Lesson plan

Security, privacy and compliance with Moraph

Understand how Moraph protects client data, what is independently audited and what is only mapped, how to get evidence, and which compliance obligations stay with your organization.

Back to the course

Product: Moraph account
Level: Foundation
For: Users, Administrators, Implementation partners, Support teams
Total time: 2 hr 26 min
Lessons: 14 in 3 modules
Assessments: 4

Course objectives

Tell apart what independent auditors have examined at Moraph (SOC 2 Type II and ISO/IEC 27001) and the frameworks Moraph only maps its controls to
Explain Moraph's core security practices, including zero trust, encryption keys, release security testing and software bills of materials
Describe where client data can be hosted and how residency is set for your organization
Explain how Moraph's cleared support lane, responsible AI principles and privacy commitments affect regulated work
Request Moraph's security evidence through the Trust Center and handle it correctly
Report a vulnerability or a suspected security incident through the right channel
Identify the security and compliance obligations that remain with your own organization

Before the course

You have completed Moraph foundations, or you already know which Moraph services your organization uses
You can open trust.moraph.com in a web browser
You know who in your organization is responsible for security, privacy or compliance

Module 1: How Moraph protects data (38 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
What is audited and what is mapped	Reading 10 min	Name the two things at Moraph that are independently audited Explain why mapping controls to a framework is not a certification or an authorization Describe an assurance claim accurately in a questionnaire or to an auditor	Reading
Moraph's security practices	Reading 12 min	Explain what zero trust means at Moraph Describe how encryption keys protect client data from casual access, including on managed platforms Explain how security testing and software bills of materials protect each release Describe how Moraph manages endpoints and the security of its own subprocessors	Reading
Data residency and where your data lives	Reading 10 min	Name Moraph's three hosting regions and the regulatory needs each one serves Explain how Moraph's private cloud and public cloud are used Find where your own organization's data is hosted	Reading
Module 1 knowledge check	Assessment 6 min	Check your understanding of Moraph's assurance, security practices and data residency	5 questions · pass mark 70% · unlimited attempts

Module 2: Regulated work, AI and privacy (35 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Regulated clients and the cleared support lane	Reading 10 min	Explain how support for Federal and Defense clients is routed through the cleared support lane Raise a support request for a regulated service without exposing sensitive data Describe what Moraph provides in a major incident and where service commitments are set	Reading
Responsible AI: AI proposes, people decide	Reading 10 min	Explain the human-in-the-loop principle behind Moraph's AI features Describe how generative features are grounded and how models are validated Recognize decisions that must stay with a qualified person at your organization	Reading
Privacy and subprocessors	Reading 9 min	State Moraph's privacy commitment for client data Find the privacy policy, data protection terms and subprocessor list that apply to you Keep track of subprocessor changes for your organization's records	Reading
Module 2 knowledge check	Assessment 6 min	Check your understanding of the cleared support lane, responsible AI and privacy at Moraph	5 questions · pass mark 70% · unlimited attempts

Module 3: Evidence, disclosure and your obligations (1 hr 13 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Requesting the evidence pack	Reading 12 min	Tell apart public Trust Center documents and confidential ones that need a request Make a complete evidence request, including a security questionnaire Handle confidential evidence correctly once access is approved	Reading
Reporting vulnerabilities and security concerns	Reading 9 min	Choose the right channel for a vulnerability, a security incident or a security question Write a useful vulnerability report Explain what good-faith research means under Moraph's disclosure policy	Reading
Your organization's obligations	Reading 11 min	Explain the shared-responsibility line between Moraph and your organization List the security and compliance tasks that stay with your organization Use a product's Security, data and compliance guide to find its limitations	Reading
Practical: prepare a vendor security review	Practical exercise 15 min	Answer vendor review questions about Moraph accurately, without overstating assurance Plan an evidence request and a responsibility checklist for a regulated service	Practical exercise with a checklist
Module 3 knowledge check	Assessment 6 min	Check your understanding of evidence requests, vulnerability reporting and your organization's obligations	5 questions · pass mark 70% · unlimited attempts
Final assessment	Assessment 20 min	Show that you can apply the whole course to realistic security, privacy and compliance situations	12 of 18 questions · pass mark 80% · 3 attempts

Completing the course

Every lesson must be completed: reading lessons are marked complete by the learner, exercises when every checklist item is confirmed, and assessments only when passed. Completing the course issues a certificate of completion with a verification code.