Security, data and compliance in FOIA "Backlog Buster" Redaction Engine

How FOIA "Backlog Buster" Redaction Engine protects data and supports your compliance obligations.

Security controls

Records kept in the United States

Records and review data are hosted in the United States region.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Access by role

Analysts see only the requests assigned to them or their team; administrators set who can approve releases.

Encryption under controlled keys

Client data is encrypted with keys our staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every view, proposal, decision and export recorded with the user and time.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Requirements it supports

• Freedom of Information Act (5 U.S.C. 552)
• Privacy Act of 1974 (5 U.S.C. 552a)
• Controlled Unclassified Information program (32 CFR Part 2002)
• Federal Records Act (44 U.S.C. Chapter 31)
• Department of Justice Office of Information Policy guidance
• Section 508 of the Rehabilitation Act

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted in the United States region, with records kept in the US.
• Dedicated environment: A single-tenant environment for agencies that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for administration, term-list maintenance and integration support.

Limitations

• It proposes; it never releases. Every redaction is accepted by a person, and exemption decisions belong to your agency.
• It can miss information, especially context-dependent material such as deliberative content under (b)(5). Analysts remain responsible for a complete review.
• Handwriting, poor-quality scans and some file types reduce detection accuracy and need closer human review.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.
• It is not designed for classified information. Records containing classified material must be handled outside it under your agency's procedures.
• Audio and video redaction is not included.
• It is not a request-tracking system. It works alongside your FOIA case management.
• Consultations and referrals to other agencies are managed in your existing process; the engine can export records for them.