Security, data and compliance in Municipal Fleet & Asset IoT Monitor

How Municipal Fleet & Asset IoT Monitor protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see follows their role and department; police and other sensitive vehicles can be hidden from everyone outside the owning department.

Public map safeguards

Only the services and vehicle classes you choose appear publicly, after a delay you set, and never with driver names.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every view of location history, export and change is logged with the person and time, and cannot be edited.

US-only hosting

Data for US government clients is hosted in the United States region only, and every release passes security testing gates with a software bill of materials kept for the product.

Requirements it supports

• FBI CJIS Security Policy, where police vehicle data is involved
• Uniform Guidance on equipment (2 CFR 200.313) for federally funded vehicles
• GASB Statement No. 34 capital asset reporting
• 49 CFR Part 396 inspection, repair and maintenance, where your state applies it to government vehicles
• State public records laws governing vehicle location data

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud (US): Hosted and operated by Moraph in the United States region.
• Dedicated environment: A single-tenant environment for cities whose policies require isolation, for example where police vehicle data is included, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for telematics integration support and platform administration.

Limitations

• It does not supply telematics hardware or connectivity. Devices and data plans come from your telematics providers, and data quality depends on them.
• Equipment sensor data such as plow and spreader status is only available where vehicles are fitted to report it.
• The public map shows where vehicles have passed with equipment active; it is not a guarantee of road condition or that a street is clear.
• What appears on the public map, and when, is your city's decision. The Monitor applies those settings.
• It is not a full fleet maintenance or parts inventory system. It works with your existing maintenance system or handles basic work orders only.
• It is not a computer-aided dispatch system and does not dispatch police, fire or EMS vehicles.
• Driver behavior data may be subject to labor agreements and records laws; how it is used is your city's decision.
• Location history is kept for the retention period you set, and is subject to your state's public records law.