a transfer cost. And what happens to anything stored locally during the provider era.
There is a timing trap as well. A transfer typically happens over weeks, and during those weeks some machines are enrolled in the provider’s tooling and some in yours. Deciding in advance which systems the half-transferred devices may reach avoids a period where nobody is quite sure what is managed by whom.
The cheap fix is to treat devices as a named workstream in the transfer plan with its own owner, rather than a line in an asset schedule. A fleet refresh costed and scheduled at the point of transfer is frequently cheaper and cleaner than inheriting ageing machines, and knowing that in advance turns it into a decision rather than a surprise.
The decision table
| Situation | Scale | Setup | Primary Pain | Recommended Starting Point |
|---|---|---|---|---|
| Business process outsourcing | Any | Outcome purchased | None, usually | Provider devices. Specify data handling, not hardware. |
| Staff augmentation in your systems | 5 to 30 | People work in your stack | Equipment ambiguous | Decide provider or client supply explicitly, then write it down |
| Managed service, strict security | Any | Provider devices, your policy | Cannot evidence controls | List the five controls you need evidenced, negotiate only gaps |
| Heavy workloads, developer tooling | Any | Standard seat machines | Specification too thin | Written minimum specification in the commercial terms |
| Build, operate, transfer | 20 plus | Transfer planned | Device transfer unpriced | Devices as a named workstream, costed refresh as the alternative |
| Engagement winding down | Any | Mixed ownership, no list | Nobody knows what is where | Reconcile quarterly during, not at the end |
| Client-owned devices on site | 10 plus | You shipped or bought locally | Failures and tracking | Local buffer stock and a quarterly reconciliation |
Red flags in a proposal
Five things in an outsourcing proposal that are worth a follow-up question rather than an assumption.
Equipment is not mentioned at all
The most common case and the easiest to fix. It does not mean anything sinister. It means nobody asked.
“Fully equipped workstations” with no specification
True and uninformative. Ask what a workstation is, in memory and storage, and what the maximum age at assignment is.
A security annex that restates a standard without naming controls
Certification is useful and it is not the same as telling you whether local administrator rights are granted on the machine your data sits on.
No stated replacement time for a failed device
This is the service level that most affects whether people can work, and its absence usually means best effort.
Exit terms covering access but not devices or data
Very common. Access termination is the easy third of the problem and the one everybody remembers.
None of these is a reason to walk away. Each is a reason to ask one question, and the quality of the answer tells you a great deal about how the engagement will run.
A short checklist before signing
Eight lines. They are not legal terms and this is not a template, just the operational facts somebody will need later.
Who supplies the devices. Who owns them. The minimum specification and the maximum age at assignment. The replacement time for a failure and whether local spares exist. Whose management tooling the device is enrolled in. What may be stored locally. What happens when a worker rotates to another client. And what you receive at exit, for devices and for data separately.
Then one test, which is worth more than the list. Ask the provider to walk through a single real scenario end to end: an engineer’s laptop fails on a Tuesday, what happens, in what order, by when, and who pays. The answer tells you whether there is a process or an intention.
A provider who answers that quickly and specifically has a process. One who describes a policy does not.
Ask the same for a leaver. Somebody rotates off the account on Friday. What happens to the device, to the local data, to the accounts, and what do you receive. Providers who have done this well will answer quickly and specifically. Providers who have not will describe a policy. That difference tells you more about how the next three years will go than any part of the commercial proposal does, and it costs one question to find out.
What this costs when nobody settles it
The visible cost in it outsourcing philippines engagements is the underspecified machine, where twelve engineers each lose some portion of their day to a device sized for lighter work. It is real, it compounds quietly, and it is almost never attributed to the equipment because nobody is measuring it.
The larger cost is the evidence gap. An outsourcing arrangement means your data is on devices you do not control, and at some point somebody will ask you to describe the controls. Being unable to answer independently, and having to relay a provider’s assurance instead, is a materially weaker position in a customer security review than producing your own records.
