Security, data and compliance in Dynamic Collateral Monitor

How Dynamic Collateral Monitor protects data and supports your compliance obligations.

Security controls

Single sign-on

Lender staff sign in through your identity provider, so your password and multi-factor policies apply.

Read-only, borrower-authorized connections

ERP connections are authorized by the borrower, limited to the records the monitor needs, and can be revoked by the borrower or the lender at any time.

Role-based access

What each person can see and do follows their role; recommending availability is separate from approving it, and borrowers see only their own company.

Encryption and keys

Client and borrower data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every data pull, view, change, decision and export is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• OCC Comptroller's Handbook: Asset-Based Lending
• Uniform Commercial Code Article 9 (secured transactions)
• Interagency Guidelines Establishing Standards for Safety and Soundness (12 CFR Part 30, Appendix A)
• Interagency Guidance on Third-Party Relationships: Risk Management (2023)
• Federal Reserve Commercial Bank Examination Manual, asset-based lending section

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for lenders outside the US.
• Dedicated environment: A single-tenant environment for lenders whose policies require isolation, scoped in the proposal.
• Branded borrower workspace: The borrower-facing pages carry your institution's name and branding.

Limitations

• The monitor does not prove that a receivable is genuine. It compares reported figures with the borrower's own records and flags patterns worth checking; a borrower who falsifies its ledger can still mislead it, so field exams and debtor verifications remain necessary.
• It needs the borrower's authorization and cooperation. If a borrower will not connect its system or provide exports, the monitor works only from the certificates and backup supplied.
• Connections to systems other than NetSuite depend on the system and the borrower's edition; some will need a scheduled export instead of a live connection.
• It does not decide availability or declare a default. Credit officers approve availability, reserves and exceptions under your credit policy.
• It covers accounts receivable. Inventory, equipment and other collateral classes are recorded as reported but not reconciled to source systems.
• It is not a loan servicing system. Advances, payments and interest stay in your loan system.
• It does not perform UCC lien searches or filings.
• Debtor verification responses depend on account debtors replying; the monitor records requests and responses but cannot compel an answer.