Security, data and compliance in Inter-Agency "Silo Breaker" Data Bridge

How Inter-Agency "Silo Breaker" Data Bridge protects data and supports your compliance obligations.

Security controls

Records kept in the United States

The Bridge and its logs are hosted in Moraph's United States region, or in your own environment.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Single sign-on and role-based access

Each agency's people sign in through its own identity provider, and roles decide who can query, approve policies and see logs.

Encryption under controlled keys

Data in transit and logs at rest are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every query, response, refusal, policy change and approval recorded with the person, system and time, and cannot be edited.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Requirements it supports

• Privacy Act of 1974 (5 U.S.C. 552a)
• Computer Matching and Privacy Protection Act of 1988
• E-Government Act of 2002, Section 208 privacy impact assessments
• OMB Circular A-130, Managing Information as a Strategic Resource
• OMB Circular A-108, Federal Agency Responsibilities for Review, Reporting, and Publication under the Privacy Act
• NIST SP 800-53 Rev. 5, Security and Privacy Controls

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted in the United States region, with adapters installed in each providing agency's environment.
• Agency-hosted: Installed in an agency's own environment where its policy requires, operated under its authorization.
• Dedicated environment: A single-tenant environment for agencies that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for policy upkeep, adapter maintenance and administration.

Limitations

• It does not decide whether sharing is lawful. The legal authority, agreements, system of records notices and privacy impact assessments are your agencies' responsibility; the Bridge enforces the policies you approve.
• Computer matching programs still need their matching agreements, data integrity board approvals and notices. The Bridge supports them but does not replace those steps.
• Answers are only as accurate as the providing agency's records. The Bridge does not correct or reconcile source data.
• It is not a data warehouse or analytics platform. It answers specific queries and does not build combined datasets across agencies.
• Each providing agency must install and maintain an adapter, which needs its system owner's approval and technical support.
• Statute-specific restrictions, such as those on federal tax information, can be reflected in policies, but determining what they permit is your agencies' decision.
• Moraph holds no FedRAMP authorization for the Bridge. We provide control documentation to support each agency's own authorization.
• Responses depend on the availability of the providing agency's system; if it is unavailable, queries are refused rather than answered from a copy.