Security, data and compliance in Cloud Contact Center

How Cloud Contact Center protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in to Five9 through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person at your organization and at Moraph can see and do follows their role; requesting a change is separate from approving it, and recording access is limited to the roles you approve.

Business associate agreement

Calls, recordings and caller details contain protected health information, so Moraph works under a business associate agreement with you; Five9's own terms for handling it also apply.

Complete audit trail

Five9 records administrator and user activity, and Moraph's change record links each change and each recording access by Moraph staff to its request.

Encryption and keys

Service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service. Five9's own attestations cover the platform.

Requirements it supports

• HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• Telephone Consumer Protection Act (47 U.S.C. 227) and FCC rules (47 CFR 64.1200)
• Section 1557 of the Affordable Care Act, language assistance (45 CFR Part 92)
• Electronic Communications Privacy Act (18 U.S.C. 2511) and state call-recording consent laws

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Licences through Moraph: Moraph resells the Five9 subscription and runs the environment as one service, subject to Five9's terms.
• Your existing Five9 environment: If you already license Five9, Moraph reviews the current configuration against a new baseline and takes over its operation.
• Co-managed: Your team keeps some tasks, such as hours changes or user setup, and Moraph runs the rest; the split is written into the responsibilities for the service.

Limitations

• Moraph is not Five9. Five9 operates the platform, and Five9's own service commitments, roadmap, maintenance and outages apply.
• Five9 subscriptions are subject to Five9's terms. Some capabilities, such as workforce management, quality management or virtual agents, need their own licences.
• Moraph does not provide agents or nurses. Your organization staffs the lines, and triage nurses work under your clinical protocols and supervision.
• Moraph does not make clinical decisions, provide triage protocols or give medical advice.
• Integrations depend on what your scheduling, CRM and EHR systems and Five9 support, and on access to those systems; they are scoped during implementation.
• Moraph configures recording, consent and outbound settings with reference to HIPAA and TCPA requirements, but your organization decides the policies and whether the settings are adequate.
• Calls to emergency services are not handled by this service. Lines play the emergency message you approve, directing callers with an emergency to call 911.
• Moraph does not make breach notification or patient complaint decisions on your behalf; escalated issues need a decision from your named approver.