Trust Center
Security, sovereignty and audit evidence, built in from the start
Our clients answer to examiners, inspectors general and data protection authorities. Everything we build and operate is designed so they can prove control, not just claim it.
Data residency & sovereignty
Your data stays in your jurisdiction
Sensitive workloads run on our private cloud inside Tier 4-certified colocation facilities, connected to public cloud over private fiber. We can tell a regulator exactly which rack, in which country, holds your data, and that it never crosses the public internet.
United StatesSwitch
Primary US footprint for FedRAMP, HIPAA and SEC-regulated workloads, running on 100% renewable energy.
United KingdomArk Data Centres
UK sovereign hosting for GDPR, UK banking and DORA requirements, with physical failover independent of public cloud.
AustraliaNextDC
Sydney hosting so Australian banks and super funds meet APRA CPS 234 and the Privacy Act without data leaving the country.
Public cloud (AWS, Azure, GCP) is used for scalable, less sensitive workloads and peak demand, under the same policy-as-code controls.
Security architecture
Identity is the perimeter
Zero trust, everywhere
Every person and service is authenticated and authorized for each request. The same controls cover all 1,250 people who touch our code or data, whoever pays them.
Keys we can't casually use
Client data is encrypted with keys our staff cannot access without explicit, time-bound authorization. For managed platforms, we can hold encryption keys so the platform vendor cannot.
Secure by construction
Static and dynamic security testing gate every release. A software bill of materials is maintained for every product, and vulnerable or restrictively licensed components are blocked from the build.
Managed endpoints
Every laptop and phone used for Moraph work is encrypted and centrally managed, from New York to Manila.
Cleared support lane
Tickets from Federal and Defense clients are routed only to US citizens with active security clearances. No foreign national sees sensitive government logs.
Fourth-party risk
We continuously monitor the security posture of our own sub-processors and trigger reviews automatically when a score drops.
Resilience & incident response
Built for the day something goes wrong
Follow-the-sun operations
Tier 1 and 2 teams in Manila and Mumbai cover the US night, with a target first response under 15 minutes for critical issues. Tier 3 engineering escalates to core teams in New York, London and Sydney.
Crisis protocol
In a major incident we open an executive bridge with our CISO, Head of Engineering and your executive sponsor, and provide timestamped log exports to support your forensic and legal teams.
Frameworks
Frameworks we build and operate against
Controls are mapped to the frameworks our clients answer to and evidenced continuously. Current reports, attestations and authorization letters are shared under NDA in our evidence pack.
- SOC 2 Type IISecurity, availability and confidentiality controls across our platforms.
- ISO 27001Information security management system.
- FedRAMP HighManaged landing zones and products built for federal authorization.
- DoD IL5 / IL6Cleared administration for classified collaboration environments.
- HIPAA / HITRUSTBAA-backed environments for protected health information.
- CJISMicrosoft 365 GCC configured for criminal justice data.
- GLBA / FFIECAuthentication, data protection and exam-ready evidence for banks.
- SEC 17a-4 / FINRAWORM archiving and supervision for broker-dealers.
- SR 11-7Champion/challenger validation for every production financial model.
- GDPR / UK GDPRData residency and privacy engineering for UK and EU clients.
- DORAOperational resilience and exit planning for EU financial entities.
- APRA CPS 234Australian data that stays in Australia.
Responsible AI
AI that can explain itself to a regulator
Human in the loop
Clinical AI proposes; a credentialed provider decides. Generative features are grounded only in the client's own verified documents to prevent fabricated answers.
Fair and validated models
Lending models are tested for disparate impact before release and come with explainability reports. Every production financial model runs 30 days in shadow mode before it replaces the current one.
Privacy
We monetize software, not data
We never sell or monetize client data. Patient, citizen and member records are processed only to deliver the service, under the controls described above.
Evidence pack
Request our security evidence
Tell us what your vendor-risk or procurement team needs. We typically share SOC reports, penetration test summaries, policies, data-flow diagrams and completed questionnaires (SIG, CAIQ, HECVAT) under NDA.
Responsible disclosure
Found a vulnerability?
Please report it to security@moraph.com. We acknowledge reports promptly, will not pursue good-faith research, and credit researchers who want it. Our security.txt has the details.