Security, data and compliance in Munitions Accountability & Audit Ledger

How Munitions Accountability & Audit Ledger protects data and supports your compliance obligations.

Security controls

Records kept in the United States

For US government clients, data is hosted only in the United States region.

Cleared support lane

Support tickets from federal and defense clients are handled only by US citizens with active security clearances.

Access by role and unit

What each person can see and do follows their role and the units, arms rooms and sites assigned to them.

Encryption under controlled keys

Data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Tamper-evident ledger and audit trail

Ledger entries are append-only, and every view, change, approval and export is logged with the person and time.

Tested releases

Every release passes security testing gates before deployment, and a software bill of materials is maintained for the product.

Requirements it supports

• DoD Manual 5100.76, Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives
• DoD Instruction 5000.64, Accountability and Management of DoD Equipment and Other Accountable Property
• DoD Instruction 8320.04, Item Unique Identification (IUID) Standards for Tangible Personal Property
• MIL-STD-130, Identification Marking of U.S. Military Property
• DFARS 252.211-7003, Item Unique Identification and Valuation
• DoD Manual 4140.01, DoD Supply Chain Materiel Management Procedures

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted and operated by Moraph in the United States region for unclassified accountability data.
• Dedicated environment: A single-tenant environment for organizations that require isolation, scoped in the proposal.
• Client-operated environment: Installed in an environment your organization operates. Where that environment is a classified network, it runs under your authority and your accreditation process, and Moraph provides control documentation to support it.
• Disconnected sites: Mobile and handheld clients work offline at sites with intermittent connections and synchronize when a connection is available.

Limitations

• The ledger records accountability; it does not guarantee it. Accuracy depends on people scanning and signing for every movement and on inventories being done as your procedures require.
• It does not replace your service's accountable property system of record unless your organization decides it should. By default it runs alongside that system and exchanges data with it.
• Moraph holds no FedRAMP authorization or DoD impact level authorization for this product. We map controls and provide documentation to support your organization's own authorization decision.
• Operation on classified networks happens only in environments your organization operates, under your authority. Moraph does not host classified information.
• It does not control physical security. Arms room construction, locks, alarms and guards remain under your physical security program.
• Items without readable IUID marks or barcodes must be identified and entered by hand, which needs closer checking.
• Explosives safety calculations, such as quantity-distance and storage compatibility, are not included.
• Disposal, demilitarization and shipment documents are recorded, but they are produced in the systems your organization already uses.