Financial Services · Managed platform (Salesforce FinServ Cloud)

CRM for Finance

Salesforce Financial Services Cloud, run for you, with encryption keys held outside Salesforce

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs Salesforce Financial Services Cloud for banks, credit unions, wealth managers and other financial firms. Sensitive client data is protected with Salesforce Shield Platform Encryption, and Moraph manages the key material in a key service outside Salesforce, so Salesforce does not store the keys that decrypt your data. Moraph also operates the org day to day: changes, releases, access, monitoring and support, under your approval.

The problem it solves

Financial firms want one view of each client relationship, but a CRM holding account numbers, tax identifiers, balances and financial plans is one of the most sensitive systems a firm runs. Security and risk teams ask who can read that data, who holds the encryption keys and what happens if the vendor is compelled or compromised. Meanwhile the CRM itself drifts: customizations pile up, permissions widen, releases arrive on the vendor's schedule, and the in-house admin team spends its time keeping up rather than improving it.

  • Sensitive client data sits in a vendor's cloud with keys the firm does not control
  • Permissions widen over time and nobody can say quickly who can see what
  • Vendor releases and customizations are tested late or not at all
  • Third-party risk reviews ask questions about key custody and access that are hard to answer

Who uses it

  • Heads of retail, commercial and wealth businesses who want one view of each relationship
  • CISOs and third-party risk teams who need to answer for where client data is and who can decrypt it
  • CRM and Salesforce administrators who need engineering and operations support
  • Compliance officers responsible for privacy, recordkeeping and access to nonpublic personal information
  • Internal audit and examiners reviewing controls over customer information

Requirements it supports

Gramm-Leach-Bliley Act and Regulation P (12 CFR Part 1016)Interagency Guidelines Establishing Information Security StandardsInteragency Guidance on Third-Party Relationships: Risk Management (2023)SEC Regulation S-P (17 CFR Part 248, Subpart A), for broker-dealers and investment advisersNYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.15 on encryptionFTC Safeguards Rule (16 CFR Part 314), for non-bank financial institutions

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Salesforce runs the platform and Shield, Moraph configures and operates your org and holds the key material, and your institution owns the data and the decisions.

AreaMoraphSalesforceYour organization
LicensingResells Financial Services Cloud and Shield licences, or works with licences you holdSets licence terms and the features each edition and add-on includesAgrees to Salesforce's terms and decides which products to license
Platform availabilityTracks Salesforce service notices and tells you when an incident affects youRuns, hosts and maintains the Salesforce platform under its own commitmentsPlans for how the business works if the CRM is unavailable
Encryption keysGenerates and holds key material in its key service and carries out approved key actionsProvides Shield Platform Encryption and the Cache-Only Key Service connectionApproves every key action and decides the rotation schedule
Key service availabilityRuns and monitors the key service Salesforce calls for key materialCalls the key service and caches key material as Shield is designed toAccepts the trade-off that encrypted data is unreadable if keys are unavailable
ConfigurationDesigns, builds and maintains the org configuration under change controlProvides the platform features and configuration optionsApproves the design and every change
Identity and accessMaintains profiles, permission sets and sharing rules and runs access review reportsEnforces the configured access at each requestDecides who should have access and confirms access reviews
MonitoringReviews event monitoring data where licensed and escalates what needs a decisionRecords login and event data according to the licensed featuresDecides on escalated events and runs your wider security monitoring
Incident responseTriages CRM and key service incidents and supports your investigationResponds to incidents in the Salesforce platform itselfLeads incident response and makes notification decisions
Releases and updatesTests seasonal releases in a preview sandbox and deploys approved changesReleases platform updates on its own scheduleSigns off user acceptance testing
User supportSecond-line support and liaison with Salesforce supportSupport to Moraph for platform defectsFirst-line support and training for your staff, unless you hand it to Moraph

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Salesforce FinServ Cloud itself, which belongs to its vendor.

  1. Step 1

    The onboarding tracker

    During implementation, each workstream shows what is done, what is waiting and who it is waiting on.

    WorkstreamOwnerWaiting onStatus
    Data classificationCompliance officerNoneComplete
    Key custody designKey custodianApproval of rotation scheduleAwaiting decision
    Relationship model in sandboxMoraph engineerNoneIn progress
    Core banking integrationMoraph engineerTest file from core teamBlocked
    Trial data load 2Moraph engineerReconciliation sign-offIn review
    During implementation, each workstream shows what is done, what is waiting and who it is waiting on.

