Skip to content

Moraph for clients

Sign in

Moraph account

Security, privacy and compliance with Moraph

Understand how Moraph protects client data, what is independently audited and what is only mapped, how to get evidence, and which compliance obligations stay with your organization.

Foundation2 hr 26 min14 lessonsFor Users, Administrators, Implementation partners, Support teamsCertificate of completion

Lesson plan (printable)

About this course

Regulated organizations choose a technology partner partly on how well it protects their data, and they have to show auditors, examiners and regulators that they checked. This course explains how Moraph protects client data across everything it builds and operates, where that data lives, how Moraph uses AI responsibly, and how to get the evidence that backs it up from the Moraph Trust Center at trust.moraph.com.

It also draws a clear line that matters in every audit: what independent auditors have examined, what Moraph only maps its controls to, and what stays your organization's responsibility. The course does not replace your agreement with Moraph. Where anything here differs from your agreement, your agreement applies.

What you’ll be able to do

  • Tell apart what independent auditors have examined at Moraph (SOC 2 Type II and ISO/IEC 27001) and the frameworks Moraph only maps its controls to
  • Explain Moraph's core security practices, including zero trust, encryption keys, release security testing and software bills of materials
  • Describe where client data can be hosted and how residency is set for your organization
  • Explain how Moraph's cleared support lane, responsible AI principles and privacy commitments affect regulated work
  • Request Moraph's security evidence through the Trust Center and handle it correctly
  • Report a vulnerability or a suspected security incident through the right channel
  • Identify the security and compliance obligations that remain with your own organization

Skills you’ll gain

  • Security assurance literacy
  • Data residency and privacy
  • Evidence requests and vendor due diligence
  • Vulnerability and incident reporting
  • Shared responsibility for compliance

Before you start

  • You have completed Moraph foundations, or you already know which Moraph services your organization uses
  • You can open trust.moraph.com in a web browser
  • You know who in your organization is responsible for security, privacy or compliance
  • Recommended first: Moraph foundations: technology for high-stakes work

Syllabus

3 modules · 9 readings · 1 practical exercise · 4 assessments

  1. Module 1How Moraph protects data

    1. Reading: What is audited and what is mappedReading · 10 min
    2. Reading: Moraph's security practicesReading · 12 min
    3. Reading: Data residency and where your data livesReading · 10 min
    4. Assessment: Module 1 knowledge checkAssessment · 6 min

  2. Module 2Regulated work, AI and privacy

    1. Reading: Regulated clients and the cleared support laneReading · 10 min
    2. Reading: Responsible AI: AI proposes, people decideReading · 10 min
    3. Reading: Privacy and subprocessorsReading · 9 min
    4. Assessment: Module 2 knowledge checkAssessment · 6 min

  3. Module 3Evidence, disclosure and your obligations

    1. Reading: Requesting the evidence packReading · 12 min
    2. Reading: Reporting vulnerabilities and security concernsReading · 9 min
    3. Reading: Your organization's obligationsReading · 11 min
    4. Practical exercise: Practical: prepare a vendor security reviewPractical exercise · 15 min
    5. Assessment: Module 3 knowledge checkAssessment · 6 min
    6. Assessment: Final assessmentAssessment · 20 min

What completion gives you

Complete every lesson and pass each assessment to complete the course. You then get a completion record in My learning, and a certificate of completion you can print or share, with a code anyone can check at academy.moraph.com/verify.

Completion is not certification

Course completion records and certificates of completion show that a person completed a Moraph Academy course. They are not a Moraph certification (which needs the certification exam), a professional license or an accreditation, and they do not authorize anyone to configure, operate, resell or support Moraph products on Moraph’s or anyone else’s behalf.

Course updates

  • Version 1 · · First version.