Security, data and compliance in Database Security

How Database Security protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff sign in to the Imperva console and Moraph's service portal through your identity provider, so your password and multi-factor policies apply.

Role-based access

Who can view audit data, change policies or see captured query values follows their role, and database administrators do not administer the monitoring of their own activity.

Sensitive values masked

Imperva can mask sensitive values captured in queries and results, so reviewers see the activity without seeing customer data where it is not needed.

Moraph staff access

Moraph engineers work through role-based access you approve, and cannot use keys to your data without explicit, time-bound authorization.

Complete audit trail

Changes to Imperva policies and settings are logged, and Moraph's service portal records every change request, approval and triage decision.

Audited operations

Moraph is SOC 2 Type II and ISO/IEC 27001 audited company-wide, and its service records are hosted in the United States, United Kingdom or Australia region you choose.

Requirements it supports

• Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
• FTC Safeguards Rule under the Gramm-Leach-Bliley Act (16 CFR Part 314)
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
• SEC Regulation S-P (17 CFR Part 248), including its incident response program requirements
• PCI DSS v4.0 Requirement 10 (logging and monitoring access to cardholder data)
• Sarbanes-Oxley Act Section 404 (internal control over financial reporting)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Agents in your environment: Imperva agents on database servers and management components in your data center or cloud account, operated by Moraph.
• Network gateways: Gateways on the network path to databases where installing agents is not possible, with the coverage trade-offs documented.
• Existing Imperva estate: If you already own Imperva, Moraph can take over operations after a baseline review of coverage and policies.

Limitations

• Moraph is not Imperva. Moraph resells, implements and operates the platform; Imperva develops it and is responsible for its software and any services it hosts.
• Imperva's own service commitments, product roadmap and any outages of its services apply. Moraph does not change them.
• Licences are subject to Imperva's terms, which you accept as part of the purchase.
• Monitoring covers the databases and platforms Imperva supports and where agents or gateways are deployed. Databases outside that coverage are reported as gaps.
• Alerting detects activity as it is captured; it does not by itself stop an extraction. Blocking is available only for policies you approve and can affect legitimate activity if set too broadly.
• Moraph triages alerts but does not replace your security operations center, and does not decide whether an event is a reportable incident.
• Encrypted database connections may need additional configuration for activity to be captured, depending on the method used.
• Audit data retention is limited by the storage you provide or license.