  2. Step 2

    The encryption baseline

    What is encrypted, why, and what changes for users, reviewed with your security and compliance teams.

    Encryption baseline v2 · Example Savings Bank (fictional)

    Key model
    Cache-Only Key Service, Moraph-held
    Fields encrypted
    18
    File types encrypted
    Attachments and files
    Rotation schedule
    Set by key custodian
    Status
    Awaiting key custodian approval

    Effects to note

    • Tax identifier field no longer usable in list view filters
    • Two reports changed to filter on an unencrypted field
    • !One integration needs retesting after encryption is applied
    What is encrypted, why, and what changes for users, reviewed with your security and compliance teams.

  3. Step 3

    A key rotation

    Every key action has a request, your approval and two Moraph operators, all recorded.

    KA-0219 · Scheduled key rotation

    1. Rotation due under the approved scheduleKey service
    2. Rotation requestedMoraph key operator
    3. Rotation approvedKey custodian
    4. New key material generated under dual controlTwo Moraph key operators
    5. Salesforce confirmed using the new key versionMoraph key operator
    6. Action recorded and evidence attachedMoraph key operator
    Every key action has a request, your approval and two Moraph operators, all recorded.

  4. Step 4

    A change request

    Your CRM owner approves, Moraph builds and tests in a sandbox, and the release is recorded.

    CR-2207 · Add beneficiary details to financial accounts

    Requested by
    Wealth operations
    Approver
    CRM owner
    Sensitive data
    Yes, compliance sign-off required
    Encrypted
    Proposed for 2 new fields
    Release
    Next scheduled release

    Steps

    • Build in development sandbox
    • Compliance review of new fields
    • User acceptance test by wealth operations
    • Deploy and record
    Your CRM owner approves, Moraph builds and tests in a sandbox, and the release is recorded.

  5. Step 5

    Alert triage

    Where Event Monitoring is licensed, unusual activity is reviewed and escalated with a recommendation for your decision.

    EventUserWhat was seenRecommendationStatus
    EV-7710User 21844Large report export including encrypted fieldsConfirm business reason with managerAwaiting your decision
    EV-7702User 30517Login from new countryConfirmed travel; no actionClosed
    EV-7695Integration userAPI calls outside usual hoursCheck scheduled job changeIn review
    Where Event Monitoring is licensed, unusual activity is reviewed and escalated with a recommendation for your decision.

  6. Step 6

    The monthly service review

    Moraph and your team review changes, releases, key actions and open risks.

    Service review · Sample month

    Changes deployed
    9, all approved
    Key actions
    1 rotation
    Key service failed requests
    0
    Escalated events
    2
    Permission review
    Overdue for one business line

    Actions agreed

    • Complete the overdue permission review
    • Test the coming Salesforce release in the preview sandbox
    • Decide on encrypting two additional fields
    Moraph and your team review changes, releases, key actions and open risks.

Workflows

The principal workflows

  1. Design

    Moraph works with your business, security and compliance teams to decide what data the CRM holds, which fields and files are encrypted, how keys are held and who can see what.

    • Business processes and data sources mapped with each line of business
    • Sensitive fields and files classified with your security and compliance teams
    • Encryption scope and key custody model agreed and documented
    • Profiles, permission sets and sharing rules designed for each role
    • Design approved by your business owner and information security officer

  2. Build and migrate

    Moraph configures Financial Services Cloud, sets up Shield Platform Encryption with keys from Moraph's key service, and migrates data from your existing systems in tested loads.

    • Sandbox configured for households, financial accounts and relationship data
    • Key service connected and encryption policy applied to agreed fields and files
    • Integrations built to core, wealth and marketing systems
    • Data migrated in trial loads and reconciled with your team
    • User acceptance testing and sign-off before production go-live

  3. Operate

    Moraph runs the org day to day: change requests, user and permission changes, release testing, monitoring and second-line support, with every change approved by your named owner.

    • Change requests raised by your team and approved by the named owner
    • Changes built and tested in a sandbox, then deployed through a recorded release
    • Salesforce seasonal releases tested in a preview sandbox before they reach production
    • Login and data-access events reviewed where Event Monitoring is licensed
    • Support requests handled and platform issues raised with Salesforce

  4. Manage keys

    Moraph operates the key service, rotates key material on the schedule you approve, and handles requests to revoke or destroy keys under dual control, with each action recorded.

