Security, data and compliance in Board Governance & Packet Portal

How Board Governance & Packet Portal protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff and directors sign in through your identity provider, or through invited accounts with multi-factor authentication where directors have no institution identity.

Role-based access

Each person sees only the meetings, committees and items they are entitled to, and recused directors are excluded from the related material.

Reading room controls

Download, print and offline settings are enforced per document, watermarks name the reader, and cached copies can be removed remotely.

Encryption and keys

Client data is encrypted, including copies cached on devices, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every publication, view, vote, approval and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Federal Reserve Supervisory Guidance on Board of Directors' Effectiveness (SR 21-3)
• Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 Appendix B; 12 CFR Part 748 Appendix A for credit unions)
• FDIC Annual Independent Audits and Reporting Requirements (12 CFR Part 363)
• NCUA general authorities and duties of federal credit union directors (12 CFR 701.4)
• Sarbanes-Oxley Act Section 301, for public holding companies
• SEC Regulation FD (17 CFR Part 243), for public holding companies

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for institutions outside the US.
• Dedicated environment: A single-tenant environment for institutions whose policies require isolation, scoped in the proposal.
• iPad app: The reader app runs on current iPadOS versions and can be distributed through your mobile device management; directors without an iPad use a web browser.

Limitations

• Reading room controls limit downloading and printing in the portal, but they cannot stop someone photographing a screen. Watermarks and the access record discourage and trace this.
• Directors need a current iPad or web browser. Android tablet and Windows apps are not included; directors on those devices use the browser.
• The portal records votes and consents; whether a vote or consent is valid under your bylaws and state law is a matter for your counsel.
• It is not a full entity management system: subsidiary records, officer appointments and statutory filings are not included.
• Video conferencing is not included; meetings held remotely use your existing conferencing tool alongside the portal.
• Public company disclosure filings are not prepared or filed from the portal.
• Retention of private annotations follows the policy you set; directors should understand that policy before they annotate.