Federal civilian · Moraph software

Inter-Agency "Silo Breaker" Data Bridge

Share exactly the fields an agreement allows, without copying databases between agencies

Overview

What you are buying

The Data Bridge is a secure gateway that lets one agency ask another a specific question, such as whether a record exists or what a permitted field contains, and receive only the fields the inter-agency agreement allows. Data stays in the providing agency's systems; the Bridge applies the agreement's rules to every query and logs who asked what, why and what was returned. Privacy officers and data stewards can see every exchange and show that sharing stayed within the agreement and the law.

The problem it solves

When one agency needs to verify something held by another, the usual options are a bulk extract sent on a schedule, a direct connection into the other agency's database, or a manual request by email. Bulk copies go stale and spread personal information further than needed, direct connections give more access than the agreement intends, and manual requests are slow and hard to audit. Privacy officers are asked to sign off on sharing they cannot easily see, and when an inspector general or oversight body asks what was shared and why, the answer has to be reconstructed.

  • Bulk extracts copy more personal information than the purpose needs
  • Direct database access goes beyond what agreements intend
  • Agreement terms are not enforced by the systems that share the data
  • There is no single record of who asked for what, and why

Who uses it

  • Program offices that need to verify information held by another agency
  • Data stewards and system owners at providing agencies
  • Senior agency officials for privacy and privacy offices
  • Chief data officers and interagency agreement managers
  • Inspectors general and auditors reviewing data sharing

Requirements it supports

Privacy Act of 1974 (5 U.S.C. 552a)Computer Matching and Privacy Protection Act of 1988E-Government Act of 2002, Section 208 privacy impact assessmentsOMB Circular A-130, Managing Information as a Strategic ResourceOMB Circular A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy ActNIST SP 800-53 Rev. 5, Security and Privacy Controls

The product supports these requirements; meeting them remains your organization’s responsibility.

See how it works

A short walkthrough

Illustrative screens with fictional sample data. They show the workflow, not any client’s data or configuration, and the layout of the product itself differs. A live demonstration uses the product with sample data.

  1. Step 1

    The agreement register

    Every sharing relationship starts from an agreement, with its parties, purpose, term and status in one register.

    AgreementProviding agencyRequesting agencyPurposeExpiresStatus
    IAA-0412Example Agency A (fictional)Example Agency B (fictional)Benefit eligibility verificationIn 14 monthsIn force
    IAA-0398Example Agency C (fictional)Example Agency B (fictional)Address confirmationIn 40 daysRenewal due
    IAA-0377Example Agency A (fictional)Example Agency D (fictional)Licensing status checkIn 9 monthsIn force
    IAA-0421Example Agency E (fictional)Example Agency A (fictional)Grant recipient verificationNot startedAwaiting approval
    Every sharing relationship starts from an agreement, with its parties, purpose, term and status in one register.
  2. Step 2

    A sharing policy

    The policy turns the agreement into rules the Bridge enforces: which fields, which queries, for what purpose and how many.

    Policy for IAA-0412 · Benefit eligibility verification

    Authority
    Recorded from the agreement
    Query type
    Match on record identifier, return permitted fields
    Permitted fields
    Record exists; enrollment status; status date
    Limit
    500 queries per day (fictional)
    Approved by
    Data steward; both privacy offices

    Fields never released

    • Income amounts
    • Household members
    • Contact details
    The policy turns the agreement into rules the Bridge enforces: which fields, which queries, for what purpose and how many.
  3. Step 3

    A query and its answer

    Each query states its purpose, is checked against the policy, and returns only the permitted fields.

    Query Q-7781204 · IAA-0412

    Requester
    Eligibility system, Example Agency B
    Purpose
    Benefit eligibility verification
    Case reference
    Case 20431 (fictional)
    Record exists
    Yes
    Enrollment status
    Active

    Policy checks

    • Agreement in force
    • Purpose matches the agreement
    • Only permitted fields returned
    • Within daily limit
    Each query states its purpose, is checked against the policy, and returns only the permitted fields.
  4. Step 4

    Refused queries

    Queries that fall outside the policy are refused, and the rule that refused each one is recorded.