    • Key material generated in Moraph's key service, outside Salesforce
    • Rotation scheduled and approved by your key custodian
    • Key actions carried out by two Moraph key operators under dual control
    • Each key action logged with requester, approver and time
    • Key custody evidence provided for audits and third-party risk reviews

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Relationship manager or advisor

Relationship manager, financial advisor, banker, client service associate

Uses the CRM to manage client relationships, referrals and tasks.

Sees

  • Clients, households and financial accounts within their book or team, as sharing rules allow
  • Encrypted fields their permission set allows, shown in clear to them
  • Their tasks, referrals and action plans

Does

  • Records client interactions, notes and opportunities
  • Creates and works referrals
  • Completes action plan tasks for onboarding and reviews
  • Raises support requests

Cannot

  • See clients outside their sharing scope
  • Export reports containing encrypted fields unless their role allows it
  • Change configuration or permissions
Approvals
None in the CRM itself; business approvals follow your own procedures.
Notified about
Referrals and tasks assigned to them, and planned changes that affect how they work.

Client CRM owner

Head of CRM, business systems owner, Salesforce product owner

Owns the CRM for the business and decides what changes and in what order.

Sees

  • The change backlog, releases and their status
  • Adoption and data quality reports
  • Service reports and open risks

Does

  • Approves or rejects change requests
  • Sets priorities for the backlog
  • Signs off user acceptance testing for releases
  • Approves permission set and sharing changes with the security team
  • Attends the service review

Cannot

  • Approve key actions; that belongs to the key custodian
  • Approve a change they raised themselves where a second approver is named
Approvals
Approves changes and releases; permission changes affecting encrypted data also need the information security officer.
Notified about
Changes waiting for approval, releases ready for testing and Salesforce release dates.

Key custodian

Information security officer, head of cryptography, IT risk manager

Holds your institution's authority over the encryption keys Moraph manages.

Sees

  • The key inventory: which key material exists, its status and rotation history
  • The encryption scope: which fields and files are encrypted
  • The key action log

Does

  • Approves key generation, rotation, revocation and destruction
  • Sets the rotation schedule
  • Requests key custody evidence for audits
  • Decides with the CRM owner on changes to encryption scope

Cannot

  • Carry out key actions in the key service directly unless that is agreed as part of a client-held key model
  • Approve a key action they requested without a second approver
Approvals
Every key action needs their approval; destruction of key material needs a second named approver at your institution.
Notified about
Key actions requested, rotations due, and any failure of Salesforce to reach the key service.

Compliance officer

Compliance officer, privacy officer, chief compliance officer

Makes sure access to client information, retention and records meet your obligations.

Sees

  • Access reports and permission review results
  • Field history and event monitoring reports where licensed
  • Retention settings and the change history

Does

  • Reviews who can see nonpublic personal information
  • Sets retention requirements for field history and records
  • Requests evidence for examinations and audits
  • Raises concerns and changes through the CRM owner

Cannot

  • Change configuration or permissions directly
  • Approve key actions
Approvals
Consulted on changes that affect client data handling; their sign-off can be made a required step for those changes.
Notified about
Changes affecting sensitive data, escalated access events and completed access reviews.

Moraph Salesforce engineer

Moraph Salesforce engineer, Moraph CRM administrator

Builds, tests and deploys approved changes and provides second-line support.

Sees

  • Org configuration, metadata and sandboxes
  • Approved change requests and the release plan
  • Client data only where a support task needs it and your institution has authorized it

Does

  • Builds changes in sandboxes and deploys them through recorded releases
  • Tests Salesforce seasonal releases in a preview sandbox
  • Maintains profiles, permission sets and sharing rules under approved changes
  • Handles second-line support and raises platform issues with Salesforce
  • Prepares service and access reports

Cannot

  • Deploy to production without an approved change
  • Carry out key actions or access the key service
  • Grant themselves access to encrypted data
Approvals
Every production deployment needs the CRM owner's approval; access to client data for support needs your authorization, time-bound.
Notified about
Approved changes, support requests and Salesforce release and incident notices.

Moraph key operator

Moraph key management operator, Moraph security engineer

Runs the key service that supplies key material to Salesforce, and carries out approved key actions.

