Security, data and compliance in Data Loss Prevention

How Data Loss Prevention protects data and supports your compliance obligations.

Security controls

Single sign-on

Your reviewers sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Configuring policies, triaging incidents and seeing evidence are separate roles, granted only as you approve.

Encryption and keys

Incident data held by the service is encrypted, and Moraph staff cannot reach it without your explicit, time-bound authorization.

Complete audit trail

Every policy change, incident decision and evidence view is logged with the person and time, and cannot be edited.

Tested changes

Moraph's own configuration tooling and scripts pass security testing gates before release, and a software bill of materials is kept for them.

Data residency

Incident data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Gramm-Leach-Bliley Act Safeguards (Interagency Guidelines Establishing Information Security Standards; FTC Safeguards Rule, 16 CFR Part 314)
• SEC Regulation S-P (17 CFR Part 248), including its incident response and customer notification requirements
• Payment Card Industry Data Security Standard (PCI DSS) v4.0, where cardholder data is handled
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
• FFIEC IT Examination Handbook: Information Security
• State data breach notification laws

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Forcepoint-hosted components: Where you use Forcepoint's hosted options, Moraph configures and runs them; Forcepoint operates the hosting.
• Components on your infrastructure: Management and network components installed in your data center or cloud account, operated by Moraph under the service agreement.
• Existing deployment: Where you already own Forcepoint, Moraph takes over its operation and tuning without a fresh installation.
• With other Moraph services: Run alongside Moraph's Mobile Device Management, Secure File Transfer or Public Cloud Infrastructure services.

Limitations

• Moraph is not Forcepoint. Forcepoint's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to Forcepoint's licence terms.
• DLP reduces the chance of sensitive data leaving; it cannot stop every route, such as photographs of a screen or data typed out by hand.
• Policies are only enforced on endpoints with a working agent and on network traffic routed through the inspection points.
• Encrypted or password-protected files may not be inspectable; how they are treated is a policy decision you make.
• Decisions about staff conduct, breach determination and customer or regulator notification remain with your organization.
• Mobile devices and cloud applications are outside this service unless covered by separate policy or another Moraph service.
• Moraph supports your PCI DSS and other assessments with evidence; it does not certify your environment.