Reference
Security, data and compliance in Diplomatic Cable Archive & Search
Security controls, supported requirements, hosting and limitations of Diplomatic Cable Archive & Search.
Applies to Diplomatic Cable Archive & Search as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.
On this page
How Diplomatic Cable Archive & Search protects data and supports your compliance obligations.
Security controls
US hosting and agency environments
Unclassified and CUI holdings are hosted in the United States region. Classified holdings are deployed in your agency's own environment and operated under your agency's authority.
Cleared support lane
Support tickets from federal clients are handled only by US citizens with active security clearances.
Access checked per document
Clearance, caveats and need to know are checked for every document before it is returned, counted or suggested.
Encryption under controlled keys
Client data is encrypted with keys Moraph staff cannot access without explicit, time-bound authorization.
Complete audit trail
Every search, view, summary, export and access change is recorded with the person and time, and cannot be edited.
AI proposes, people decide
Summaries and suggestions are labeled as machine-generated and cite their sources; they never change markings, access or records.
Requirements it supports
- Executive Order 13526, Classified National Security Information
- Classified national security information directive (32 CFR Part 2001)
- Controlled Unclassified Information program (32 CFR Part 2002)
- Federal Records Act (44 U.S.C. Chapter 31) and NARA records management regulations (36 CFR Chapter XII, Subchapter B)
- Freedom of Information Act (5 U.S.C. 552)
- Privacy Act of 1974 (5 U.S.C. 552a)
The product supports these requirements; meeting them remains your organization's responsibility.
Where it runs
- Moraph cloud, United States: For unclassified and CUI holdings, hosted and operated by Moraph in the United States region.
- Dedicated environment: A single-tenant environment for agencies that require isolation, scoped in the proposal.
- Agency environment: For classified holdings, the software is deployed in your agency's own accredited environment and operated under your agency's authority, with support from cleared Moraph staff as your procedures allow.
Limitations
- Moraph holds no FedRAMP authorization and no accreditation for classified systems. We map controls and provide documentation to support your agency's own authorization decisions.
- Classified holdings are not hosted in Moraph's cloud. They are handled only in your agency's environment, under your authority.
- Access control is only as accurate as the markings on documents and the clearance data from your personnel security source. Documents with missing or inconsistent markings are held until reviewed.
- It does not classify, declassify or downgrade anything. It records decisions made by your authorized officials.
- Summaries and suggested related documents are machine-generated and can be incomplete or wrong. Users must check them against the cited sources.
- Search quality on older scanned holdings depends on scan quality; low-confidence text is flagged and may need rescanning.
- It is not a cable drafting or transmission system, and it does not replace your official records system of record.
- Search is in the languages your holdings are indexed for during implementation; translation is not included.
Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in the Moraph Trust Center, where you can request the evidence pack.
Was this page helpful?
Report a problem with this page
Need help with your own setup rather than this page? Raise a support ticket.