Sees

  • Key service health and Salesforce's requests for key material
  • Key metadata and the key action log
  • Approved key action requests

Does

  • Monitors the key service and its connection to Salesforce
  • Carries out approved key actions with a second operator
  • Records every key action with requester, approver and time
  • Prepares key custody evidence

Cannot

  • Act on keys without your key custodian's approval and a second operator
  • Sign in to the Salesforce org or read client data
  • Export key material in clear
Approvals
Every key action needs the key custodian's approval and a second Moraph operator.
Notified about
Key service alerts, approved key actions and rotations due.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Reviews controls over client data, keys and changes without being able to change anything.

Sees

  • Key custody evidence and the key action log
  • Access review results and change history
  • Evidence packs within the scope granted

Does

  • Reads evidence within their scope
  • Requests more evidence through your compliance officer or CRM owner

Cannot

  • Change anything or see client records unless your institution grants that separately
  • Keep access after it expires
Approvals
Their access is approved by your institution with a scope and an end date.
Notified about
Nothing by default.

Permissions at a glance

ActionAdvisorCRM ownerKey custodianComplianceMoraph eng.Moraph keysAuditor
Work client recordsOwn work onlyView onlyNo accessView onlyNo accessNo accessNo access
View encrypted fields in clearOwn work onlyView onlyNo accessView onlyNo accessNo accessNo access
Request a changeOwn work onlyFullFullFullNo accessNo accessNo access
Approve a change or releaseNo accessApprovesNo accessView onlyNo accessNo accessNo access
Deploy to productionNo accessApprovesNo accessNo accessFullNo accessNo access
Change permissions and sharingNo accessApprovesNo accessView onlyFullNo accessNo access
Change encryption scopeNo accessApprovesApprovesView onlyFullNo accessNo access
Approve a key actionNo accessNo accessApprovesNo accessNo accessNo accessNo access
Carry out a key actionNo accessNo accessApprovesNo accessNo accessFullNo access
View key action logNo accessNo accessView onlyView onlyNo accessView onlyView only
View change historyNo accessView onlyView onlyView onlyView onlyNo accessView only
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • Key operations and org administration are separated: Moraph's key operators cannot sign in to your Salesforce org, and Moraph's Salesforce engineers cannot reach the key service.
  • No key action happens without your key custodian's approval and two Moraph operators, and destroying key material needs a second approver at your institution.
  • Moraph engineers work in your org through named accounts with the permissions their tasks need. Access to client data for support is authorized by you, time-bound and recorded.
  • Roles, profiles and permission sets are designed with you during implementation and reviewed periodically; every change to them goes through change control and is recorded.

Features

What it does

Relationship view

Financial Services Cloud brings households, related people and businesses, financial accounts and goals into one view of each client.

Shield Platform Encryption

Salesforce Shield encrypts selected fields, files and attachments at rest, using key material supplied from outside Salesforce.

Keys held outside Salesforce

Using Salesforce's Cache-Only Key Service, key material stays in Moraph's key service; Salesforce fetches it when needed and holds it only in cache, not in storage.

Dual-control key operations

Generating, rotating, revoking or destroying key material needs two Moraph operators and your key custodian's approval, and every action is logged.

Least-privilege access model

Profiles, permission sets and sharing rules designed so each role sees the clients and fields it needs, with field-level security on sensitive data.

Event monitoring

Where Shield Event Monitoring is licensed, Moraph reviews logins, report exports and API access for patterns that need attention and escalates them to you.

Field history retention

Where Shield Field Audit Trail is licensed, changes to sensitive fields are kept for the retention period you set, for compliance and investigations.

Release management

Changes and Salesforce seasonal releases are tested in sandboxes and deployed through a recorded release process with your sign-off.

Referrals and action plans

Financial Services Cloud's referral and action plan features configured for how your teams pass leads and run onboarding and review tasks.

Managed change control

Every change, from a new field to a permission set, goes through a request, approval, sandbox test and recorded deployment.

Access reviews

Periodic reports of who holds which permissions and who can see encrypted data, for your managers and security team to confirm or remove.

Third-party risk evidence

A pack describing key custody, encryption scope, access controls and change history, for your vendor risk and audit teams.

