Security, data and compliance in "The Grant Factory" (Grant Management System)

How "The Grant Factory" (Grant Management System) protects data and supports your compliance obligations.

Security controls

Staff single sign-on

Staff sign in through your identity provider, so your own password and multi-factor policies apply.

Separate subrecipient portal

Subrecipients sign in to their own portal with multi-factor authentication and see only their own subaward.

Role-based access

What each person can see and approve follows their role, department and awards; preparing and approving are always separate.

Encryption and keys

Grant records and documents are encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every decision, approval, cost review, report and export is logged with the person and time, and cannot be edited.

US hosting

Data for US government clients is hosted only in Moraph's United States region, under the controls covered by Moraph's SOC 2 Type II report and ISO/IEC 27001 certification.

Requirements it supports

• Uniform Guidance (2 CFR Part 200)
• Single Audit requirements (2 CFR Part 200, Subpart F)
• FFATA subaward reporting (2 CFR Part 170)
• SAM.gov registration and Unique Entity ID (2 CFR Part 25)
• Coronavirus State and Local Fiscal Recovery Funds rule (31 CFR Part 35, Subpart A)
• Build America, Buy America Act (Infrastructure Investment and Jobs Act, Pub. L. 117-58, Division G, Title IX)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States region.
• Dedicated environment: Single-tenant hosting where your policies require it, scoped in the proposal.
• Phased by funding source: Start with the awards carrying the heaviest reporting, then bring in other awards and the opportunity pipeline.
• With a managed service: Optionally run with a Moraph managed service for configuration changes, integration monitoring and platform administration.

Limitations

• The Grant Factory does not submit applications, reports or drawdowns itself. Your staff submit them through Grants.gov, the agency's portal or its payment system.
• Moraph does not hold, receive or move grant funds. Drawdowns are paid by the funding agency directly to your organization.
• It is not your accounting system of record. Expenditures are recorded in your financial system and imported for matching and review.
• Cost flags and opportunity suggestions are prompts for staff review. Allowability and eligibility decisions are made by your staff under the award terms and the Uniform Guidance.
• Using it does not by itself prevent audit findings or repayment demands; it organizes the records and deadlines so your staff can meet the requirements.
• Agency report formats and guidance change. Report templates are kept up to date, but staff should confirm each report against the agency's current instructions.
• State and private opportunity sources that do not publish listings in a usable format are entered by your staff.
• The single audit is performed by your auditor. The Grant Factory prepares the schedule and supporting records.