Security, data and compliance in Drone/UAV Flight Log & Maintenance Tracker

How Drone/UAV Flight Log & Maintenance Tracker protects data and supports your compliance obligations.

Security controls

Records kept in the United States

Hosted in the United States region only, for government clients.

Cleared support lane

Support tickets from federal and defense clients are handled only by US citizens with active security clearances.

Single sign-on and role-based access

Staff sign in through your identity provider, and what each person can see and do follows their role and unit.

Encryption under controlled keys

Client data is encrypted with keys Moraph staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every log entry, sign-off, release, change and export is recorded with the person and time, and cannot be edited.

Controls mapped for your authorization

Moraph is SOC 2 Type II and ISO/IEC 27001 audited, maps the tracker's controls to NIST SP 800-171 and 800-53, and supports your own authorization process; it does not hold a DoD authorization of its own.

Requirements it supports

• DoD Directive 5030.61, DoD Airworthiness Policy
• Public aircraft operations (49 U.S.C. 40102(a)(41) and 40125)
• 14 CFR Part 107, Small Unmanned Aircraft Systems
• American Security Drone Act of 2023 (FY2024 National Defense Authorization Act)
• DoD Instruction 5200.48, Controlled Unclassified Information (CUI)
• NIST SP 800-171, Protecting CUI in Nonfederal Systems

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted and operated by Moraph in the United States region for unclassified data, with controls mapped to support your own authorization.
• Dedicated environment: A single-tenant environment for organizations whose policies require isolation, scoped in the proposal.
• Your environment: Installed in an environment you operate, including disconnected networks, where your authorizing official approves it and it runs under your authority.
• With a managed service: Optionally run alongside a Moraph managed service for administration and integration support, delivered by US citizens with active clearances.

Limitations

• The tracker does not make airworthiness decisions. Grounding, inspection sign-off and return to service are made by qualified people at your organization.
• It does not replace the manufacturer's maintenance data or your service's maintenance program; it applies the intervals and tasks you configure from them.
• Counters are only as accurate as the flights and maintenance recorded. Flights that are not logged or imported are not counted.
• It does not control or connect to aircraft in flight, and is not a flight planning, airspace authorization or mission planning system.
• Ground control station imports depend on the formats your equipment exports; formats are confirmed during implementation.
• It is designed for unclassified records. Use on classified networks is possible only in an environment you operate and authorize.
• It is not your service's official maintenance information system of record unless your service approves it as one; where an official system is required, records are exported to it.
• Moraph does not hold a DoD authorization for the tracker; your authorizing official decides whether and where it may be used.