Security, data and compliance in Email Security

How Email Security protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Changing policies, triaging messages and seeing message content are separate roles, granted only as you approve.

Business associate agreement

Because email can contain PHI, Moraph signs a business associate agreement with you; your agreement with Proofpoint covers its own handling.

Encryption and keys

Incident records held by Moraph are encrypted, and Moraph staff cannot reach them without your explicit, time-bound authorization.

Complete audit trail

Every policy change, removal, release and content view is logged with the person and time, and cannot be edited.

Data residency

Records Moraph keeps stay in the hosting region you choose: the United States, the United Kingdom or Australia. Proofpoint's data locations follow its own terms.

Requirements it supports

• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA Breach Notification Rule (45 CFR 164.400-414)
• HITECH Act
• Health Industry Cybersecurity Practices (HICP), Section 405(d) of the Cybersecurity Act of 2015
• HHS Healthcare and Public Health Cybersecurity Performance Goals
• NIST SP 800-177 Rev. 1, Trustworthy Email

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Proofpoint cloud service: Proofpoint operates the email security service in its cloud; Moraph configures and runs it for you.
• Existing deployment: Where you already own Proofpoint, Moraph takes over its operation and tuning without a fresh setup.
• With other Moraph services: Run alongside Moraph's Secure Messaging, Cloud Content or Identity Governance services.

Limitations

• Moraph is not Proofpoint. Proofpoint's own service commitments, support terms, roadmap and outages apply to the platform, and Moraph cannot change them.
• Licences bought through Moraph remain subject to Proofpoint's licence terms, and some features described here depend on the modules you license.
• No email filter stops every phishing or impersonation message. Staff awareness and a verification procedure for payment and banking changes are still needed, and those procedures belong to your organization.
• Removal after delivery depends on the permissions your mail system grants and on messages still being in mailboxes Proofpoint can reach.
• Moraph does not run your mail system or DNS; changes there are made by your administrators.
• Breach determination and any notification to patients, HHS or the media remain your organization's decisions.
• Security awareness training and simulated phishing are not included unless added to the scope.
• Moraph supports your HIPAA risk analysis and audits with evidence; it does not certify your compliance.