Integrations

How it connects to your systems

Connects toHowWhat flows
Core bankingCustomer, account and balance data from your core system loaded on a schedule or through an integration layer, so relationship managers see current holdings.In: customers, accounts, balances and relationships.
Wealth and custody platformsHoldings, positions and account details from your wealth or custody platform for advisors' views of client assets.In: financial accounts, holdings and transactions.
Moraph key serviceSalesforce's Cache-Only Key Service calls Moraph's key service for key material over an authenticated connection.Out to Salesforce: key material on request. In: request logs.
Identity providerStaff sign in to Salesforce through your identity provider using SAML single sign-on, so your MFA and leaver process apply.In: user identity, with provisioning where configured.
Electronic signatureDocuments generated from the CRM sent for signature through a signing platform such as DocuSign, with the status returned to the record.Out: documents and signer details. In: envelope status and completed documents.
Marketing and communicationsConsent and preference data shared with your marketing platform, so campaigns respect what clients have agreed to.Out: contacts and consent. In: campaign responses.
Data warehouse and SIEMCRM data delivered to your data warehouse, and event monitoring data to your SIEM, where licensed.Out: CRM records and event logs.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Keys outside Salesforce

Key material for Shield Platform Encryption is generated and held in Moraph's key service, and Salesforce holds it only in cache.

Dual control and your approval

Moraph staff cannot use key material without your explicit, time-bound authorization and a second operator; every key action is logged.

Single sign-on

Staff sign in through your identity provider, so your password, MFA and leaver policies apply.

Role-based access

What each person sees follows their profile, permission sets and sharing rules; Moraph's engineers and key operators have separate, limited roles.

Complete audit trail

Configuration changes, deployments and key actions are recorded with the person, approval and time, and Salesforce's setup audit trail records administrator changes.

Key service hosting

Moraph's key service runs in the region you choose: the United States, the United Kingdom or Australia, and is covered by Moraph's SOC 2 Type II and ISO/IEC 27001 audits.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Service operations

Change and release log

For cRM owner and information security officer

Every change and release in the period with its request, approval, test result and deployment date.

Break down by
Change type, Release, Approver, Period
Delivered as
Moraph service portal; CSV and PDF export
Used for
Confirming that every production change was approved and tested.

Requests and support tickets

For cRM owner and Moraph service manager

Open and closed requests and tickets with their age, status and who is waiting on whom.

Break down by
Request type, Status, Age band, Business line
Delivered as
Moraph service portal; CSV export
Used for
Keeping the backlog moving and seeing where decisions are needed.

Seasonal release readiness

For cRM owner

Salesforce release changes relevant to your org, test results from the preview sandbox and actions needed before the release.

Break down by
Release, Feature area, Test result, Action owner
Delivered as
Before each Salesforce seasonal release; PDF
Used for
Avoiding surprises when Salesforce updates the platform.

Key custody

Key action log

For key custodian, internal audit

Every key generation, rotation, revocation and destruction with requester, approver, operators and time.

Break down by
Action type, Key, Approver, Period
Delivered as
Moraph service portal; PDF and CSV export
Used for
Evidencing who controls the keys and that every action was approved.

Encryption scope

For key custodian, compliance officer, third-party risk

Which fields, files and attachments are encrypted, the encryption scheme used and when each was added.

Break down by
Object, Field or file type, Date added
Delivered as
On request; PDF
Used for
Answering what is encrypted and confirming it matches the data classification.

Key service availability

For key custodian and CRM owner

Key requests from Salesforce, failed requests and key service incidents in the period.

Break down by
Period, Request result, Incident
Delivered as
Service report
Used for
Seeing whether key availability has affected access to encrypted data.

Access governance

Permission review

For cRM owner, managers, information security officer

Users with their profiles, permission sets and the ability to view encrypted data or export reports.

Break down by
User, Business line, Permission set, Last login
Delivered as
On the review schedule you set; CSV export
Used for
Confirming or removing access and evidencing the review.

Escalated access events

For information security officer and compliance officer

Access events Moraph escalated, such as unusual report exports or logins, with the recommendation and the decision recorded.

Break down by
Event type, User, Outcome, Period
Delivered as
Moraph service portal; PDF export
Used for
Reviewing how access events were handled. Requires Event Monitoring.

Business use

Adoption and data quality

For cRM owner and business leaders

Active users, records updated, and missing or duplicate data in key fields.

Break down by
Business line, Team, Object, Period
Delivered as
Service report; CSV export
Used for
Finding where training or cleanup is needed.

