Security, data and compliance in 311 Omni-Channel Citizen Intake

How 311 Omni-Channel Citizen Intake protects data and supports your compliance obligations.

Security controls

Resident details protected

Names, phone numbers and emails are shown only to roles that need them, and never on the public map or in open data.

Staff single sign-on

Staff sign in through your identity provider, so your own password and multi-factor policies apply.

Role-based access

Each person sees requests for their department, district or channel, as their role allows.

Encryption and keys

Requests, photos and resident details are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every creation, status change, assignment and view of contact details is logged with the person and time, and cannot be edited.

US hosting

Data for US government clients is hosted only in Moraph's United States region, under the controls covered by Moraph's SOC 2 Type II report and ISO/IEC 27001 certification.

Requirements it supports

• ADA Title II web accessibility rule (28 CFR Part 35, Subpart H)
• WCAG 2.1 Level AA
• Title VI of the Civil Rights Act of 1964 and language access for people with limited English proficiency
• Telephone Consumer Protection Act (47 U.S.C. 227), for text message updates
• State public-records laws
• Your records-retention schedules

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region.
• Dedicated environment: Single-tenant hosting where your policies require it, scoped in the proposal.
• Phased by department: Start with the departments that receive the most requests, such as Public Works and sanitation, and add others in later phases.
• With a managed service: Optionally run with a Moraph managed service for service catalog changes, integration monitoring and platform administration.

Limitations

• It is not a 911 or emergency dispatch system. Emergency calls must continue to go to 911, and the forms tell residents so.
• It is not a telephone system. Calls are handled by your existing phone or contact center platform, which is integrated.
• Status updates depend on departments recording progress. Where a department's own work order system is used, updates arrive as that system reports them.
• Social media monitoring covers posts and messages addressed to your official accounts; it does not scan general public conversation.
• Location validation is only as good as the address and boundary data in your GIS, which your GIS staff maintain.
• Text message updates are sent only to residents who opt in, through a messaging provider under your agreement or Moraph's.
• Duplicate detection suggests likely matches; staff decide whether to link them.
• Translations of forms and messages into additional languages are provided by you or a translation service you choose.