Financial Services · Managed platform (Kiteworks)

Secure File Transfer

A secure place for clients to send tax returns and financial documents, instead of email

Book a demonstration Request a technical briefing Factsheet

Overview

What you are buying

Moraph resells, implements and runs Kiteworks so your clients can upload tax returns, statements and other sensitive documents through an encrypted upload link or portal rather than ordinary email. Kiteworks controls who can see each file, how long it is kept and every download, and Moraph configures it to your retention and data-handling policies. Moraph runs the service day to day, while your firm decides who has access and how long documents are kept.

The problem it solves

Wealth, trust, tax and lending teams still receive tax returns, bank statements and identity documents as email attachments. Those files sit in inboxes indefinitely, get forwarded, and leave no record of who opened them. Consumer file-sharing links are hard to control and harder to evidence. When a client asks how their documents are protected, or an examiner asks how customer information sent by email is safeguarded, the honest answer is often that it is not controlled.

Clients email tax returns and statements as ordinary attachments
Documents stay in inboxes and personal folders long after they are needed
There is no record of who opened or forwarded a file
Staff use consumer file-sharing tools the firm does not control

Who uses it

Wealth management, trust and private banking teams collecting client documents
Tax and accounting groups that receive tax returns and supporting records
Lending teams that collect statements and tax documents from borrowers
Compliance and information security officers responsible for customer information
IT teams that want the platform run for them

Requirements it supports

Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)Internal Revenue Code Section 7216 and Treasury Regulations (26 CFR 301.7216) on tax return informationIRS Publication 4557, Safeguarding Taxpayer DataSEC Regulation S-P (17 CFR Part 248, Subpart A)Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500)

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

Kiteworks provides the platform, Moraph configures and runs it, and your firm decides who has access and how documents are handled.

Area	Moraph	Kiteworks	Your organization
Licensing	Supplies licences as a reseller and tracks counts and renewals	Sets licence terms, entitlements and pricing	Agrees to Kiteworks' terms and decides how many users to license
Platform availability	Monitors the platform and escalates vendor-side issues	Runs its hosted service under its own service commitments	Provides hosting and network access for self-hosted deployments
Configuration	Configures folders, policies, branding and integrations as approved	Provides the platform's configuration capabilities	Approves configuration through the service owner
Identity and access	Integrates with your identity provider and maintains groups	Provides authentication and recipient verification features	Owns the identity provider and decides who can see which folders
Monitoring	Watches health and security alerts and triages them	Publishes service status for its hosted service	Reports user problems through your help desk
Incident response	Triages, contains or escalates incidents and keeps you informed	Resolves issues in its own product and service	Decides on client communications and any notifications
Patches and updates	Applies platform updates after testing in agreed windows	Releases product updates and security fixes	Approves maintenance windows
Retention and sharing policy	Implements the policy and reports on it	Provides retention and sharing controls	Decides retention periods, sharing rules and legal holds
User support	Second-line support and vendor escalation	Vendor support for Moraph's escalations	First-line support for staff and client questions

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of Kiteworks itself, which belongs to its vendor.

Step 1

The onboarding tracker

During onboarding, each team moves from discovery through policy approval, pilot and rollout.

Team	Staff	Folder template	Policies approved	Pilot	Status
Tax services	18	Client tax year	Yes	Complete	Live
Private banking	26	Client relationship	Yes	Complete	Live
Trust administration	14	Trust account	Yes	In progress	Piloting
Mortgage lending	31	Loan file	Awaiting retention decision	Not started	Blocked
Wealth advisory	22	Client relationship	Yes	Not started	Scheduled

