Security, data and compliance in Permitting & Licensing Accelerator

How Permitting & Licensing Accelerator protects data and supports your compliance obligations.

Security controls

Separate access for applicants and staff

Applicants see only their own applications; staff see what their role allows, and every access is checked on each request.

Staff single sign-on

Staff sign in through your identity provider, so your own sign-in and multi-factor policies apply.

Encryption

Application data and documents are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

No card data held

Payments are taken on your processor's payment page. Moraph does not store card details, hold funds or move money.

Audit trail

Every submission, decision, fee change and status change recorded with who made it and when, for public-records requests and audits.

Company-wide assurance

Operated under the controls covered by Moraph's SOC 2 Type II report and ISO/IEC 27001 certification, described in the Trust Center.

Requirements it supports

• ADA Title II web accessibility rule (28 CFR Part 35, Subpart H)
• WCAG 2.1 Level AA
• State public-records laws
• Your records-retention schedules
• Your local building, zoning and licensing codes, including adopted International Code Council codes
• PCI DSS, through your payment processor

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted by Moraph in the United States region.
• Dedicated environment: Single-tenant hosting where your policies require it, scoped in the proposal.
• Phased by department: Departments or permit types can go live in stages, starting with those that gain most from online applications.
• With a managed service: Optionally run with a Moraph managed service for configuration changes, such as new fees or permit types, and platform administration.

Limitations

• The wizard is only as accurate as the rules configured from your codes and fee schedules, which your staff maintain after go-live.
• Payments go through your existing payment processor. Moraph does not hold or transfer funds.
• Reviewers comment within the Accelerator; detailed markup of large-format drawings needs an electronic plan-review tool, which can be integrated.
• It does not interpret codes or make approval decisions. Reviewers and inspectors decide.
• It does not replace your GIS. Parcel and zoning data are read from your GIS and must be kept current there.
• Code enforcement cases, complaints and violations are not included. The 311 Omni-Channel Citizen Intake product handles requests from residents.
• Applicants need an email address to apply online. Counter staff can enter applications on behalf of people who cannot or prefer not to apply online.
• Migration of historical records depends on the condition of your existing data. Older records may be referenced rather than fully migrated.