    QueryAgreementRequesterReason refusedTime
    Q-7781198IAA-0412Eligibility system, Agency BField not permitted: income amount09:14
    Q-7781150IAA-0398Case worker (fictional)Purpose not in agreement08:52
    Q-7780911IAA-0377Licensing system, Agency DProvider system unavailable07:30
    Q-7780876IAA-0412Eligibility system, Agency BDaily limit reachedDay before
    Queries that fall outside the policy are refused, and the rule that refused each one is recorded.
  5. Step 5

    Reviewing an anomaly

    Unusual activity is flagged to the privacy office, and the review and its outcome are kept with the agreement.

    Anomaly AN-0219 · IAA-0412

    1. Query volume from one requester well above its usual pattern flaggedSystem
    2. Review assignedPrivacy officer, Example Agency A
    3. Requesting agency asked to explain the activityPrivacy officer
    4. Explanation recorded: annual recertification batchAgreement manager, Example Agency B
    5. Activity found within agreement; review closedPrivacy officer
    Unusual activity is flagged to the privacy office, and the review and its outcome are kept with the agreement.
  6. Step 6

    Activity under an agreement

    Privacy offices and auditors see what was asked and released under each agreement, without seeing the personal data itself.

    Month (fictional)QueriesAnsweredRefusedFields releasedAnomalies
    Month 18,2148,170443 permitted fields0
    Month 27,9027,861413 permitted fields0
    Month 311,63011,588423 permitted fields1 reviewed
    Privacy offices and auditors see what was asked and released under each agreement, without seeing the personal data itself.

Workflows

The principal workflows

  1. Agree

    Each data-sharing relationship starts from the agreement behind it. The agreement's parties, purpose, permitted fields, legal authority and term are recorded and turned into a sharing policy that both sides approve.

    • Agreement recorded with parties, purpose, authority and term
    • Permitted fields, query types and volumes listed
    • Policy drafted from the agreement by the agreement manager
    • Providing agency's data steward and both privacy offices approve
    • Policy published with an effective date and an expiry date
  2. Connect

    The providing agency connects the Bridge to its system through a narrow adapter that answers only the queries the policy allows. No database credentials or bulk copies pass to the requesting agency.

    • Adapter installed in the providing agency's environment
    • Source fields mapped to the policy's permitted fields
    • Requesting system registered with its own credentials
    • Test queries run with fictional records
    • Connection approved by the providing system owner
  3. Query

    The requesting agency's system or user sends a query with a stated purpose. The Bridge checks it against the policy, passes it to the provider, and returns only the permitted answer, which may be a match result or specific fields.

    • Query submitted with the requester, purpose and case reference
    • Policy checked: agreement in force, field permitted, volume within limits
    • Query answered by the providing agency's system
    • Response filtered to the permitted fields before it is returned
    • Query and response metadata written to the audit log
  4. Oversee

    Privacy officers, data stewards and auditors see every exchange under each agreement, review anomalies and prepare the reporting that agreements and oversight bodies ask for.

    • Activity under each agreement summarized by purpose, requester and field
    • Queries outside normal patterns flagged for review
    • Refused queries listed with the rule that refused them
    • Agreements approaching expiry or renewal reviewed
    • Evidence exported for inspectors general and oversight bodies

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Requesting user

Eligibility specialist, case worker, program analyst, or a registered requesting system

Asks the questions an agreement allows, for a stated purpose, and uses the permitted answers in their work.

Sees

  • The agreements they are entitled to query under
  • Answers to their own queries, limited to permitted fields
  • Their own query history

Does

  • Submits queries with a purpose and case reference
  • Receives match results or permitted fields
  • Sees why a query was refused
  • Records the case outcome where the agreement asks for it

Cannot

  • Query under an agreement they are not entitled to use
  • See fields outside the policy
  • See other users' queries or answers
Approvals
Their entitlement to query under an agreement is approved by their agency's agreement manager.
Notified about
Refused queries and changes to the agreements they use.

