Security, data and compliance in Food Safety Inspection Router

How Food Safety Inspection Router protects data and supports your compliance obligations.

Security controls

United States hosting

Data is hosted in Moraph's United States region only.

Cleared support lane

Support tickets from federal clients are handled only by US citizens with active security clearances.

Protected data on devices

Data held offline on a device is encrypted, limited to the inspector's current assignments, and removed once synchronized and no longer needed.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view, change, approval and synchronization is logged with the person and time, and cannot be edited.

Tested releases

Every release passes security testing gates before it ships, and a software bill of materials is maintained for the product. Moraph is SOC 2 Type II and ISO/IEC 27001 audited.

Requirements it supports

• Federal Meat Inspection Act (21 U.S.C. 601 et seq.)
• Poultry Products Inspection Act (21 U.S.C. 451 et seq.)
• Egg Products Inspection Act (21 U.S.C. 1031 et seq.)
• FDA Food Safety Modernization Act, including risk-based inspection targeting (21 U.S.C. 350j)
• Federal Information Security Modernization Act (44 U.S.C. 3551 et seq.)
• Section 508 of the Rehabilitation Act

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted and operated by Moraph in the United States region, with data kept in the US.
• Dedicated environment: A single-tenant environment for agencies that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for administration, model monitoring support and integration support.

Limitations

• The Router proposes; it does not decide. Inspection plans are approved by a supervisor, and findings and enforcement decisions belong to your agency.
• Risk scores depend on the completeness and quality of the facility, inspection and signal data you provide, and should be reviewed periodically as that data changes.
• It does not replace inspection frequencies set in law or regulation. Required visits are planned alongside risk-driven ones.
• Offline use covers the inspector's downloaded assignments. Facility records not downloaded beforehand are not available without a connection.
• It is not a laboratory information system or a recall management system. It uses results and notices from the systems your agency already has.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.
• It is not designed for classified information.
• The mobile app requires agency-managed devices that meet the supported operating system versions listed in the proposal.