Step 2
The configuration baseline review
Each month the live configuration is compared with the policies your compliance officer approved.
Secure File Transfer · Baseline reviewSample data
Baseline review · Example Wealth Partners (fictional)
Policy version
v4, approved by compliance officer
Recipient verification
One-time code required
Default share expiry
Matches policy
Retention, tax folders
Matches records schedule
Malware scanning
On for all uploads
Download limit on shares
1 folder differs from policy
Deviations
- One folder created before the policy change kept the old download setting
- Change request opened to align it
- Compliance officer notified
Accept as exceptionRestore baseline
Each month the live configuration is compared with the policies your compliance officer approved.
Step 3
A change request
Changing a retention rule is requested, approved by compliance and the service owner, tested and recorded.
Secure File Transfer · Change CR-0743Sample data
CR-0743 · New retention rule for trust account folders
1. Change requested with records schedule referenceCompliance officer
2. Impact assessed: existing folders affectedMoraph service engineer
3. Retention rule approvedCompliance officer
4. Change approved and window agreedService owner
5. Rule applied and tested on sample folderMoraph service engineer
6. Request closed with evidenceMoraph service engineer
Changing a retention rule is requested, approved by compliance and the service owner, tested and recorded.

Step 4

Alert triage

Platform and security alerts land in Moraph's operations queue, where they are resolved, passed to your firm or escalated to the vendor.

Alert	Signal	Priority	Owner	Status
AL-3307	Uploaded file flagged by malware scan	High	Your compliance officer	File quarantined, passed on
AL-3302	Unusual volume of downloads by one recipient	High	Your compliance officer	Passed on
AL-3298	Storage approaching licence limit	Medium	Moraph	Service owner informed
AL-3291	Vendor maintenance notice	Low	Vendor	Scheduled
AL-3286	Failed sign-ins, one staff account	Low	Your help desk	Passed on

Step 5
The monthly service review
Each month the service owner and compliance officer see usage, incidents, changes and open actions in one pack.
Secure File Transfer · Service reviewSample data
Monthly service review · Example Wealth Partners (fictional)
Teams live
4
Upload requests sent
1,312
Requests still open
146
Incidents
1
Updates applied
Current
Files past retention awaiting review
38
Actions agreed
- Compliance officer to review files past retention
- Plan mortgage lending rollout once retention is decided
- Refresh client guidance for tax season
Download PDFRecord actions
Each month the service owner and compliance officer see usage, incidents, changes and open actions in one pack.

Step 6

The access review

Team managers confirm who can see each client folder, and removals are tracked until done.

User	Team	Folders	Last sign-in	Manager decision	Status
User 7120	Tax services	Client tax year (all)	Today	Keep	Confirmed
User 7104	Tax services	Client tax year (all)	Left the firm	Remove	Removed
User 6981	Private banking	Assigned clients	This week	Keep	Confirmed
User 6955	Trust administration	Trust account (all)	88 days ago	Pending	Reminder sent
User 6930	Private banking	Assigned clients	Yesterday	Keep	Confirmed

Workflows

The principal workflows

Request
A staff member sends a client a secure upload request for the documents they need, and Kiteworks delivers files into a folder only the right people can see.
- Staff member creates an upload request from Kiteworks or their email client
- Client receives a link and verifies their identity as your policy requires
- Client uploads the requested documents
- Kiteworks scans the files and places them in the client's folder
- Staff member is notified that the documents have arrived
Share
When documents need to go back to the client or to an outside adviser, staff send them through Kiteworks with access limits and expiry rather than as attachments.
- Staff member selects files and recipients
- Access settings follow policy: view only, download, expiry date
- Recipient verifies identity before opening
- Every view and download is logged
- Access ends automatically at expiry
Retain and dispose
Files are kept for the periods your records schedule sets and then deleted, with legal holds when needed.
- Retention rules set per folder type with your compliance officer
- Files reaching the end of retention flagged for review where required
- Files deleted on schedule and the deletion logged
- Legal holds placed and released by authorized staff
- Retention exceptions reviewed periodically
Operate and review
Moraph monitors the platform, applies updates, handles changes and reports monthly on usage, incidents and access.
- Platform health and security alerts triaged by Moraph
- Updates applied after testing in agreed windows
- Change requests approved by your service owner
- Access reviews sent to team managers
- Monthly service review prepared and discussed

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Client or external recipient

Client, borrower, trust beneficiary, outside accountant or attorney

Sends documents to your firm and receives documents from it through a secure link instead of email.

