Security, data and compliance in Veterans Benefits Claims Automator

How Veterans Benefits Claims Automator protects data and supports your compliance obligations.

Security controls

Records kept in the United States

Claim files and decision data are hosted in the United States region.

Cleared support lane

Support tickets from federal clients are routed only to US citizens with active security clearances.

Access by role and station

Staff see only the claims for their role, team or station; access to sensitive files can be limited further.

Encryption under controlled keys

Client data is encrypted with keys our staff cannot access without explicit, time-bound authorization.

Complete audit trail

Every view, correction, proposal, decision and export is recorded with the user and time, and cannot be edited.

Independent audits

Moraph's controls are covered by its SOC 2 Type II report and ISO/IEC 27001 certification, available through the Trust Center.

Requirements it supports

• Title 38, U.S. Code, Chapter 11 (Compensation for Service-Connected Disability or Death)
• 38 CFR Part 3 (Adjudication), including presumptive service connection at 3.307 to 3.320
• 38 CFR Part 4 (Schedule for Rating Disabilities)
• Sergeant First Class Heath Robinson Honoring our Promise to Address Comprehensive Toxics (PACT) Act of 2022
• Duty to assist (38 U.S.C. 5103A)
• Privacy Act of 1974 (5 U.S.C. 552a)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud, United States: Hosted in the United States region, with records kept in the US.
• Dedicated environment: A single-tenant environment for agencies that require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for administration, integration support and rule library maintenance support.

Limitations

• It proposes; it never decides. Service connection, evaluations and every other finding are made by your rating staff, and the system does not issue decisions or notices.
• Presumptive rules reflect law and regulation as reviewed and approved by your policy staff. Moraph does not interpret the law for your agency, and rule changes take effect only when you approve them.
• Extraction from scanned records can miss or misread information, especially handwriting and poor-quality scans. Low-confidence pages are flagged, and staff remain responsible for reviewing the evidence.
• It does not assign disability percentages on its own. It can show the rating schedule criteria and evidence, but the evaluation is the rater's decision.
• Moraph holds no FedRAMP authorization for this product. We provide control documentation to support your agency's own authorization decision.
• It is not a replacement for your agency's system of record for claims, payments or notices; it works alongside them.
• Appeals processing is not included beyond making the claim file and decision record available.
• Coverage starts with the claim types and presumptive provisions agreed during implementation; others are added by agreement.