Security, data and compliance in Public Cloud Infrastructure

How Public Cloud Infrastructure protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff and Moraph's engineers sign in through identity providers with multi-factor authentication; your staff through yours.

Role-based access

Permission sets follow roles, so writing a change, approving it and applying it are separate.

Time-bound administrative access

Moraph staff can reach your data or keys only with explicit, time-bound authorization from you for a stated task.

Complete audit trail

Every console, command-line and pipeline action is logged with the person and time in a logging account that cannot be edited by workload or Moraph engineers.

Tested changes

Guardrail and landing-zone code passes Moraph's security testing gates before release, and a software bill of materials is kept for Moraph's tooling.

Region control

Workloads run only in the AWS regions you approve; Moraph operates environments from the United States, the United Kingdom or Australia to match.

Requirements it supports

• Gramm-Leach-Bliley Act Safeguards (Interagency Guidelines Establishing Information Security Standards; FTC Safeguards Rule, 16 CFR Part 314)
• FFIEC Joint Statement on Security in a Cloud Computing Environment (2020)
• FFIEC IT Examination Handbook: Architecture, Infrastructure, and Operations
• Interagency Guidance on Third-Party Relationships: Risk Management (2023)
• NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
• SEC Regulation S-P (17 CFR Part 248), where applicable

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• In your AWS organization: The environment is in AWS accounts owned by your institution, with Moraph operating them under the service agreement.
• Under a Moraph reseller agreement: AWS usage is bought through Moraph and billed with the service, subject to AWS's terms.
• Existing landing zone: Where you already have an AWS organization, Moraph takes over its operation and brings it under policy as code rather than rebuilding it.
• With other Moraph services: Run alongside Moraph managed services for vulnerability management, privileged access or data loss prevention.

Limitations

• Moraph is not AWS. AWS's own service commitments, support terms, roadmap and outages apply to the cloud itself, and Moraph cannot change them.
• AWS usage and support bought through Moraph remain subject to AWS's customer terms and pricing.
• Guardrails reduce the chance of misconfiguration; they do not remove it. Some risky configurations can only be detected after the fact rather than prevented.
• Moraph operates the landing zone and guardrails. Building, patching and supporting your applications is not included unless contracted separately.
• Decisions about data classification, risk acceptance, exceptions and incident notification remain with your organization.
• The service covers AWS. Other clouds and on-premises infrastructure are outside its scope.
• Moraph maps controls to frameworks your institution reports against and supports your own assessments; it does not certify your environment.
• Workloads that cannot be deployed as code need a documented exception and are checked by detective rules only.