Security reviews
Reviewing Moraph’s security
This page is for the security, vendor-risk and procurement teams who review Moraph before or during a purchase. It lists the evidence and questionnaires you can ask for, how to ask for them, and what Moraph does not hold.
Evidence
What you can request
Security evidence is shared through the Moraph Trust Center. Audit reports, penetration-test summaries, policies, data-flow diagrams and completed questionnaires are shared with approved reviewers, under NDA where required.
| Item | What it is | How Moraph provides it |
|---|---|---|
| SOC 2 Type II report | An independent auditor’s report on a service organization’s controls over a period of time, under the AICPA’s SOC framework. | Moraph’s report covers its security, availability and confidentiality controls. The systems in scope are set out in the report, which is shared under NDA. |
| ISO/IEC 27001 certificate | Certification of an information security management system against the ISO/IEC 27001 standard. The scope statement says which parts of the organization it covers. | Moraph holds a certified information security management system. The certificate and its scope statement are in the evidence pack. |
| Penetration-test summary | A summary of a test in which testers try to break into a system as an attacker would, and what they found. | Shared with approved reviewers through the Trust Center. |
| Completed questionnaires | Standard security questionnaires (SIG, CAIQ, HECVAT) or your own. | Requested through the Trust Center and completed by Moraph. See Questionnaires. |
| Policies and data-flow diagrams | Security policies, and diagrams of how data moves through a service. | Shared with approved reviewers through the Trust Center. |
| Hosting facility certifications | The certifications held by the colocation facilities in the United States, the United Kingdom and Australia where client workloads that must stay in-country run. | Available to reviewers with the evidence pack, with what each certificate covers. |
| Subprocessors | The companies that process data on Moraph’s behalf. | Public: listed on the subprocessors page with a change log, and you can subscribe to changes. |
| Accessibility conformance report (ACR / VPAT®) | A report on how a product conforms to accessibility standards, on the ITI VPAT® template. | Requested from the buyer team, not the Trust Center. See Accessibility reports. |
The document library lists each document with its version, the period it covers and its review status. Public documents download straight away; confidential ones are listed so you can see what exists, and approved reviewers read them in their reviewer room.
Questionnaires
Standard questionnaires, or your own
When you request access in the Trust Center you can ask Moraph to complete a standard questionnaire, or upload your own, and follow its progress in your reviewer room.
| Questionnaire | Published by | What it is | Versions you can choose |
|---|---|---|---|
| SIG (Standardized Information Gathering) | Shared Assessments | A questionnaire for assessing a third party’s cybersecurity, IT, privacy and data-security risks. | SIG Lite, SIG Core |
| CAIQ (Consensus Assessments Initiative Questionnaire) | Cloud Security Alliance | Questions about a cloud provider’s controls, aligned to the CSA Cloud Controls Matrix. | CAIQ |
| HECVAT (Higher Education Community Vendor Assessment Toolkit) | EDUCAUSE | A questionnaire colleges and universities use to assess the security of vendors and their services. | HECVAT Lite, HECVAT Full |
| Your own questionnaire | Your organization | Your own vendor-risk or procurement questions. | Upload it as Excel, Word, PDF or CSV, up to 20 MB. |
With each questionnaire you can give a date you need it by, and notes such as the version of the questionnaire, the product or service in scope, or the sections to focus on. A request can include up to five questionnaires; if you need more, ask the Security team in your request.
Plainly stated
What Moraph does not hold
The Trust Center keeps two things apart: what independent auditors have examined, and the frameworks Moraph maps its controls to. The independently audited items are SOC 2 Type II and ISO/IEC 27001.
Mapping a control to a framework is not a certification or an authorization. Moraph does not hold a certification or authorization for any of the mapped frameworks, which include FedRAMP High, DoD IL5 / IL6, HIPAA (HITRUST CSF), the CJIS Security Policy, GLBA / FFIEC, SEC 17a-4 / FINRA, SR 11-7, GDPR / UK GDPR, DORA and APRA CPS 234. Where a client needs its own authorization or examination, Moraph provides the control mapping and evidence to support it.
The full list, with what each item covers, is on Assurance and certifications.
The reviewer process
How a review runs in the Trust Center
Customers, prospective customers, auditors, regulators and partners can request Moraph’s confidential security materials.
Create a reviewer account
Use your work email at trust.moraph.com. If you already have one, sign in.
Tell us what you need
Your organization and role, your relationship with Moraph, why you need the materials, the documents or categories, any questionnaire, and any deadline.
Accept the confidentiality terms
Most documents are shared under confidentiality terms you accept online, or under an NDA your organization has already signed with Moraph.
Security team review
Moraph’s Security team reviews the request and may ask you a question in it. You get an email when there’s news.
Your reviewer room
Approved documents are available there until the access end date Moraph sets.
Good to know before you start
- Confidential documents open only with two-step verification on your reviewer account, set up with an authenticator app.
- Each download is recorded, and the file name carries your name.
- A request can be approved in full or in part, or declined with the reason given. When access ends, you can ask for it again.
- Questions about Moraph’s security, assurance, data residency or privacy that are not a document request go to the Security team through Ask a question. Already a customer? Your Moraph contact can also answer security questions.
- To report a vulnerability, email security@moraph.com; see the disclosure policy.
Accessibility
Accessibility conformance reports
Accessibility conformance reports are requested from the team for your sector, not through the Trust Center. Moraph prepares them on the ITI VPAT® template, in the edition your rules call for: Section 508, EN 301 549, WCAG, or the international edition that covers all three.
A report describes one product at one version, so name the product and version you are evaluating. For managed platforms such as Microsoft 365 or ServiceNow, the platform vendor publishes its own reports. How to buy has the details.
Questions
Frequently asked questions
Do I need to sign an NDA first?
Most documents are shared under confidentiality terms you accept online in the Trust Center. If your organization has already signed an NDA with Moraph, documents can be shared under that instead. Documents marked public need neither.
Can you complete our own questionnaire instead of a standard one?
Yes. Choose “Your own questionnaire” when you request access and upload it as an Excel, Word, PDF or CSV file of up to 20 MB.
Is Moraph FedRAMP authorized or HITRUST certified?
No. Moraph maps its controls to FedRAMP High and to the HITRUST CSF, among other frameworks, but holds no certification or authorization for them. See What Moraph does not hold.
We are a prime contractor or contracting officer. Where do we start?
Contracting officers and primes can ask through the procurement request form for the evidence Moraph can share before an award: the Trust Center evidence pack, accessibility conformance reports, and information on the staff who would work on the requirement. Reviewers can also request the evidence pack directly in the Trust Center.