Can an MSP use offshore techs? Start with the client contract

What actually restricts an MSP, and what only sounds like it does

Some environments are effectively closed to anyone outside the US. Client environments holding export-controlled defense data are one clear example, criminal justice systems are another, and Dokimo will not place anyone on either. If you serve a client like that, the work stays with US staff. If a defense client hasn't told you whether its data is export-controlled, ask its compliance or security officer, and keep the environment US-only until you have the answer.

Almost everything else is a contract or insurance term, and those vary. A managed services agreement can limit who you may subcontract to. A client's security review can ask where your staff sit. A health-data agreement can pass its terms down to anyone who touches the environment. A client's own insurance can ask about vendor access. Financial-services clients may add vendor-oversight terms of their own, and their regulators can ask where a provider's staff sit. None of that is one rule you can look up, because it's whatever your paperwork with that particular client says.

So the decision sits with you. Dokimo doesn't decide which of your clients a remote tech can touch, doesn't tell you an environment is fine, and doesn't speak to your clients for you. Your counsel reads the agreements, you draw the line, and Dokimo fits the seat to what you decide. The order matters here, because a seat set up before the client list is sorted ends up resting on a guess, and a guess is exactly what a client or an insurer will later ask you to defend.

HIPAA, health data and the cyber insurance application

HIPAA on its own does not ban work from outside the US, and it's a mistake to treat it as though it does. It's also a mistake to stop reading there. An MSP with access to health data has agreements and a risk analysis to think about, and that covers anyone the MSP brings in to work on those systems. Many clients' agreements go further than HIPAA itself, and some restrict where staff sit. Some government health programs and some states add their own limits on where patient data may be handled, so a medical client that bills those programs needs a closer look. Read the business associate agreement for each health client before you assign anyone to it, and settle which terms Dokimo and its employer of record (EOR) partner have to sign, since they may count as outside parties on a health client's work.

A cyber insurance application is the other place a guess gets expensive. Applications can ask who has access to your systems and how their access is controlled: MFA, vaulted credentials, logging and privileged access. Some policies also limit territory. A wrong answer, given from memory or from what you hoped was true, can put a claim at risk when you need it most. Only your carrier can tell you what your policy allows, so ask your broker in writing and answer from facts you can show. That goes for your own cyber and E&O renewals too, not only your clients' policies, so tell your broker before the seat starts.

How MSPs set it up: tenant by tenant, cleared clients first

The security risk of an offshore help desk is largely a question of access design, and you control that. Access should run through your own tools: a named account for every remote tech (never a shared login), MFA on every sign-in, credentials held in your vault, not in a chat, a browser or a spreadsheet, and session logging you can review. To keep the work off a personal machine, Dokimo offers one optional add-on, priced separately: a secure remote workstation, meaning a US-hosted virtual desktop, centrally revocable access, disclosed productivity and activity monitoring, and managed endpoint security.

Then check the client side. A client whose Conditional Access policies block sign-ins from outside the US, or require a compliant device the tech's laptop can't be, will lock the tech out, so find that out before the seat starts, not on day one. The workable way to set it up is tenant by tenant: sort your clients into cleared, US-only and not sure yet, and start the new seat on cleared clients you've already reviewed, on work that suits it, like Tier 1 and Tier 2 tickets, alert triage and documentation. Then enforce the list in your tools instead of a memo: limit the remote tech's RMM sites, PSA companies and queues, remote-control groups and documentation organizations to cleared clients, so a US-only client can't be opened by accident. Regulated clients get a US-only pod or stay with US staff.

What you tell your own clients is set by your agreements with them, so read them. Look at the subcontracting clauses, any term about where staff are located, the answers you gave on security reviews and any health-data terms. Where the paper says something must be disclosed or approved, do that. Also write the answer you would give if a client asked tomorrow: who works on their environment, from which country, under whose contract and with what access. Don't plan around keeping it quiet: an agreement or an answer that no longer matches your staffing is the exposure. Nothing here is legal advice, and your agreements and your counsel decide.

Where Dokimo fits, and where it doesn't

Dokimo fits once you've done that sorting and have clients cleared for it. The seat follows your answer: which tenants, which tools, which hours. The remote tech is dedicated to your account and works through a named account under your managers. Dokimo's EOR partner employs them in their country and pays them through local payroll, while Dokimo sends you one monthly invoice. The client relationship stays yours. The hours and the tenants the seat covers are yours to set, and anything outside them is off limits to the seat.

It doesn't fit environments with export-controlled defense data or criminal justice systems, where Dokimo won't place anyone. It doesn't fit clients you keep US-only for any reason, or work that needs hands on site. It doesn't fit an MSP that wants Dokimo to say whether a client is cleared, because the answer lives in your agreements. Dokimo also won't hand out compliance badges for individual technicians, and you should be wary of any firm that does: those labels belong to organizations and systems, not to a person at a desk.

If you have your cleared list, the next step is to tell us which seat, which tenants and which hours, and which work stays with your US staff. If you don't have the list yet, build it first, and bring your counsel in on the clients you're unsure about. The page on staffing for MSPs covers the seats, the cost and the free replacement once you're ready to add one.