Security, data and compliance in Alt-Invest Compliance & Checkout Portal

How Alt-Invest Compliance & Checkout Portal protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff sign in through your identity provider, so your password and multi-factor policies apply.

Investor accounts with multi-factor authentication

Investors and their representatives sign in with their own accounts and multi-factor authentication, and see only the subscriptions they are part of.

Role-based access

What each person can see and do follows their role; accepting an investor's status is separate from collecting the evidence.

Encryption and keys

Client and investor data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, decision, signature and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Regulation D (17 CFR 230.500 to 230.508)
• Rule 506(c) accredited investor verification (17 CFR 230.506(c)(2)(ii))
• Rule 506(d) bad actor disqualification
• Form D notice of exempt offering (17 CFR 239.500)
• Investment Company Act of 1940 Sections 3(c)(1) and 3(c)(7)
• OFAC sanctions regulations (31 CFR Chapter V)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for managers outside the US.
• Dedicated environment: A single-tenant environment for managers whose policies require isolation, scoped in the proposal.
• Branded investor portal: The investor-facing pages carry your firm's name and branding on a domain you choose.

Limitations

• The portal does not decide whether an investor is accredited or a qualified purchaser. Your compliance team reviews the evidence and makes that decision, and the portal records it.
• It does not file Form D or state notice filings. It assembles the data, and your team or counsel submits filings through EDGAR and the relevant state systems.
• Moraph does not hold, receive or move investor funds. Capital is wired to the fund's own bank account, and receipt is confirmed by your administrator.
• It is not a sanctions screening engine. It sends investor details to the screening provider you choose and records the results.
• Subscription documents and questions are your counsel's. Moraph converts them into the online form but does not give legal advice on their content.
• It is designed for US private placements under Regulation D. Offerings under Regulation S or other countries' private placement rules need separate configuration and review by your counsel.
• It does not maintain the fund's investor register or capital accounts after the close; that stays with your administrator.
• Ongoing investor reporting, capital calls after the initial closing and distributions are not included.