Security, data and compliance in Trade Reconstruction Repository

How Trade Reconstruction Repository protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see follows their role and their desk and period scope; approving a reconstruction is separate from building one.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every search, view, link decision, approval and export is logged with the person and time, and cannot be edited.

Source integrity

Source records are stored as received and never altered; notes and links are kept as separate, attributed records.

Data residency

Data stays in the hosting region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• MiFID II Article 16(7) and Commission Delegated Regulation (EU) 2017/565 Article 76 (recording of communications)
• MiFID II Article 27 and Commission Delegated Regulation (EU) 2017/565 Articles 64 to 66 (best execution)
• FCA Handbook COBS 11.8 (recording telephone conversations and electronic communications)
• CFTC Regulation 1.35 (records of commodity interest transactions)
• SEC Rule 17a-4 under the Securities Exchange Act of 1934
• FINRA Rule 5310 (Best Execution and Interpositioning)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud: Hosted and operated by Moraph in the United States, United Kingdom or Australia region, chosen to match where your records must be held.
• Dedicated environment: A single-tenant environment for firms whose policies require isolation, scoped in the proposal.
• With managed archiving: Optionally run alongside Moraph's Communication Archiving or Voice Recording Compliance managed services, so sources and the repository are supported together.

Limitations

• The repository does not record calls or capture messages itself. It uses the recordings and archives your existing systems produce, and its completeness depends on theirs.
• Suggested links are suggestions. An analyst confirms each link, and the firm is responsible for the reconstructions it releases.
• Transcripts come from your recording platform or transcription service; the repository does not guarantee their accuracy.
• It is not a trade surveillance system. It can receive alerts from one and reconstruct the trades behind them.
• It does not decide whether best execution was achieved. It records the reviewer's judgment against your execution policy.
• It does not submit anything to regulators. Approved packages are delivered to your legal or compliance team for production.
• Records are retained for the periods you configure. Choosing retention periods that meet your obligations is your firm's decision.
• Hosting is available in the United States, United Kingdom and Australia regions; other regions are not offered.