Trust Center
Security, sovereignty and audit evidence, built in from the start
Our clients answer to examiners, inspectors general and data protection authorities. Everything we build and operate is designed so they can prove control, not just claim it.
- 99.99%
- Premium SLA tier (99.9% standard)
- 1 hr / 15 min
- Tier 1 recovery time / recovery point objectives
- 24/7/365
- Follow-the-sun security and operations coverage
- 3
- Sovereign regions: United States, United Kingdom, Australia
What’s audited, and what’s mapped
We keep two things apart: what independent auditors have examined, and the frameworks we map our controls to. Mapping a control to a framework is not a certification or an authorization.
Independently audited
- SOC 2 Type IIReport available to approved reviewers
- ISO/IEC 27001Report available to approved reviewers
Reports and certificates are shared with approved reviewers, under NDA where required.
Frameworks our controls are mapped to
- FedRAMP High
- DoD IL5 / IL6
- HIPAA (HITRUST CSF)
- CJIS Security Policy
- GLBA / FFIEC
- SEC 17a-4 / FINRA
- SR 11-7
- GDPR / UK GDPR
- DORA
- APRA CPS 234
Moraph does not hold a certification or authorization for any framework in this list; where a client needs its own authorization or examination, we provide the control mapping and evidence to support it.
How we protect client data
Each area explains our practice in plain words and lists the evidence behind it.
Security practices
Zero trust, keys staff can’t casually use, security testing on every release, managed endpoints.
Security practicesData residency
Three sovereign regions: the United States, the United Kingdom and Australia.
Data residencyPrivacy
We monetize software, not data. Policies and the subprocessor list.
PrivacyResilience
Follow-the-sun operations, a crisis protocol and recovery objectives.
ResilienceService commitments
The service tiers we publish. Your agreement sets your own commitments.
Service commitmentsResponsible AI
Human in the loop, fair and validated models.
Responsible AISubprocessors
Who processes data on our behalf, with a change log you can subscribe to.
SubprocessorsReport a vulnerability
Email security@moraph.com. We will not pursue good-faith research.
Disclosure policyEvidence
Request our security evidence
Audit reports, penetration-test summaries, policies, data-flow diagrams and completed questionnaires (SIG, CAIQ, HECVAT) are shared with approved reviewers, under NDA where required.
- Create a reviewer account
- Tell us what you need and why
- Accept the confidentiality terms
- Moraph’s Security team reviews it
- Read the approved documents in your reviewer room until access ends
Latest updates
Changes to our assurance, subprocessors and policies.
No updates published yet
When Moraph renews an audit, changes a subprocessor or updates a policy, it is recorded here with the date.
Have a question about this?
Ask Moraph’s Security team. Customers can also ask their Moraph contact.