Trust Center ยท Mobile security
A phone should never be the way into regulated data
Moraph staff and contractors use phones and tablets to reach client systems at banks, health systems and government agencies. A single hacked phone could become a way into regulated data. Some of our government work also happens at air-gapped and high-security sites, where security tools have to keep working with no internet connection. This page explains how each kind of device is protected.
At a glance
Each kind of device, and what protects it
| Device | Used by | How it is protected |
|---|---|---|
| Shared iPhones and iPads | Hourly staff, who pass them between shifts | Managed with Jamf Pro. Each device resets to the same approved setup for each new user. |
| MacBooks | Moraph staff | Managed with Jamf Pro. |
| Staff-owned and contractor phones | Staff and contractors | iVerify Enterprise mobile EDR, which watches for exploit and spyware activity without Moraph managing the whole phone. |
| Mobile devices at air-gapped and high-security sites | Our government practice | Zimperium Mobile Threat Defense with Mobile Phishing Protection, detecting threats on the device with its management console on site. |
Moraph-owned Apple devices
Shared devices that start clean for every shift
Shared iPhones and iPads
Our hourly staff pass shared iPhones and iPads between shifts. Jamf Pro resets each one to the same approved setup for each new user, so the next person starts from the approved setup, not from the previous person's session.
MacBooks
Jamf Pro also manages our MacBooks.
Staff-owned and contractor phones
Mobile EDR on phones we don't own
Mobile EDR (endpoint detection and response) is software that watches a phone for signs of hacking. iVerify Enterprise is our mobile EDR for staff-owned and contractor phones, rolled out in 2026.
What it sees
iVerify looks for exploit and spyware activity deep in a phone's operating system.
Why not full device management
It does this without Moraph having to manage the whole device. That matters on phones Moraph doesn't own.
Air-gapped and high-security sites
Protection that keeps working with no connection
Zimperium has protected our government practice since 2021. We run its Mobile Threat Defense, with Mobile Phishing Protection, on devices used at air-gapped and high-security sites.
Detection on the device
Threats are detected on the phone itself, with no cloud connection needed.
Console on site
The management console runs entirely on site, so threat data stays inside the secure environment.
Works disconnected
Protection keeps working at locations with no internet connection.
Software for classified and disconnected networks is covered on Defense & Intelligence.
Limits
What this page does and doesn't cover
- This page covers the devices Moraph people use to reach client systems. It does not describe a product or service Moraph sells.
- Mobile security lowers the chance that a compromised phone reaches client data. No tool removes that risk entirely.
- On staff-owned and contractor phones, Moraph runs mobile EDR but does not manage the whole device.
Questions
Frequently asked questions
Does Moraph manage the personal phones its staff and contractors use?
Not the whole device. Staff-owned and contractor phones run iVerify Enterprise, which watches for exploit and spyware activity without full device management.
Does the protection at air-gapped sites need an internet connection?
No. Zimperium detects threats on the device, its console runs on site and threat data stays inside the secure environment.
What happens to a shared device between shifts?
Jamf Pro resets it to the same approved setup for the next user.
How do we ask about mobile controls for a vendor-risk review?
Request the evidence pack and name the controls you need to review.