Security, data and compliance in Grant & Site Payment Manager

How Grant & Site Payment Manager protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person sees follows their role and department; preparing a financial transaction is separate from approving it.

Business associate agreement

Where visit data includes protected health information, Moraph signs a business associate agreement with you.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every change, approval, signature and export is logged with the person, time and reason, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• ICH E6(R3) Guideline for Good Clinical Practice
• FDA electronic records and signatures (21 CFR Part 11)
• Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (2 CFR Part 200)
• Open Payments, Physician Payments Sunshine Act (42 CFR Part 403, Subpart I)
• Medicare Clinical Trial Policy (National Coverage Determination 310.1)
• HIPAA Privacy Rule research provisions (45 CFR 164.508 and 164.512(i))

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available for organizations outside the US.
• Dedicated environment: A single-tenant environment for organizations whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside Moraph managed services for integration engine or identity support.

Limitations

• Moraph does not hold funds. Payments are made by your accounts payable system and received into your own bank accounts.
• It is not a general ledger or ERP. Your finance system remains the system of record, and your team posts entries there.
• It is not a clinical trial management system. Visit completions come from your clinical systems, and match quality depends on that data.
• It does not negotiate budgets or contracts; it records the terms you agree with sponsors.
• It does not perform Medicare coverage analysis. It can record which items are billed to the sponsor, but the billing determination is made by your team.
• It does not pay study participants; participant payments stay with the method your institution uses.
• It does not submit financial reports to federal agencies or report to Open Payments; it prepares data your teams use for those submissions.
• Approval limits, write-off decisions and cost transfer justifications are your institution's decisions; the product records and enforces them.