Skip to content
Sign inRequest access
Trust Center sectionsAssurance and certifications

Assurance

Assurance and certifications

What independent auditors have examined, with the period, scope and limitations of each, and the frameworks our controls are mapped to.
Two different things

We keep two things apart: what independent auditors have examined, and the frameworks we map our controls to. Mapping a control to a framework is not a certification or an authorization. New to an acronym? Our glossary explains each one.

Independently audited

SOC 2 Type II

Report available to approved reviewers

Independent auditor’s report on our security, availability and confidentiality controls. Systems in scope are set out in the report, shared under NDA.

The assessor, period and full scope are stated in the report or certificate itself, which approved reviewers can read.

ISO/IEC 27001

Report available to approved reviewers

Certified information security management system. The certificate and its scope statement are included in our evidence pack.

The assessor, period and full scope are stated in the report or certificate itself, which approved reviewers can read.

Frameworks our controls are mapped to

These describe how we configure and operate client environments. Moraph does not hold a certification or authorization for any framework in this list; where a client needs its own authorization or examination, we provide the control mapping and evidence to support it.

  • FedRAMP HighMapped, not certified

    Managed landing zones and products configured against the FedRAMP High baseline (NIST SP 800-53).

  • DoD IL5 / IL6Mapped, not certified

    Administration practices designed for Impact Level 5 and 6 collaboration environments.

  • HIPAA (HITRUST CSF)Mapped, not certified

    BAA-backed environments for protected health information, with controls mapped to the HITRUST CSF.

  • CJIS Security PolicyMapped, not certified

    Microsoft 365 GCC configured to the FBI CJIS Security Policy for criminal justice data.

  • GLBA / FFIECMapped, not certified

    Authentication and data-protection controls aligned to GLBA and FFIEC guidance, with evidence prepared for bank examinations.

  • SEC 17a-4 / FINRAMapped, not certified

    WORM archiving and supervision configured for broker-dealer recordkeeping rules.

  • SR 11-7Mapped, not certified

    Champion/challenger validation for every production financial model, following Federal Reserve model-risk guidance.

  • GDPR / UK GDPRMapped, not certified

    Data residency and privacy engineering for UK and EU clients.

  • DORAMapped, not certified

    Operational resilience and exit planning to support EU financial entities’ DORA obligations.

  • APRA CPS 234Mapped, not certified

    Australian hosting and controls supporting APRA-regulated entities’ CPS 234 obligations.

Have a question about this?

Ask Moraph’s Security team. Customers can also ask their Moraph contact.

Ask a question