Security, data and compliance in Enterprise Mobility

How Enterprise Mobility protects data and supports your compliance obligations.

Security controls

Single sign-on

Your administrators and Moraph's staff sign in to the platform through identity providers with multi-factor authentication, and access is removed when people leave.

Role-based access

Units see their own devices, client IT sees the fleet, and Moraph's service team works on configuration rather than on the content of devices.

Recorded device actions

Every lock, wipe, configuration change and enrollment is recorded with the person, time and request it served.

Controlled privileged access

Moraph staff use administrative access only for approved work, with keys and credentials they cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. The platform vendor's own assurance reports are available from the vendor under its terms.

Business associate agreement

Where the service involves PHI on devices or in the platform, Moraph signs a business associate agreement, and Moraph's service tooling uses the United States region.

Requirements it supports

• HIPAA Security Rule (45 CFR Part 164, Subpart C)
• HIPAA Privacy Rule (45 CFR Part 164, Subpart E)
• HIPAA Breach Notification Rule (45 CFR 164.400 to 164.414)
• NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise
• NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Vendor cloud, managed by Moraph: Jamf or Workspace ONE runs in the vendor's cloud; Moraph configures and runs it for you under a managed service agreement.
• Moraph-managed with your existing licenses: If you already license Jamf or Workspace ONE, Moraph can take over configuration and operations, subject to the vendor's terms.
• Alongside other Moraph services: Run with Moraph's Single Sign-On, Secure Messaging or Asset Tracking services so devices, sign-on and messaging are managed together.

Limitations

• Moraph is not Jamf or Omnissa, the vendor of Workspace ONE. The platform belongs to its vendor, and the vendor's own service commitments, roadmap, maintenance and outages apply to it.
• Licenses are subject to the vendor's terms, and the settings available depend on what the platform and the device's operating system support.
• How a shared device is reset depends on its type and operating system. Some devices are erased and re-enrolled, others have their user session cleared; the method is agreed for each device role.
• A device that is switched off, out of Wi-Fi range or not returned cannot receive a reset or wipe until it reconnects. The exception list shows these devices; it cannot reach them.
• Location of lost devices is available only where the platform, the operating system and your policy allow it.
• Moraph does not supply, repair or replace hardware, and does not manage personally owned devices unless that is agreed in scope.
• Your organization remains responsible for its HIPAA risk analysis, device policies and breach notification decisions.
• Clinical app behavior and configuration are governed by each app's vendor; Moraph deploys apps with the settings those vendors document.