Security, data and compliance in CRM for Finance

How CRM for Finance protects data and supports your compliance obligations.

Security controls

Keys outside Salesforce

Key material for Shield Platform Encryption is generated and held in Moraph's key service, and Salesforce holds it only in cache.

Dual control and your approval

Moraph staff cannot use key material without your explicit, time-bound authorization and a second operator; every key action is logged.

Single sign-on

Staff sign in through your identity provider, so your password, MFA and leaver policies apply.

Role-based access

What each person sees follows their profile, permission sets and sharing rules; Moraph's engineers and key operators have separate, limited roles.

Complete audit trail

Configuration changes, deployments and key actions are recorded with the person, approval and time, and Salesforce's setup audit trail records administrator changes.

Key service hosting

Moraph's key service runs in the region you choose: the United States, the United Kingdom or Australia, and is covered by Moraph's SOC 2 Type II and ISO/IEC 27001 audits.

Requirements it supports

• Gramm-Leach-Bliley Act and Regulation P (12 CFR Part 1016)
• Interagency Guidelines Establishing Information Security Standards
• Interagency Guidance on Third-Party Relationships: Risk Management (2023)
• SEC Regulation S-P (17 CFR Part 248, Subpart A), for broker-dealers and investment advisers
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.15 on encryption
• FTC Safeguards Rule (16 CFR Part 314), for non-bank financial institutions

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• New org through Moraph: Moraph resells Financial Services Cloud and Shield and builds a new org, with key material held in Moraph's key service.
• Your existing org: If you already use Salesforce, Moraph reviews the org, adds Shield encryption with Moraph-held keys where you license it, and takes over operation.
• Client-held keys: If your policy requires your institution to hold key material itself, Moraph can run the org while you operate the key service, with the split written into the responsibilities.

Limitations

• Moraph is not Salesforce. Salesforce operates the platform, and Salesforce's own service commitments, roadmap, maintenance and outages apply.
• Licences are subject to Salesforce's terms. Shield Platform Encryption, Event Monitoring and Field Audit Trail are add-ons that need their own licences.
• Shield encrypts data at rest. Users your access model allows to see a field see it in clear; encryption does not replace good permissions.
• Encrypting a field limits some Salesforce functions on it, such as certain search, sort, filter and formula uses, as Salesforce documents. These are reviewed during design.
• If the key service cannot be reached and cached key material has expired, encrypted data cannot be read until it is restored. Destroyed key material makes the data it protected unrecoverable.
• Salesforce briefly holds key material in cache while using it; holding keys outside Salesforce controls storage and revocation, not every moment of use.
• Moraph does not decide what data your institution collects or keeps; data classification, retention and privacy decisions are yours.
• Not every field type and file can be encrypted with Shield. The encryption scope is limited to what Salesforce supports.