Security, data and compliance in Construction Loan Draw Management

How Construction Loan Draw Management protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply. Inspectors and borrowers use invited accounts with multi-factor authentication.

Role-based access

What each person can see and do follows their role; preparing a draw is separate from approving it, and borrowers see only their own loans.

Evidence integrity

Inspection photos keep their capture location and time, and a submitted inspection cannot be edited; corrections are recorded as new entries.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, approval and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Interagency Guidelines for Real Estate Lending Policies (12 CFR Part 34 Subpart D, 12 CFR Part 365, 12 CFR Part 208 Appendix C)
• Interagency Appraisal and Evaluation Guidelines (2010)
• Interagency Guidance on Concentrations in Commercial Real Estate Lending (2006)
• OCC Comptroller's Handbook: Commercial Real Estate Lending
• NCUA Member Business Loans; Commercial Lending (12 CFR Part 723)
• Truth in Lending Act and Regulation Z (12 CFR Part 1026), for consumer construction loans

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for institutions outside the US.
• Dedicated environment: A single-tenant environment for institutions whose policies require isolation, scoped in the proposal.
• Mobile app: The inspection app runs on current iOS and Android phones and tablets, and can be distributed through your mobile device management.

Limitations

• The product does not hold, move or disburse funds. Approved draws are passed to your loan or payment system, and your staff release the money.
• Location and time come from the inspector's device. They are strong evidence that photos were taken on site, but they do not replace the inspector's professional judgment or your own controls over who inspects.
• It does not perform appraisals or evaluations, and percentage complete is the inspector's assessment, not a valuation.
• It is not a loan origination or servicing system; loan terms, interest and payments stay in your existing systems.
• Title searches and lien waivers are provided by the borrower and title company; the product tracks them as conditions but does not obtain them.
• It is designed for US construction lending practice. Lending in other countries may need different conditions and documents.
• Approval decisions remain your institution's; the product records and routes them but does not approve draws on its own.