Security, data and compliance in Legislative Management Suite (The "Open Meeting" Engine)

How Legislative Management Suite (The "Open Meeting" Engine) protects data and supports your compliance obligations.

Security controls

Public and staff access kept apart

The public portal shows only published records; drafts, reviews and members' annotations are never visible there.

Staff single sign-on

Staff and members sign in through your identity provider, so your own password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role and the bodies they belong to, and closed-session materials can be limited to named people.

Encryption and keys

Records are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every draft, approval, publication, revision and recorded vote is logged with the person and time, and cannot be edited.

US hosting

Data for US government clients is hosted only in Moraph's United States region, under the controls covered by Moraph's SOC 2 Type II report and ISO/IEC 27001 certification.

Requirements it supports

• State open-meetings laws (Sunshine Laws and Open Meetings Acts), as adopted in your state
• State public-records laws
• ADA Title II web accessibility rule (28 CFR Part 35, Subpart H)
• WCAG 2.1 Level AA
• Your records-retention schedules
• Your charter, code and adopted rules of procedure

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region.
• Dedicated environment: Single-tenant hosting where your policies require it, scoped in the proposal.
• Phased by body: Start with the governing body and add boards and commissions in later phases under the same agreement.
• With a managed service: Optionally run with a Moraph managed service for template and routing changes, portal administration and support on meeting days.

Limitations

• The Suite does not interpret your open-meetings law. Notice rules are configured from requirements your clerk and attorney confirm, and your staff remain responsible for following them.
• Using the Suite does not by itself make a meeting compliant or protect against claims; it records what was done so you can show it.
• Live streaming and recording use your existing video provider. The Suite embeds and links video; it does not capture or host broadcast video itself.
• Electronic voting by members requires a supported chamber voting system or the Suite's member console; otherwise the clerk records votes.
• Some states require notices to be posted at a physical location or in a newspaper. The Suite records those postings when staff confirm them but does not make them.
• Closed or executive session materials can be restricted, but deciding what may be discussed in closed session is a legal decision for your attorney.
• Migration of historical records depends on the condition and format of your existing archive. Older records may be linked rather than fully migrated.
• Accessibility of documents uploaded by staff, such as scanned attachments, depends on how those documents are prepared.