Security, data and compliance in Digital Transaction Management

How Digital Transaction Management protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff sign in through your identity provider, so your password, MFA and leaver policies apply.

Role-based access

What each person can see and do follows their permission profile and group; sending is separate from changing templates and settings.

Complete audit trail

DocuSign's envelope history records signing events, and Moraph's change record links each template and setting change to its request and approval.

Encryption and keys

Service records Moraph holds are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Limited Moraph access

Moraph engineers use named accounts with only the rights they need, and open completed documents only for an authorized support reason.

Audited company-wide

Moraph is audited to SOC 2 Type II and ISO/IEC 27001 across the company, including the teams that run this service. DocuSign's own attestations cover the platform.

Requirements it supports

• Electronic Signatures in Global and National Commerce Act (ESIGN, 15 U.S.C. 7001 et seq.)
• ESIGN consumer consent requirements (15 U.S.C. 7001(c))
• Uniform Electronic Transactions Act (UETA), as adopted by each state
• Regulation Z (12 CFR Part 1026), including TILA-RESPA integrated disclosure timing
• Gramm-Leach-Bliley Act and the Interagency Guidelines Establishing Information Security Standards

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Licences through Moraph: Moraph resells the DocuSign plan and add-ons and runs the account as one service, subject to DocuSign's terms.
• Your existing DocuSign account: If you already use DocuSign, Moraph reviews templates and settings against a new design and takes over operation of the account.
• Co-managed: Your team keeps some administration, such as user management or simple template edits, and Moraph runs the rest; the split is written into the responsibilities.

Limitations

• Moraph is not DocuSign. DocuSign operates the platform, and DocuSign's own service commitments, roadmap, maintenance and outages apply.
• Licences are subject to DocuSign's terms. Features such as ID verification and some connectors need their own plans or add-ons.
• Moraph configures signing to support ESIGN and UETA, but whether a particular record is enforceable is a legal question for your institution and its counsel.
• Some documents and transactions are excluded from ESIGN and UETA or need wet signatures, notarization or other formalities under state law; those are identified with your counsel and kept out of electronic workflows unless permitted.
• Transferable records such as eNotes, and remote online notarization, are outside this service unless scoped separately.
• Disclosure timing under Regulation Z depends on when your loan system generates and sends documents; Moraph configures delivery but does not decide timing.
• Moraph does not write your disclosures or loan documents; their content is your institution's responsibility.
• Records kept only in DocuSign are subject to the retention settings and plan you choose; your system of record should hold completed documents for your full retention period.