Security, data and compliance in Disaster Response Logistics Coordinator

How Disaster Response Logistics Coordinator protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply; partners and volunteers use separate, verified accounts.

Role-based access

Each person sees the sites, requests and records their role and agency allow; a partner sees only its own shelters and requests.

Protected personal information

Shelter residents' and volunteers' personal details are kept out of the shared operating picture and visible only to the roles that need them.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every request, approval, status change and export is logged with the person and time, and cannot be edited.

US hosting

Hosted in Moraph's United States region, under the controls covered by Moraph's SOC 2 Type II report and ISO/IEC 27001 certification.

Requirements it supports

• Robert T. Stafford Disaster Relief and Emergency Assistance Act (42 U.S.C. 5121 et seq.)
• National Incident Management System (NIMS) and the Incident Command System
• FEMA Public Assistance Program and Policy Guide
• Uniform Guidance for federal awards (2 CFR Part 200)
• ADA Title II (28 CFR Part 35), including accessibility of emergency shelters
• Your state emergency management statutes and local emergency operations plan

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted by Moraph in the United States region.
• Dedicated environment: Single-tenant hosting for jurisdictions whose policies require it, scoped in the proposal.
• Regional use: One instance shared by a county and its cities, or by a regional emergency management partnership, with each jurisdiction's data and approvals kept separate.
• With a managed service: Optionally run with a Moraph managed service for configuration between events and administration support during activations.

Limitations

• The Coordinator is not a computer-aided dispatch system and does not dispatch fire, police or EMS units.
• It does not send public alerts itself. Messages go through your emergency notification system after your staff approve them.
• It does not submit Public Assistance applications or project worksheets to FEMA or the state. It produces the documentation your staff use to prepare them.
• It needs connectivity. Field users can work through short connection drops, but sites without any connection must report by other means and staff enter the data later.
• Status is only as current as the reports shelter managers, partners and field staff enter.
• It does not register disaster survivors for individual assistance or case management.
• Response decisions, priorities and approvals are made by your staff under your incident command structure; the Coordinator records them.
• Following NIMS structure in the product does not establish NIMS compliance for your jurisdiction, which depends on your plans, training and exercises.