Sees

The upload request or files shared with them
Your firm's branded upload page
Files they uploaded, where your policy allows

Does

Verifies their identity as your policy requires
Uploads requested documents
Opens or downloads files shared with them before they expire

Cannot

See other clients' folders or files
Open a shared file after it expires or is withdrawn
Share files onward through Kiteworks

Approvals: None; they act on requests and shares sent by your staff.
Notified about: Upload requests and files shared with them, and expiry reminders where enabled.

Staff member

Relationship manager, tax preparer, trust officer, loan processor, client service associate

Collects and sends client documents securely for the clients they serve.

Sees

Client folders they have been given access to
Upload requests and shares they created, with their status
Activity on files they shared

Does

Sends upload requests to clients
Receives, opens and files uploaded documents
Sends files to clients and outside advisers with expiry and access limits
Withdraws a share sent in error

Cannot

Open client folders they have not been given access to
Change retention periods or delete files under retention or legal hold
Turn off recipient verification or extend expiry beyond policy

Approvals: Shares outside the limits your policy sets need the compliance officer's approval.
Notified about: Documents uploaded in response to their requests, and shares about to expire.

Team manager

Wealth team lead, tax practice manager, lending operations manager

Decides which staff can see which client folders, and confirms it periodically.

Sees

Their team's client folders and who can access each one
Their team's sharing activity
Access review lists for their team

Does

Grants and removes staff access to their team's client folders
Reassigns folders when staff move or leave
Confirms or removes access during access reviews
Requests changes to folder templates through the service owner

Cannot

Grant access to folders outside their team
Change retention or sharing policies
Delete activity logs

Approvals: Access they grant is recorded and reviewed in periodic access reviews.
Notified about: Access reviews due, staff leaving their team, and unusual sharing activity on their team's folders.

Service owner

IT manager, IT director, operations technology lead

Owns the service at your firm and is Moraph's main point of contact.

Sees

Platform configuration, users and folder structure
Monitoring summaries, incidents and changes
Licence use and the monthly service review

Does

Approves change requests to configuration, integrations and branding
Approves maintenance windows
Manages licence counts and renewals with Moraph
Attends the monthly service review and agrees actions
Approves Moraph administrative access

Cannot

Change retention or sharing policies without the compliance officer
Open client files unless also granted folder access
Edit or delete activity logs

Approvals: Approves changes; changes to retention or sharing policy also need the compliance officer.
Notified about: Change requests waiting for approval, incidents, licence limits approaching and vendor service notices.

Compliance officer

Chief compliance officer, information security officer, privacy officer, records manager

Decides how long documents are kept, how they may be shared, and checks that policy is followed.

Sees

Retention, sharing and verification policies
Activity logs across all folders
Legal holds and retention exceptions
Security alerts involving the service

Does

Approves retention periods and sharing policies
Places and releases legal holds
Approves sharing exceptions
Reviews activity and exports logs for audit or investigation
Approves security-relevant configuration changes

Cannot

Edit or delete activity logs
Approve an exception they requested themselves
Apply configuration changes directly

Approvals: Approves retention, sharing and verification policies, exceptions and legal holds.
Notified about: Exception requests, files flagged by scanning, unusual download activity and changes to administrative access.

Moraph service engineer

Moraph platform engineer, operations engineer

Runs Kiteworks for you: configures it, monitors it, applies updates and carries out approved changes.

Sees

Platform configuration, health and security alerts
Change requests and incidents for your environment
Vendor service notices

Does

Configures folder templates, policies and integrations as approved
Monitors health and triages alerts
Applies platform updates after testing
Raises cases with Kiteworks when the vendor's product is involved
Prepares the monthly service review

Cannot

Open client folders or files without a recorded support reason and your approval
Change retention or sharing policies without approval
Grant themselves access; administrative access is approved by your service owner

Approvals: Changes are approved by your service owner, and policy changes by your compliance officer.
Notified about: Platform alerts, incidents, approved changes ready to schedule and vendor notices.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Reviews policies, access and activity records without being able to change anything or open client files.

