Security, data and compliance in Personnel Security (PerSec) Clearance Tracker

How Personnel Security (PerSec) Clearance Tracker protects data and supports your compliance obligations.

Security controls

Records kept in the United States

Hosted in the United States region only, for government and cleared contractor clients.

Cleared support lane

Support tickets from federal and defense clients are handled only by US citizens with active security clearances.

Need-to-know access

Single sign-on through your identity provider, with roles that separate the basic clearance record from sensitive case details.

Encryption under controlled keys

Client data is encrypted with keys Moraph staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every view, change, report and export is recorded with the person and time, and cannot be edited.

Controls mapped for your authorization

Moraph is SOC 2 Type II and ISO/IEC 27001 audited, maps the tracker's controls to NIST SP 800-53 and 800-171, and supports your own authorization and Privacy Act obligations; it does not hold a DoD authorization of its own.

Requirements it supports

• Executive Order 12968, Access to Classified Information
• Security Executive Agent Directive 3, Reporting Requirements for Personnel with Access to Classified Information
• Security Executive Agent Directive 4, National Security Adjudicative Guidelines
• 32 CFR Part 117, National Industrial Security Program Operating Manual (NISPOM)
• DoD Manual 5200.02, Procedures for the DoD Personnel Security Program
• Privacy Act of 1974 (5 U.S.C. 552a)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted and operated by Moraph in the United States region for unclassified data, with controls mapped to support your own authorization.
• Dedicated environment: A single-tenant environment for organizations whose policies require isolation, scoped in the proposal.
• Your environment: Installed in an environment you operate where your authorizing official approves it, running under your authority.
• With a managed service: Optionally run alongside a Moraph managed service for administration and integration support, delivered by US citizens with active clearances.

Limitations

• The tracker does not adjudicate. Eligibility determinations are made by the government adjudicating authority, and the tracker records them.
• It does not replace or write to the government personnel security system of record; reports required there are submitted by your staff, and the tracker records the reference.
• It does not run continuous vetting checks or obtain records about individuals itself. It logs and tracks the alerts and reports your security office receives through official channels.
• It does not conduct background investigations or collect investigation forms; applicants complete those in the government system.
• It is designed for unclassified personnel security records. Classified case information is not stored in the hosted service.
• Records are only as current as the information entered and reconciled; periodic reconciliation with the system of record is needed.
• Your organization remains responsible for its Privacy Act notices, system of records requirements and retention schedules.
• Moraph does not hold a DoD authorization for the tracker; your authorizing official decides whether and where it may be used.