Data steward

Data steward, system owner, program data manager at the providing agency

Decides, within the agreement, what may be shared from their system and approves the policy that enforces it.

Sees

  • Policies for their system's data
  • Activity and refusals under those policies
  • Adapter and connection status
  • Anomalies involving their data

Does

  • Approves or returns proposed policies and changes
  • Approves the adapter connection to their system
  • Suspends a policy when needed
  • Reviews anomalies with the privacy office

Cannot

  • See the personal data returned in individual responses through the Bridge
  • Approve a policy without the privacy offices named in the agreement
  • Edit or delete entries in the audit trail
Approvals
Approves policies and connections for their data, alongside the privacy offices.
Notified about
Policies waiting for approval, anomalies involving their data and agreements nearing expiry.

Agreement manager

Interagency agreement manager, data sharing coordinator, chief data officer staff

Keeps the agreement register and turns each agreement into a policy for approval.

Sees

  • All agreements their agency is party to
  • Policies built from those agreements and their approval status
  • Activity summaries by agreement

Does

  • Records agreements, parties, authority and term
  • Drafts and proposes policies and changes
  • Grants requesting users entitlement under an agreement
  • Tracks renewals and amendments
  • Responds to anomaly reviews on behalf of the requesting agency

Cannot

  • Approve their own policies
  • See personal data in responses
  • Change the audit trail
Approvals
Their policies and changes are approved by the data steward and privacy offices.
Notified about
Agreements nearing expiry, policies returned with comments and anomaly reviews needing a response.

Privacy officer

Senior agency official for privacy, privacy officer, privacy analyst

Makes sure sharing stays within the agreement and the law, and can show it.

Sees

  • Agreements and policies involving their agency
  • Activity, refusals and anomalies under those agreements
  • Policy change history
  • The audit trail for their agency's exchanges

Does

  • Approves or returns proposed policies and changes
  • Reviews and closes anomalies
  • Samples queries for purpose and compliance
  • Prepares privacy and oversight reporting
  • Requests suspension of a policy

Cannot

  • Submit queries for program purposes
  • Edit or delete entries in the audit trail
  • Approve a policy alone where the agreement names other approvers
Approvals
Approves policies and changes alongside the data steward and the other party's privacy office.
Notified about
Policies waiting for approval, anomalies flagged and agreements nearing expiry.

Integration engineer

Integration engineer, system administrator, developer

Connects requesting systems and providing-agency adapters and keeps them working.

Sees

  • Adapter and connection configuration
  • Field mappings for the systems they support
  • Connection health and error logs without personal data

Does

  • Installs and configures adapters
  • Maps source fields to policy fields
  • Registers requesting systems and their credentials
  • Runs tests with fictional records

Cannot

  • Activate a connection without the data steward's approval
  • See live query responses
  • Change policies
Approvals
Connections they configure are approved by the providing system owner before going live.
Notified about
Connection failures, certificate expiry and adapter errors.

Auditor (read-only)

Inspector general staff, internal auditor, oversight body reviewer (under temporary access)

Reviews agreements, policies and exchanges without being able to change anything.

Sees

  • Agreements and policies within the scope granted
  • Query logs and refusals
  • Anomaly reviews and their outcomes
  • The audit trail

Does

  • Searches and reads records within their scope
  • Exports records and reports, with each export logged
  • Leaves review notes where enabled

Cannot

  • Change, approve or suspend anything
  • See records outside the scope and dates granted
  • Keep access after it expires
Approvals
Their access is approved by a privacy officer or administrator, with a scope and an end date.
Notified about
Nothing by default; access granted and expiring is confirmed to the person who approved it.

Administrator

Application administrator

Manages users, agencies and roles, without access to exchanges or personal data.