Sees

Retention and sharing policies with their approvals
Access review results
Activity logs within the granted scope
Change history and service reports

Does

Reads and exports records within their scope, with each export logged
Requests further evidence through the compliance officer
Leaves review notes where your firm enables them

Cannot

Open client files unless your firm grants it specifically
Change, approve or delete anything
Keep access after it expires

Approvals: Their access is approved by the compliance officer, with a scope and an end date.
Notified about: Nothing by default; access granted and expiring is confirmed to the person who approved it.

Permissions at a glance

Action	Client	Staff	Team manager	Service owner	Compliance	Moraph eng.	Auditor
Upload requested documents	Own work only	Full	Full	No access	No access	No access	No access
Send upload requests to clients	No access	Own work only	Full	No access	No access	No access	No access
Open files in client folders	Own work only	Own work only	Own work only	No access	View only	No access	No access
Share files outside the firm	No access	Own work only	Own work only	No access	No access	No access	No access
Approve sharing exceptions	No access	No access	No access	No access	Approves	No access	View only
Grant staff access to client folders	No access	No access	Own work only	Full	No access	No access	No access
Set retention and sharing policy	No access	No access	No access	View only	Approves	No access	View only
Place or release a legal hold	No access	No access	No access	No access	Full	No access	View only
Approve configuration changes	No access	No access	No access	Approves	Approves	No access	View only
Apply approved changes	No access	No access	No access	No access	No access	Full	No access
View activity logs	No access	Own work only	Own work only	View only	Full	View only	View only
Approve Moraph admin access	No access	No access	No access	Approves	View only	No access	View only

Full
Own work only
Approves
View only
No access

How access is controlled

Moraph engineers manage the platform but do not open client folders or files. Where support needs it, access is requested with a reason, approved by your firm and logged.
Client folder access follows teams: a team manager grants their own staff access, and access reviews ask them to confirm it periodically.
Retention, sharing and verification policies are approved by your compliance officer, and exceptions are approved by someone other than the person asking for them.
Staff sign in through your identity provider, and roles can follow its groups. External recipients verify their identity for each request or share, and auditors get temporary read-only access with a scope and an end date.

Features

What it does

Secure upload requests

Staff send clients a link to upload specific documents, without the client needing an account or the files touching email.

Client folders

Each client relationship has a folder whose access is limited to the staff who serve that client.

Secure sending

Files are sent to clients and outside advisers through Kiteworks with view-only or download rights and an expiry date.

Recipient verification

External recipients verify their identity before opening files, using the methods your policy requires, such as a one-time code.

Email client add-in

Staff send secure upload requests and files from their email client, so the secure route is also the convenient one.

File scanning

Uploaded files are scanned for malware, and can be checked by your data loss prevention tool, before staff open them.

Encryption

Kiteworks encrypts files in transit and at rest.

Retention and disposal

Retention periods per folder type, automatic deletion at the end of retention, and legal holds that stop deletion.

Activity logging

Every upload, view, download, share and permission change is logged with the person and time.

Branding

Upload pages and notifications carry your firm's name and logo, so clients recognize where they are sending documents.

Managed operation

Moraph monitors the platform, applies updates, manages configuration and answers your help desk's escalations.

Access reviews

Periodic lists of who can see each client folder, sent to team managers for confirmation, with removals tracked.

Integrations

How it connects to your systems

Connects to	How	What flows
Identity provider	Staff sign in through your identity provider with multi-factor authentication, using SAML.	In: user identity and group membership.
Email client	An add-in lets staff send upload requests and secure shares from their email client.	Out: secure links in email. Files themselves stay in Kiteworks.
Malware scanning	Uploaded files are checked by malware scanning before staff open them.	Out: files for scanning. In: scan verdicts.
Data loss prevention	Outgoing shares can be checked by your data loss prevention tool, such as Moraph's managed Data Loss Prevention service.	Out: files and metadata for policy checks. In: allow or block decisions.
Document management	Uploaded documents can be moved into your document management or client record system after review.	Out: documents filed to the client record.
Security monitoring	Activity logs forwarded to your SIEM or security operations provider.	Out: upload, download, share and administrative events.
IT service management	Incidents and change requests exchanged with your service desk tool.	In and out: tickets, change requests and status.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply; external recipients verify their identity for each request.

Role-based access

Client folders are visible only to the staff who serve that client; approving a policy exception is separate from requesting one.

