Security, data and compliance in Digital Evidence Management for Local PD

How Digital Evidence Management for Local PD protects data and supports your compliance obligations.

Security controls

Single sign-on and multi-factor

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role, unit and the sensitivity of the case.

Encryption and keys

Evidence is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Chain of custody

Every view, download, clip, share and deletion is logged with the person and time, and cannot be edited.

US hosting

Evidence and criminal justice information are hosted in the United States region only.

CJIS control mapping

Moraph maps its controls to the FBI CJIS Security Policy and supports your agency's own compliance; personnel screening and the security addendum are agreed in the contract.

Requirements it supports

• FBI CJIS Security Policy
• State public records laws, including body-worn camera release provisions (vary by state)
• Brady v. Maryland disclosure obligations and state criminal discovery rules
• Federal Rules of Evidence 901 and state equivalents on authentication
• State law enforcement records retention schedules
• Juvenile record confidentiality laws (vary by state)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region, the only region used for government data.
• Dedicated environment: A single-tenant environment for agencies whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for system connections, migration and administration support.

Limitations

• Redaction proposals are suggestions. Automated detection can miss faces, plates or other details, so a person reviews every release and a second person approves it.
• Release decisions and their legal basis are your agency's. The product records them; your records staff and counsel decide what state law requires.
• It is not a camera system. It imports footage from your body-worn, in-car and interview room systems through their export or upload interfaces, which vary by vendor.
• It is not a records management system. Case data comes from your RMS.
• Moraph does not hold CJIS certification; there is no such certification. Moraph maps its controls to the CJIS Security Policy and supports your agency's compliance and audits.
• Forensic extraction from phones and computers is done with your forensic tools; their outputs can be stored and tracked here.
• Live video streaming and real-time camera monitoring are not included.
• Retention periods come from your schedule and state law; the product applies them but does not set them.