CRM for Finance

Principal workflows

• Design: Moraph works with your business, security and compliance teams to decide what data the CRM holds, which fields and files are encrypted, how keys are held and who can see what.
• Build and migrate: Moraph configures Financial Services Cloud, sets up Shield Platform Encryption with keys from Moraph's key service, and migrates data from your existing systems in tested loads.
• Operate: Moraph runs the org day to day: change requests, user and permission changes, release testing, monitoring and second-line support, with every change approved by your named owner.
• Manage keys: Moraph operates the key service, rotates key material on the schedule you approve, and handles requests to revoke or destroy keys under dual control, with each action recorded.

Who uses it

• Heads of retail, commercial and wealth businesses who want one view of each relationship
• CISOs and third-party risk teams who need to answer for where client data is and who can decrypt it
• CRM and Salesforce administrators who need engineering and operations support
• Compliance officers responsible for privacy, recordkeeping and access to nonpublic personal information
• Internal audit and examiners reviewing controls over customer information

Reporting

• Changes and releases with approvals and test results
• Key actions with requester, approver and operators
• Fields and files under encryption
• Who can view encrypted data or export reports
• Escalated access events and decisions
• Adoption and data quality by business line

Features

• Relationship view: Financial Services Cloud brings households, related people and businesses, financial accounts and goals into one view of each client.
• Shield Platform Encryption: Salesforce Shield encrypts selected fields, files and attachments at rest, using key material supplied from outside Salesforce.
• Keys held outside Salesforce: Using Salesforce's Cache-Only Key Service, key material stays in Moraph's key service; Salesforce fetches it when needed and holds it only in cache, not in storage.
• Dual-control key operations: Generating, rotating, revoking or destroying key material needs two Moraph operators and your key custodian's approval, and every action is logged.
• Least-privilege access model: Profiles, permission sets and sharing rules designed so each role sees the clients and fields it needs, with field-level security on sensitive data.
• Event monitoring: Where Shield Event Monitoring is licensed, Moraph reviews logins, report exports and API access for patterns that need attention and escalates them to you.
• Field history retention: Where Shield Field Audit Trail is licensed, changes to sensitive fields are kept for the retention period you set, for compliance and investigations.
• Release management: Changes and Salesforce seasonal releases are tested in sandboxes and deployed through a recorded release process with your sign-off.
• Referrals and action plans: Financial Services Cloud's referral and action plan features configured for how your teams pass leads and run onboarding and review tasks.
• Managed change control: Every change, from a new field to a permission set, goes through a request, approval, sandbox test and recorded deployment.
• Access reviews: Periodic reports of who holds which permissions and who can see encrypted data, for your managers and security team to confirm or remove.
• Third-party risk evidence: A pack describing key custody, encryption scope, access controls and change history, for your vendor risk and audit teams.

Integrations

• Core banking: Customer, account and balance data from your core system loaded on a schedule or through an integration layer, so relationship managers see current holdings.
• Wealth and custody platforms: Holdings, positions and account details from your wealth or custody platform for advisors' views of client assets.
• Moraph key service: Salesforce's Cache-Only Key Service calls Moraph's key service for key material over an authenticated connection.
• Identity provider: Staff sign in to Salesforce through your identity provider using SAML single sign-on, so your MFA and leaver process apply.
• Electronic signature: Documents generated from the CRM sent for signature through a signing platform such as DocuSign, with the status returned to the record.
• Marketing and communications: Consent and preference data shared with your marketing platform, so campaigns respect what clients have agreed to.
• Data warehouse and SIEM: CRM data delivered to your data warehouse, and event monitoring data to your SIEM, where licensed.

Deployment

• New org through Moraph: Moraph resells Financial Services Cloud and Shield and builds a new org, with key material held in Moraph's key service.
• Your existing org: If you already use Salesforce, Moraph reviews the org, adds Shield encryption with Moraph-held keys where you license it, and takes over operation.
• Client-held keys: If your policy requires your institution to hold key material itself, Moraph can run the org while you operate the key service, with the split written into the responsibilities.

Security and privacy

• Keys outside Salesforce: Key material for Shield Platform Encryption is generated and held in Moraph's key service, and Salesforce holds it only in cache.
• Dual control and your approval: Moraph staff cannot use key material without your explicit, time-bound authorization and a second operator; every key action is logged.
• Single sign-on: Staff sign in through your identity provider, so your password, MFA and leaver policies apply.
• Role-based access: What each person sees follows their profile, permission sets and sharing rules; Moraph's engineers and key operators have separate, limited roles.
• Complete audit trail: Configuration changes, deployments and key actions are recorded with the person, approval and time, and Salesforce's setup audit trail records administrator changes.
• Key service hosting: Moraph's key service runs in the region you choose: the United States, the United Kingdom or Australia, and is covered by Moraph's SOC 2 Type II and ISO/IEC 27001 audits.

Limitations

• Moraph is not Salesforce. Salesforce operates the platform, and Salesforce's own service commitments, roadmap, maintenance and outages apply.
• Licences are subject to Salesforce's terms. Shield Platform Encryption, Event Monitoring and Field Audit Trail are add-ons that need their own licences.
• Shield encrypts data at rest. Users your access model allows to see a field see it in clear; encryption does not replace good permissions.
• Encrypting a field limits some Salesforce functions on it, such as certain search, sort, filter and formula uses, as Salesforce documents. These are reviewed during design.
• If the key service cannot be reached and cached key material has expired, encrypted data cannot be read until it is restored. Destroyed key material makes the data it protected unrecoverable.
• Salesforce briefly holds key material in cache while using it; holding keys outside Salesforce controls storage and revocation, not every moment of use.
• Moraph does not decide what data your institution collects or keeps; data classification, retention and privacy decisions are yours.
• Not every field type and file can be encrypted with Shield. The encryption scope is limited to what Salesforce supports.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/crm-for-finance. Purchasing routes and company information: www.moraph.com/how-to-buy.