Encryption and keys

Kiteworks encrypts files in transit and at rest; where Moraph holds keys, staff cannot use them without explicit, time-bound authorization.

Complete audit trail

Every upload, view, download, share, permission change and administrative action is logged with the person and time, and cannot be edited.

No routine access to client files

Moraph engineers administer the platform without opening client files; any exception is requested, approved by your firm and logged.

Data residency

Files are hosted in the region you choose: the United States, the United Kingdom or Australia.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

10 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Activity

Upload requests and responses

For staff and team managers

Upload requests sent, documents received and requests still waiting on the client.

Break down by: Staff member, Team, Status, Period
Delivered as: Live view; CSV export
Used for: Following up with clients who have not yet sent documents.

External sharing

For team managers and compliance officer

Files shared outside the firm, with recipients, access settings, expiry and downloads.

Break down by: Team, Recipient domain, Access type, Period
Delivered as: Live view; scheduled email; CSV export
Used for: Checking that client documents leave the firm only as policy allows.

File activity log

For compliance officer and auditors

Who uploaded, viewed, downloaded or shared each file, and when.

Break down by: Folder, User, Action, Date range
Delivered as: On request; CSV and PDF export
Used for: Answering client, audit and investigation questions about a specific document.

Policy and compliance

Retention and disposal

For compliance officer and records manager

Files reaching the end of retention, files deleted, and files kept under legal hold.

Break down by: Folder type, Retention rule, Status, Period
Delivered as: Monthly PDF; CSV export
Used for: Evidencing that documents are kept no longer than your schedule allows.

Sharing exceptions

For compliance officer and auditors

Each exception to the sharing policy, who requested and approved it, and when it ends.

Break down by: Team, Policy area, Approver, End date
Delivered as: Live view; PDF export
Used for: Keeping exceptions few, justified and reviewed.

Files flagged by scanning

For compliance officer and security team

Uploaded files flagged by malware or data loss prevention checks, and what happened to each.

Break down by: Check type, Folder, Outcome, Period
Delivered as: Live view; scheduled email
Used for: Following up on risky uploads and outgoing files.

Access

Access review

For team managers, compliance officer, auditors

Who can see each client folder, the manager's confirmation or removal, and removals completed.

Break down by: Team, Manager, Folder, Outcome
Delivered as: Scheduled email to managers; PDF and CSV export
Used for: Periodic certification of access to client documents.

Administrative activity

For compliance officer and auditors

Administrative sign-ins and actions by Moraph engineers and your administrators, including any approved access to client files.

Break down by: Administrator, Action, Date range
Delivered as: On request; CSV export
Used for: Reviewing privileged activity on the platform.

Service

Monthly service review

For service owner and compliance officer

Availability, incidents, changes, updates applied, licence use and open actions for the month.

Break down by: Month, Incident priority, Change type
Delivered as: PDF; reviewed in a monthly meeting
Used for: Overseeing the service and agreeing actions with Moraph.

Adoption

For service owner and business leaders

Staff using the platform, requests and shares per team, and storage used.

Break down by: Team, Period, Activity type
Delivered as: Monthly PDF
Used for: Seeing which teams still rely on email attachments and where to focus training.

Exports, access and evidence

Kiteworks' own activity and administration reports remain available to your administrators; Moraph adds service, access review and policy reports around them.
Every report can be exported to CSV or PDF and scheduled by email to the people entitled to see it.
Activity logs can be forwarded to your SIEM so your security team reports on them alongside other systems.
Reports respect each viewer's role: team managers see their own team's folders and sharing, while the compliance officer sees the whole firm.
Activity and retention reports can be run for a past period for audit, and running or exporting a report is itself logged.

Deployment

Where and how it runs

Hosted by the vendor

Kiteworks hosted in the region you choose, configured and operated by Moraph.

Your own cloud tenant

Kiteworks deployed in your own cloud subscription for firms whose policies require it, with Moraph operating it under logged administrative access.

On-premises

Kiteworks installed in your data center, with Moraph operating it remotely under your access controls.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Discovery

We map how each team collects and sends client documents today, and agree folder structure, teams and policies. We need a contact in each team and your records retention schedule.