Service review summary

For cRM owner, information security officer and senior management

Changes, releases, incidents, key actions and open risks for the period, with actions agreed.

Break down by
Period, Topic
Delivered as
PDF after each service review
Used for
Giving management a record of how the CRM service was run.

Exports, access and evidence

  • Service reports are prepared by Moraph from Salesforce's setup audit trail and reports, Moraph's change records and the key service log.
  • Business reports and dashboards inside Salesforce remain yours to build and use; Moraph can build them as change requests.
  • Event monitoring and field history reports depend on the Shield features you license.
  • Key custody reports never include key material, only metadata about keys and the actions taken.
  • Reports respect each viewer's role, and auditors receive evidence within the scope and dates you grant.

Deployment

Where and how it runs

New org through Moraph

Moraph resells Financial Services Cloud and Shield and builds a new org, with key material held in Moraph's key service.

Your existing org

If you already use Salesforce, Moraph reviews the org, adds Shield encryption with Moraph-held keys where you license it, and takes over operation.

Client-held keys

If your policy requires your institution to hold key material itself, Moraph can run the org while you operate the key service, with the split written into the responsibilities.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Discovery and data classification

We map business processes and data sources, and classify sensitive fields and files with your security and compliance teams.

Key custody design

We agree how key material is generated and held, who approves key actions, the rotation schedule and what happens if keys are unavailable.

Org configuration

Financial Services Cloud is configured in a sandbox for your relationship model, roles and processes, with the access model built in.

Encryption and testing

Shield Platform Encryption is applied to the agreed scope and tested, including the effect on search, reports and integrations.

Integration and migration

Integrations are built and data is migrated in trial loads, reconciled with your team before the production load.

Go-live and handover

Users are trained, the production org goes live, and change control, approvers, key procedures and reporting move into day-to-day operation.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not Salesforce. Salesforce operates the platform, and Salesforce's own service commitments, roadmap, maintenance and outages apply.
  • Licences are subject to Salesforce's terms. Shield Platform Encryption, Event Monitoring and Field Audit Trail are add-ons that need their own licences.
  • Shield encrypts data at rest. Users your access model allows to see a field see it in clear; encryption does not replace good permissions.
  • Encrypting a field limits some Salesforce functions on it, such as certain search, sort, filter and formula uses, as Salesforce documents. These are reviewed during design.
  • If the key service cannot be reached and cached key material has expired, encrypted data cannot be read until it is restored. Destroyed key material makes the data it protected unrecoverable.
  • Salesforce briefly holds key material in cache while using it; holding keys outside Salesforce controls storage and revocation, not every moment of use.
  • Moraph does not decide what data your institution collects or keeps; data classification, retention and privacy decisions are yours.
  • Not every field type and file can be encrypted with Shield. The encryption scope is limited to what Salesforce supports.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. List the sensitive fields and files you would encrypt and review the effect on search, reports and integrations
  2. Ask your third-party risk team to review the key custody design and its evidence
  3. Walk through a key rotation from request to recorded action
  4. Walk through a change request from approval to recorded deployment
  5. Review what happens to users if the key service is unavailable
  6. Confirm the split of responsibilities between Moraph, Salesforce and your team

Questions

Frequently asked questions

Does Salesforce ever have our keys?

Key material is generated and stored in Moraph's key service, not in Salesforce. Salesforce fetches it when it needs to encrypt or decrypt, and holds it only in cache. Revoking it in the key service stops Salesforce reading encrypted data once the cache clears.

Can Moraph read our client data?

Moraph's key operators cannot sign in to your org. Moraph's Salesforce engineers see client data only when a support task needs it and you have authorized it, time-bound and recorded.

Can we hold the keys ourselves instead?

Yes. Moraph can run the org while your institution operates the key service, with the responsibilities written down accordingly.

What happens if the key service is down?

Salesforce can keep using key material it has cached. Once that expires, encrypted fields and files cannot be read until the key service is reachable again. The key service design and its monitoring are agreed during implementation.

How is it priced?

Salesforce licences are priced under Salesforce's terms, and the managed service, key service and implementation are quoted separately. See Working with Moraph for what drives a quotation.

Can we leave the service?

Yes. The org and its data are yours. Moraph hands over documentation and change history, and key material is transferred to you or another custodian under dual control before Moraph's access is removed.

Next steps

Evaluate CRM for Finance

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: CRM for Finance guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: CRM for Finance support guide.

Related products