Sees

  • Users, agencies and roles
  • Identity provider connections
  • The record of permission changes

Does

  • Adds and removes users, or maps them from identity provider groups
  • Assigns roles within their agency
  • Runs access review reports

Cannot

  • Submit queries or see responses
  • Change policies or agreements
  • Grant roles in another agency
Approvals
Role changes that grant approval rights are approved by the agency's privacy officer.
Notified about
Access reviews coming due and accounts not used for a period your policy sets.

Permissions at a glance

ActionRequesterData stewardAgreement mgrPrivacyIntegrationAuditorAdmin
Submit queriesOwn work onlyNo accessNo accessNo accessNo accessNo accessNo access
See query responsesOwn work onlyNo accessNo accessNo accessNo accessNo accessNo access
Record agreementsNo accessView onlyFullView onlyNo accessView onlyNo access
Propose sharing policiesNo accessView onlyFullView onlyNo accessView onlyNo access
Approve sharing policiesNo accessApprovesNo accessApprovesNo accessNo accessNo access
Suspend a policyNo accessFullNo accessApprovesNo accessNo accessNo access
Grant query entitlementNo accessNo accessOwn work onlyView onlyNo accessNo accessNo access
Configure adapters and connectionsNo accessApprovesNo accessNo accessFullNo accessNo access
Review anomaliesNo accessView onlyOwn work onlyFullNo accessView onlyNo access
View query logsOwn work onlyOwn work onlyOwn work onlyView onlyNo accessView onlyNo access
Export oversight reportsNo accessOwn work onlyOwn work onlyFullNo accessView onlyNo access
Manage users and rolesNo accessNo accessNo accessApprovesNo accessNo accessFull
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • No single person can put a policy into force: it is drafted by an agreement manager and approved by the providing agency's data steward and the privacy offices the agreement names.
  • Roles belong to an agency. Each agency's people sign in through its own identity provider and see only the agreements, policies and logs their agency is party to.
  • Only requesting users see the personal data in responses. Stewards, privacy officers and auditors see what was asked and which fields were released, not the values themselves.
  • Every permission change is recorded in the audit trail, and access review reports list each person's roles for periodic certification. Auditors get temporary read-only access with a defined scope and an end date.

Features

What it does

Agreement-driven policies

Each sharing policy is built from a recorded interagency agreement, including its purpose, authority, permitted fields and term, and stops working when the agreement expires.

Field-level release

Responses contain only the fields the policy allows; other fields in the source record never leave the providing agency.

Match-only answers

Where a yes-or-no answer is enough, the Bridge returns only whether a matching record exists, without returning the record.

Data stays at the source

Queries are answered from the providing agency's system at the time they are asked, so no bulk copy is made or kept by the requester.

Purpose on every query

Every query carries a stated purpose and case reference, which are checked against the agreement and kept in the log.

Volume and rate limits

Limits on the number of queries per requester and period, as the agreement sets, to prevent use of the Bridge as a bulk extract.

Complete query log

Who asked, for what purpose, under which agreement, which fields were returned and when, for every query, and it cannot be edited.

Anomaly review

Queries outside normal patterns, such as unusual volumes, hours or repeated refusals, flagged for the privacy office or data steward to review.

Policy approval workflow

New policies and changes need approval from the providing agency's data steward and the privacy offices named in the agreement.

Agreement register

All agreements with their parties, authority, term, renewal dates and the policies built from them, in one register.

Standard APIs

Requesting systems connect through documented REST APIs, and people without a system integration can use a web form under the same policy.

Oversight reporting

Activity, refusals and anomalies by agreement, ready for privacy offices, data integrity boards where matching programs apply, and inspectors general.

