Security, data and compliance in Tax Code "Rule-as-Code" Engine

How Tax Code "Rule-as-Code" Engine protects data and supports your compliance obligations.

Security controls

Hosted in the United States

Rules, examples and review records are hosted in the United States region.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Access by role

Drafting, legal approval and release are separate permissions, and unreleased rules can be limited to the people working on them.

Encryption under controlled keys

Client data is encrypted with keys our staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every edit, test, approval and release is recorded with the user and time, and cannot be edited.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Requirements it supports

• Internal Revenue Code (Title 26, U.S. Code)
• Treasury Regulations (26 CFR)
• Confidentiality of returns and return information (26 U.S.C. 6103)
• Taxpayer Bill of Rights (26 U.S.C. 7803(a)(3))
• Federal Information Security Modernization Act of 2014 (FISMA)
• Section 508 of the Rehabilitation Act

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted in the United States region, with data kept in the US.
• Dedicated environment: A single-tenant environment for agencies that require isolation, scoped in the proposal.
• Rule packages run in your systems: Released packages are executed by your own processing systems or by an execution component installed in your environment, so production calculations do not depend on Moraph's cloud.
• With a managed service: Optionally run alongside a Moraph managed service for administration, rule-engineering support and integration support.

Limitations

• It does not interpret the law for your agency. Every rule reflects the reading of your specialists and counsel, and Moraph does not provide tax or legal advice.
• It does not process returns or hold taxpayer accounts. Your processing systems run the released rules.
• Some provisions depend on judgment, facts and circumstances that cannot be reduced to conditions and calculations; these are recorded as inputs a person or system must supply, not decided by the engine.
• A rule is only as reliable as its worked examples. Testing shows the rule matches the examples written, not that the examples cover every case.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.
• Existing logic in legacy processing systems is not converted automatically; provisions are modeled in the engine as your agency chooses to bring them across.
• Consuming systems must be changed to read the released packages, and that work sits with the teams that own them.
• It is designed for tax provisions. Other areas of law can be modeled but are outside the conventions delivered at implementation.