Trust Center sectionsSecurity practices
Security architecture
Security practices
Zero trust, everywhere
Every person and service is authenticated and authorized for each request. The same controls cover all 1,250 people who touch our code or data, whoever pays them.
Keys we can’t casually use
Client data is encrypted with keys our staff cannot access without explicit, time-bound authorization. For managed platforms, we can hold encryption keys so the platform vendor cannot.
Secure by construction
Static and dynamic security testing gate every release. A software bill of materials is maintained for every product, and vulnerable or restrictively licensed components are blocked from the build.
Managed endpoints
Every laptop and phone used for Moraph work is encrypted and centrally managed, from New York to Manila.
Cleared support lane
Tickets from Federal and Defense clients are routed only to US citizens with active security clearances. No foreign national sees sensitive government logs.
Fourth-party risk
We continuously monitor the security posture of our own sub-processors and trigger reviews automatically when a score drops.
Have a question about this?
Ask Moraph’s Security team. Customers can also ask their Moraph contact.