The largest is the exit nobody designed. Devices unaccounted for, local data of unknown extent, and no agreed mechanism for either, at precisely the moment the commercial relationship has least goodwill in it. This is the one that occasionally becomes a genuine incident rather than an inconvenience.
The common factor is that all three are decided at contract stage by whether a few specific questions were asked, and none of them is expensive to prevent at that point. After signing, every one of them becomes a renegotiation.
Which is the useful way to think about the whole subject. Equipment in an outsourcing arrangement is not a hard problem and it is not a large cost. It is simply a set of decisions that defaults to nobody if neither side raises it, and defaults tend to be discovered rather than chosen. Half an hour of questions before signature replaces every one of them with something somebody actually decided.
HROpsLab publishes independent comparison work across HR and IT tooling. We sell nothing, we take no vendor money, and we publish no paid placements. Where a vendor publishes no price, we say so rather than estimating, and where a product is our own we state that too.
Frequently asked questions
Who provides laptops in an it outsourcing philippines arrangement?
Usually the provider, and in most cases that is the right answer, because they buy locally, hold replacement stock and can swap a failed machine the same day from a shelf in Manila rather than shipping one for three weeks. What provider supply does not automatically include is your specification, your management tooling, a refresh commitment or independently verifiable evidence of encryption, so those are the items to specify in the commercial terms if they matter to you.
Who owns the devices in an outsourcing engagement?
Whoever the agreement says, which is why the absence of a clause is the problem rather than any particular answer. Ownership decides whose balance sheet the asset sits on, who replaces failures and who can require return at the end. It is a separate question from who controls the data, since you can own a device a provider administers or have strong data terms on a device you will never see, and assuming that settling one settles the other is the most common error here.
Should we supply our own laptops to an outsourcing provider?
Only where your specification or security requirements genuinely cannot be met otherwise, because supplying your own means taking on five things the provider was absorbing: getting machines into the country, replacing failures with no local stock, supporting a build their technicians do not know, tracking assets in a facility you do not control, and recovering them at exit from a company you no longer pay. Each is manageable and none is free, so the decision should be priced rather than assumed.
What should an outsourcing contract say about equipment?
At minimum: who supplies, who owns, the minimum specification, the maximum age at assignment, the replacement time for a failed device, whose management tooling it is enrolled in, what may be stored locally, and what you receive at exit for devices and data separately. None of those is unusual to ask for before signing, and all of them become a renegotiation afterwards. This is a list of operational facts rather than legal drafting, so take local advice on the terms themselves.
What happens to our data when a worker moves to another client?
This is specific to outsourcing and has no equivalent in direct employment, so it is worth asking directly: a technician on your account this month may be on somebody else’s next month, frequently on the same machine, and whatever was stored locally remains there unless some process removed it. Ask what that process is and what you receive confirming it. The cleanest structural answer is to keep local storage minimal throughout so there is little to remove.
How do we get our laptops back when the engagement ends?
By maintaining a reconciled device list quarterly during the engagement rather than constructing one at the end, because recovering fifty machines from a facility you do not control, during a wind-down, against a list nobody maintained, is where the losses actually happen. Agree the return mechanism, who pays for it and the timetable at contract stage, and keep in mind that an engagement ending in a commercial dispute is the worst possible moment to be negotiating the return of hardware.
Does a seat price include a laptop?
Almost always yes, and almost never with any detail attached, which is the gap worth closing. A seat rate typically assumes a device without stating its memory, storage or processor class, its maximum age when assigned to you, how quickly a failure is replaced, whether peripherals such as a monitor and headset are included, or who provides and pays for connectivity in home-based arrangements. All five are cheap to agree before signing and awkward to raise two years in.
What about devices in a build, operate, transfer arrangement?
They transfer with the team and almost nobody prices that at the start, which is why it becomes a surprise. Four questions arrive together: at what value do second-hand machines move, who re-images and re-enrols them into your tooling, how much useful life remains, and what happens to data stored locally during the provider era. A costed fleet refresh scheduled at the transfer point is frequently cheaper and cleaner than inheriting ageing hardware, and knowing that in advance makes it a decision instead of a shock.
