Security, data and compliance in Tribal Trust Asset Management System

How Tribal Trust Asset Management System protects data and supports your compliance obligations.

Security controls

Records kept in the United States

All ownership, income and beneficiary data is hosted in the United States region.

Cleared support lane

Support tickets from federal clients are handled only by US citizens with active security clearances.

Role-based access

What each person can see and do follows their role, region and tribe; entering a change is separate from approving it.

Encryption under controlled keys

Client data is encrypted with keys Moraph staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every view of beneficiary data, every change, approval, calculation and export is recorded with the person and time, and cannot be edited.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification. Moraph maps controls to support your agency's own authorization decision.

Requirements it supports

• American Indian Trust Fund Management Reform Act of 1994 (25 U.S.C. 4001 et seq.)
• Indian Land Consolidation Act, as amended by the American Indian Probate Reform Act of 2004 (25 U.S.C. 2201 et seq.)
• Trust funds for tribes and individual Indians (25 CFR Part 115)
• Leases and permits on Indian land (25 CFR Part 162)
• Land title and records (25 CFR Part 150)
• Privacy Act of 1974 (5 U.S.C. 552a)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted and operated by Moraph in the United States region, with all records kept in the US.
• Dedicated environment: A single-tenant environment for agencies or tribes that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for administration, data reconciliation support and integration operations.

Limitations

• It does not decide ownership. Probate, conveyance and consolidation decisions are made by the authorized offices; the system records and checks them once approved.
• It does not hold or move money. Distribution files are exported to the system that posts to beneficiary accounts, and payments are made through your agency's financial processes.
• Results depend on the quality of migrated title and contract records. Tracts that fail reconciliation must be resolved by your title staff.
• It is not a probate case management or hearings system. It receives the orders those processes produce.
• Mineral production volumes and royalty values come from the reporting systems you already use; it does not verify production.
• Moraph holds no FedRAMP authorization for this product. We map controls and provide documentation to support your agency's own authorization decision.
• Land surveys and geospatial mapping of tract boundaries are not included; legal descriptions and acreage are recorded as data.
• Policy on trust responsibilities, tribal agreements and the scope of tribal access is decided by your agency and the tribes, not by the system.