Security, data and compliance in Private Market Secondary Liquidity Engine

How Private Market Secondary Liquidity Engine protects data and supports your compliance obligations.

Security controls

Single sign-on

Company staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; external participants see only their own transactions.

No funds held

Moraph does not hold funds or securities; payment and delivery move through the agent you appoint.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every request, notice, election, approval and cap table change is logged with the person and time, and cannot be edited.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Securities Act of 1933, Section 4(a)(1) and Section 4(a)(7) resale exemptions
• SEC Rule 144 (17 CFR 230.144)
• Regulation D accredited investor definition (17 CFR 230.501(a))
• Securities Exchange Act of 1934, Section 12(g) holder-of-record thresholds
• Delaware General Corporation Law Section 202 (restrictions on transfer of securities)
• OFAC sanctions regulations (31 CFR Chapter V)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region. United Kingdom and Australia regions are available on request.
• Dedicated environment: A single-tenant environment for companies whose policies require isolation, scoped in the proposal.
• Branded portal: The shareholder portal can carry your company's name and domain.

Limitations

• Moraph is not a broker-dealer, exchange, alternative trading system or transfer agent, and does not find buyers, match orders or recommend prices.
• Moraph does not hold funds or securities. Payment and delivery are handled by the escrow or settlement agent you appoint.
• The Engine applies the restrictions and rights your counsel configures; whether a transfer is permitted, and whether a securities exemption is available, are legal decisions for the company and its counsel.
• Buyer accredited investor status is evidenced by documents the buyer provides and reviewed by your team; the Engine does not verify it independently.
• It is not a valuation tool. Price history is recorded for your own use and does not determine fair value.
• Sanctions screening and identity verification use the provider you already have.
• It is designed for US private companies. Transfers governed by other countries' laws need review by your counsel before configuration.
• Tax reporting and withholding on employee sales remain with the company and its payroll and tax advisers.