Security, data and compliance in Secure File Transfer

How Secure File Transfer protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply; external recipients verify their identity for each request.

Role-based access

Client folders are visible only to the staff who serve that client; approving a policy exception is separate from requesting one.

Encryption and keys

Kiteworks encrypts files in transit and at rest; where Moraph holds keys, staff cannot use them without explicit, time-bound authorization.

Complete audit trail

Every upload, view, download, share, permission change and administrative action is logged with the person and time, and cannot be edited.

No routine access to client files

Moraph engineers administer the platform without opening client files; any exception is requested, approved by your firm and logged.

Data residency

Files are hosted in the region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)
• Internal Revenue Code Section 7216 and Treasury Regulations (26 CFR 301.7216) on tax return information
• IRS Publication 4557, Safeguarding Taxpayer Data
• SEC Regulation S-P (17 CFR Part 248, Subpart A)
• Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
• NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Hosted by the vendor: Kiteworks hosted in the region you choose, configured and operated by Moraph.
• Your own cloud tenant: Kiteworks deployed in your own cloud subscription for firms whose policies require it, with Moraph operating it under logged administrative access.
• On-premises: Kiteworks installed in your data center, with Moraph operating it remotely under your access controls.

Limitations

• Moraph is not Kiteworks. The platform belongs to Kiteworks, and Kiteworks' own service commitments, roadmap and outages apply to it.
• Licences are subject to Kiteworks' terms, including how users and storage are counted.
• It replaces email for sensitive documents only if staff and clients use it. Your firm decides whether to require it and how to tell clients.
• Once a recipient downloads a file, Kiteworks cannot control what they do with their copy. View-only sharing reduces this but cannot stop screenshots.
• It is not a tax preparation, document management or client portal system. Documents can be passed to those systems, but they are separate.
• Retention periods, sharing rules and legal holds are your firm's decisions; Moraph implements and reports on them.
• Malware and data loss prevention checks reduce risk but cannot detect every harmful or sensitive file.
• Moraph supports your compliance with GLBA, Section 7216 and other requirements but does not determine whether your firm meets them.