Integrations

How it connects to your systems

Connects toHowWhat flows
Providing agency systemsA narrow adapter in the providing agency's environment answers permitted queries from its database or API, mapped during implementation.In: answers to permitted queries only. No bulk extracts.
Requesting agency systemsCase management and eligibility systems send queries through documented REST APIs, each registered with its own credentials.In: queries with purpose and case reference. Out: permitted fields or match results.
Single sign-onPeople sign in through their own agency's identity provider, including PIV card sign-in, so each agency's credentials and policies apply.In: user identity, agency and group membership for role assignment.
Security information and event managementQuery and policy logs are streamed to each agency's SIEM, limited to that agency's own activity.Out: audit events in a standard log format.
Records managementLogs and agreement records are retained and disposed of under the retention schedules you set, and can be transferred to your records system.Out: agreements, policies and logs on your retention schedule.
Work APIAgreement, policy and activity data available to each agency's reporting tools through the Moraph Work API.Out: agreements, policies, activity summaries and anomaly reviews, without returned personal data.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Records kept in the United States

The Bridge and its logs are hosted in Moraph's United States region, or in your own environment.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Single sign-on and role-based access

Each agency's people sign in through its own identity provider, and roles decide who can query, approve policies and see logs.

Encryption under controlled keys

Data in transit and logs at rest are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every query, response, refusal, policy change and approval recorded with the person, system and time, and cannot be edited.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Activity

Queries by agreement

For agreement managers, data stewards and privacy officers

Queries under each agreement with their outcome, purpose and requester, over time.

Break down by
Agreement, Purpose, Requester, Outcome, Period
Delivered as
Live dashboard; CSV export
Used for
Seeing how each agreement is used and whether use matches its purpose.

Fields released

For data stewards and privacy officers

Which fields were released under each agreement and how often, without the values themselves.

Break down by
Agreement, Field, Requester, Period
Delivered as
Live view; CSV and PDF export
Used for
Confirming that only permitted fields leave the providing agency.

Connection health

For integration engineers and data stewards

Availability and errors for each adapter and requesting system, and queries refused because a system was unavailable.

Break down by
System, Agency, Error type, Period
Delivered as
Live dashboard; scheduled email
Used for
Keeping connections working and spotting problems before programs notice.

Privacy and compliance

Refused queries

For privacy officers and agreement managers

Queries refused, the rule that refused each, and the requesters involved.

Break down by
Agreement, Rule, Requester, Period
Delivered as
Live dashboard; CSV export
Used for
Finding requesters who need training and policies that need a change.

Anomaly reviews

For privacy officers

Anomalies flagged, who reviewed them, the explanation recorded and the outcome.

Break down by
Agreement, Anomaly type, Outcome, Period
Delivered as
Live view; PDF and CSV export
Used for
Evidencing that unusual activity was looked at and resolved.

Agreement status and renewals

For agreement managers, privacy officers, chief data officers

All agreements with their term, renewal dates, policy status and approvals.

Break down by
Agency, Status, Expiry window, Authority
Delivered as
Live dashboard; scheduled email
Used for
Renewing agreements before sharing stops and retiring those no longer needed.

Matching program activity

For privacy officers and data integrity boards

Activity under agreements designated as computer matching programs, with the matching agreement reference and term.

Break down by
Matching program, Period, Outcome
Delivered as
PDF; CSV export
Used for
Supporting data integrity board reviews and required reporting.

Audit

Policy change history

For privacy officers, auditors, inspectors general

Every policy and change, with who proposed it, who approved it and when it took effect.

Break down by
Agreement, Change date, Approver, Change type
Delivered as
Live view; PDF and CSV export
Used for
Showing that every sharing rule was approved before it took effect.

Audit trail extract

For auditors and inspectors general

Who did what and when for a selected agreement, requester, query or period.

Break down by
Record, User or system, Action, Date range
Delivered as
On request in the product; CSV and PDF export
Used for
Answering oversight requests without assembling evidence by hand.

Access review

For privacy officers and administrators

Each user's roles, agency and query entitlements, and accounts not used recently.

Break down by
Agency, Role, Agreement, Last sign-in
Delivered as
Live view; CSV export
Used for
Periodic certification of who can query and approve.

