Security, data and compliance in Communication Archiving

How Communication Archiving protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff and Moraph's staff sign in through identity providers with multi-factor authentication, and access is removed when people leave.

Role-based access

Reviewers see their review groups, legal sees holds and productions, and Moraph's service team sees configuration rather than content.

Logged content access

Every search and export of message content, by your staff or ours, is recorded with the person, time and request it served.

Controlled privileged access

Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. Smarsh's own platform assurance reports are available from Smarsh under its terms.

Data residency

Archive data is held in the Smarsh hosting region selected for your firm, and Moraph's service tooling uses the United States, United Kingdom or Australia region you choose.

Requirements it supports

• SEC Rule 17a-4 (17 CFR 240.17a-4), including the electronic recordkeeping requirements of paragraph (f)
• FINRA Rule 4511 (General Requirements for books and records)
• FINRA Rule 3110 (Supervision), including review of correspondence and internal communications
• Investment Advisers Act Rule 204-2 (17 CFR 275.204-2)
• CFTC Rule 1.31 (17 CFR 1.31) regulatory records
• FINRA Rule 2210 (Communications with the Public)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Smarsh cloud, managed by Moraph: Smarsh hosts the archive; Moraph configures and runs it for you under a managed service agreement.
• Moraph-managed with your existing Smarsh licenses: If you already license Smarsh, Moraph can take over configuration and operations, subject to Smarsh's terms.
• Alongside other Moraph services: Run with Moraph's Voice Recording Compliance, Data Loss Prevention or Mobile Device Management services so channels are governed together.

Limitations

• Moraph is not Smarsh. The platform belongs to Smarsh, and Smarsh's own service commitments, roadmap, maintenance and outages apply to it.
• Licenses are subject to Smarsh's terms, and the channels that can be captured depend on what Smarsh supports and what you license.
• Capture depends on the source systems. If a channel is used on an unmanaged device or an unapproved app, it may not be captured at all.
• Messages that were never captured, for example during a source-side outage, may not be recoverable. Daily checks find gaps; they cannot always fill them.
• Your firm remains responsible for its books-and-records and supervision obligations, including the Rule 17a-4(f) designations and undertakings that apply to you.
• Moraph does not make supervisory decisions. Your reviewers decide whether a message needs action.
• Smarsh's lexicons and policies flag messages for review; they do not find every problem message, and your sampling and review procedures still apply.
• Legal advice on retention periods, holds and disclosures is not part of the service.