Licensing and hosting

Moraph supplies Kiteworks licences as a reseller under Kiteworks' terms and agrees the hosting arrangement and region with you.

Policy configuration

Retention, sharing, expiry and recipient verification policies are configured and approved by your compliance officer.

Integrations

Identity provider, email add-in, scanning, data loss prevention and log forwarding are connected and tested.

Pilot and rollout

A pilot team uses the service with real clients, then teams are rolled out in turn, with client-facing guidance in your firm's name.

Training and handover

Staff are trained on requests and sharing, your help desk on first-line support, and monitoring and the monthly service review begin.

Limitations

What it does not do

Worth knowing before you evaluate it.

Moraph is not Kiteworks. The platform belongs to Kiteworks, and Kiteworks' own service commitments, roadmap and outages apply to it.
Licences are subject to Kiteworks' terms, including how users and storage are counted.
It replaces email for sensitive documents only if staff and clients use it. Your firm decides whether to require it and how to tell clients.
Once a recipient downloads a file, Kiteworks cannot control what they do with their copy. View-only sharing reduces this but cannot stop screenshots.
It is not a tax preparation, document management or client portal system. Documents can be passed to those systems, but they are separate.
Retention periods, sharing rules and legal holds are your firm's decisions; Moraph implements and reports on them.
Malware and data loss prevention checks reduce risk but cannot detect every harmful or sensitive file.
Moraph supports your compliance with GLBA, Section 7216 and other requirements but does not determine whether your firm meets them.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

Send a test upload request to a colleague acting as a client and follow it through to the client folder
Check that a share expires and can no longer be opened
Ask a team manager to grant and remove folder access and review the log
Confirm retention rules match your records schedule for each folder type
Review a sample monthly service review and access review
Confirm in the responsibilities table which tasks stay with your firm

Questions

Frequently asked questions

Do clients need an account?

No. Clients receive a link for each upload request or share and verify their identity in the way your policy requires, such as a one-time code.

Who owns the documents?

Your firm does. Where they are hosted and how they are returned and deleted at the end of the agreement are set out in the contract.

Can Moraph staff see our clients' files?

Not routinely. Moraph engineers administer the platform without opening client files. If support ever needs it, access is requested with a reason, approved by your firm and logged.

How is it priced?

Kiteworks licences are priced under Kiteworks' terms, and Moraph's managed service is a subscription based on users and the deployment chosen, with implementation charged separately. See Working with Moraph for what drives a quotation.

Can staff send files from their email client?

Yes. An email add-in lets staff send upload requests and secure shares without leaving their email; the files stay in Kiteworks.

Is there an accessibility conformance report?

Ask through the procurement request form at /how-to-buy/request, naming the platform and version you are evaluating, and we will obtain Kiteworks' current report for you.

Next steps

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Secure File Transfer guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Secure File Transfer support guide.

Secure File Transfer

What you are buying

The problem it solves

Who uses it

Requirements it supports

Who is responsible for what

A short walkthrough

The onboarding tracker

The configuration baseline review

A change request

Alert triage

The monthly service review

The access review

The principal workflows

Request

Share

Retain and dispose

Operate and review

Who does what in the product

Client or external recipient

Sees

Does

Cannot

Staff member

Sees

Does

Cannot

Team manager

Sees

Does

Cannot

Service owner

Sees

Does

Cannot

Compliance officer

Sees

Does

Cannot

Moraph service engineer

Sees

Does

Cannot

Auditor or examiner (read-only)

Sees

Does

Cannot

Permissions at a glance

How access is controlled

What it does

Secure upload requests

Client folders

Secure sending

Recipient verification

Email client add-in

File scanning

Encryption

Retention and disposal

Activity logging

Branding

Managed operation

Access reviews

How it connects to your systems

How your data is protected

Single sign-on

Role-based access

Encryption and keys

Complete audit trail

No routine access to client files

Data residency

What you can report on

Activity

Upload requests and responses

External sharing

File activity log

Policy and compliance

Retention and disposal

Sharing exceptions

Files flagged by scanning

Access