Exports, access and evidence

  • Every report can be exported to CSV, and compliance and audit reports to PDF. Reports can be scheduled to arrive by email for the people entitled to see them.
  • Reports describe what was asked and released, not the personal data itself, so privacy offices and auditors can review sharing without seeing individuals' records.
  • Agreement, policy and activity data is available through the Moraph Work API for each agency's own reporting tools, limited to the agreements it is party to.
  • Reports respect each viewer's role and agency: a data steward sees their own data's agreements, a privacy officer sees their agency's, and auditors see the scope they are granted.
  • Audit reports can be run as of a past date and give the same result each time. Running and exporting a report is itself recorded in the audit trail.

Deployment

Where and how it runs

Moraph cloud, United States

Hosted in the United States region, with adapters installed in each providing agency's environment.

Agency-hosted

Installed in an agency's own environment where its policy requires, operated under its authorization.

Dedicated environment

A single-tenant environment for agencies that require isolation, scoped in the proposal.

With a managed service

Optionally run alongside a Moraph managed service for policy upkeep, adapter maintenance and administration.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Agreement and privacy review

We review the agreements, system of records notices, privacy impact assessments and legal authorities behind each sharing relationship with your privacy office and counsel.

Policy design

Permitted fields, query types, purposes and limits are translated into sharing policies and reviewed with both agencies' data stewards and privacy offices.

Adapter and integration

The adapter is installed at the providing agency and mapped to its system, and requesting systems are registered and connected. We need a contact from each system's technical team.

Testing with fictional records

Each policy is tested with fictional records, including queries that should be refused, before any live data is connected.

Authorization support

We provide control documentation to support each agency's own authorization decision; Moraph does not hold a FedRAMP authorization for the Bridge.

Training and go-live

Requesting users, data stewards and privacy staff are trained on their own tasks, and each agreement goes live when both sides approve.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • It does not decide whether sharing is lawful. The legal authority, agreements, system of records notices and privacy impact assessments are your agencies' responsibility; the Bridge enforces the policies you approve.
  • Computer matching programs still need their matching agreements, data integrity board approvals and notices. The Bridge supports them but does not replace those steps.
  • Answers are only as accurate as the providing agency's records. The Bridge does not correct or reconcile source data.
  • It is not a data warehouse or analytics platform. It answers specific queries and does not build combined datasets across agencies.
  • Each providing agency must install and maintain an adapter, which needs its system owner's approval and technical support.
  • Statute-specific restrictions, such as those on federal tax information, can be reflected in policies, but determining what they permit is your agencies' decision.
  • Moraph holds no FedRAMP authorization for the Bridge. We provide control documentation to support each agency's own authorization.
  • Responses depend on the availability of the providing agency's system; if it is unavailable, queries are refused rather than answered from a copy.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Turn one of your existing agreements into a policy and check that it says what the agreement says
  2. Send test queries with fictional records, including ones that should be refused, and review the refusals
  3. Confirm that fields outside the policy never appear in a response or a log
  4. Review the query log from the point of view of your privacy office and inspector general
  5. Check what happens when an agreement expires or the providing system is unavailable
  6. Walk the adapter installation through your system owner's change and authorization process

Questions

Frequently asked questions

Does the requesting agency get a copy of our database?

No. Each query is answered from your system when it is asked, and only the fields the policy permits are returned. No bulk copy is made.

Does the Bridge decide whether we are allowed to share?

No. Your agencies decide that, through the agreement, its legal authority and your privacy reviews. The Bridge enforces the policy you approve and records every exchange.

Can it support a computer matching program?

Yes, as the mechanism for exchanging and logging data under the program. The matching agreement, data integrity board approval and required notices remain with your agencies.

Is it FedRAMP authorized?

No. Moraph holds no FedRAMP authorization for the Bridge. We provide control documentation to support each agency's own authorization decision.

How is it priced?

As a subscription, usually measured by the number of agreements and connected systems, with implementation charged separately. See Working with Moraph for what drives a quotation.

Is there an accessibility conformance report?

Ask for one through the procurement request form at /how-to-buy/request, naming the version you are evaluating.

Next steps

Evaluate Inter-Agency "Silo Breaker" Data Bridge

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Inter-Agency "Silo Breaker" Data Bridge guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Inter-Agency "Silo Breaker" Data Bridge support guide.