Security, data and compliance in Smart Utility Metering & Billing Hub

How Smart Utility Metering & Billing Hub protects data and supports your compliance obligations.

Security controls

Separate access for customers and staff

Customers see only their own accounts; staff see what their role allows.

Staff single sign-on

Staff sign in through your identity provider, so your own sign-in and multi-factor policies apply.

Encryption and keys

Meter, account and billing data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

No card data held

Payments are taken on your processor's payment page. Moraph does not store card details, hold funds or move money.

Audit trail

Every read edit, estimate, rate change, adjustment and bill run recorded with who made it and when, and cannot be edited.

US hosting and assurance

Hosted in Moraph's United States region, under the controls covered by Moraph's SOC 2 Type II report and ISO/IEC 27001 certification.

Requirements it supports

• Your utility rate ordinances, tariffs and approved rate schedules
• State public utility commission billing, deposit and disconnection rules, where they apply to municipal utilities
• FTC Red Flags Rule (16 CFR Part 681) for utilities that extend credit to customers
• NISTIR 7628 Guidelines for Smart Grid Cybersecurity, used as a reference for meter data security
• ADA Title II web accessibility rule (28 CFR Part 35, Subpart H)
• PCI DSS, through your payment processor

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted by Moraph in the United States region.
• Dedicated environment: Single-tenant hosting for utilities whose policies require it, scoped in the proposal.
• Alongside your billing system: Used for meter data validation, detection and the customer portal, sending validated usage to the billing system you keep.
• With a managed service: Optionally run with a Moraph managed service for rate changes, feed monitoring and platform administration.

Limitations

• The Hub does not install, read or operate meters or their communication network. It uses the data your head-end systems provide.
• It does not control the water or electric network, and it is not an outage management or SCADA system. Outage flags are based on meters losing contact and need confirmation by your operators.
• Leak and tampering flags are indications for staff to review, not findings. Detection depends on read frequency and data quality.
• Rates are set by your governing body. The Hub applies the rates you configure; it does not design or approve them.
• Moraph does not hold funds, take payments or store card details. Payments go through your payment processor.
• Disconnection, collections and deposit decisions are made by your staff under your policies and any rules that apply to your utility.
• Gas metering and wholesale energy settlement are not included.
• Customer usage and alerts in the portal are only as current as the reads delivered by your head-end systems.