Security, data and compliance in API Security & Integration

How API Security & Integration protects data and supports your compliance obligations.

Security controls

Single sign-on

Platform users sign in through your identity provider, so your password and multi-factor policies apply.

Least-privilege partner access

Each partner has its own credentials and scope, approved by your security officer and reviewed periodically.

Controlled administrator access

Moraph engineers use named accounts with role-based access, and production changes require your approval.

Audit trail

Partner approvals, policy changes, deployments and administrator actions are logged with the person and time.

Encryption and keys

Traffic is encrypted in transit, and configuration and service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Tested releases

Every integration change passes automated tests and a security review before release, under Moraph's SOC 2 Type II and ISO/IEC 27001 audited controls.

Requirements it supports

• Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b))
• FTC Safeguards Rule (16 CFR Part 314) for non-bank financial institutions
• FFIEC IT Examination Handbook, Architecture, Infrastructure, and Operations booklet
• FFIEC Authentication and Access to Financial Institution Services and Systems (2021)
• Interagency Guidance on Third-Party Relationships: Risk Management (2023)
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• MuleSoft-hosted runtimes: Integrations run on MuleSoft's hosted runtime in the region your licence provides, operated by Moraph.
• Runtimes in your environment: Where data must stay in your data center or cloud account, runtimes run in your environment and Moraph operates them by agreement.
• Your existing licence: Where you already license MuleSoft, Moraph takes over build and operation, subject to the vendor's terms.

Limitations

• Moraph is not the vendor. MuleSoft owns and operates the Anypoint Platform, and its own service commitments, roadmap and outages apply.
• Licences are subject to MuleSoft's terms, including capacity measures that may limit the number of integrations or the traffic they carry.
• Moraph does not change or operate your core or mainframe systems. Integrations use the interfaces your teams expose and are limited by their capacity.
• Decisions about which data is exposed and which partners may access it are your organization's, as is due diligence on each partner.
• The service is not a replacement for your web application firewall, network security or fraud controls.
• Moraph restores service on the integration layer; failures in core systems, networks or partner systems are resolved by their owners.
• Customer and regulator notifications after an incident remain your organization's responsibility.
• Platform features available depend on the MuleSoft edition and add-ons you license.