Security, data and compliance in Federal HR "Onboarding Passport"

How Federal HR "Onboarding Passport" protects data and supports your compliance obligations.

Security controls

Records kept in the United States

Selectee and case data are hosted in the United States region.

Security status, not security files

The Passport holds investigation milestones only; investigative reports and adjudication rationale stay in your security office's systems.

Access by role

Selectees see only their own case, hiring managers only their own selectees, and HR teams only the cases they are responsible for.

Encryption under controlled keys

Client data is encrypted with keys Moraph staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every view, change, submission and export is recorded with the user and time, supporting Privacy Act accounting and access reviews.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Requirements it supports

• 5 CFR Part 731, Suitability and Fitness
• 5 CFR Part 1400, Designation of National Security Positions
• Privacy Act of 1974 (5 U.S.C. 552a)
• HSPD-12 and FIPS 201-3, Personal Identity Verification
• Employment eligibility verification, Form I-9 (8 U.S.C. 1324a)
• Section 508 of the Rehabilitation Act (29 U.S.C. 794d)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted in the United States region, with selectee and case data kept in the US.
• Dedicated environment: A single-tenant environment for agencies that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for administration, checklist maintenance and integration support.

Limitations

• The Passport does not conduct, adjudicate or decide background investigations. Investigations are conducted by your investigative service provider and determinations are made by your agency.
• It does not replace eApp. Selectees complete the SF-85, SF-85P and SF-86 in eApp, and the Passport records status.
• It does not store investigation reports or adjudication rationale, by design.
• It does not capture fingerprints or issue PIV credentials; it schedules appointments and tracks status from the systems that do.
• It is not an HR system of record or payroll system and does not process personnel actions.
• Connections to government systems depend on the system owner's approval and available interfaces. Where none exists, status is recorded by staff.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.
• Overall onboarding time depends on investigation and credentialing timelines outside the Passport's control.