Security, data and compliance in Virtual Desktop Infrastructure

How Virtual Desktop Infrastructure protects data and supports your compliance obligations.

Security controls

Single sign-on and MFA

Staff and Moraph engineers sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

Desktops, applications and administrative rights follow each person's role; approving a change is separate from carrying it out.

Data stays in the hosted session

Data-transfer policies restrict copying, downloading and printing outside the session to what your security officer approves.

Encryption and keys

Data is encrypted in transit and at rest; where Moraph holds keys, staff cannot use them without explicit, time-bound authorization.

Complete audit trail

Sign-ins, sessions, administrative actions and changes are logged with the person and time, and cannot be edited.

Data residency

Desktops are hosted in the region you choose: the United States, the United Kingdom or Australia.

Requirements it supports

• Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)
• Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
• FFIEC IT Examination Handbook, Information Security and Architecture, Infrastructure, and Operations booklets
• NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500)
• NCUA Security Program and Customer Information Guidelines (12 CFR Part 748 and Appendix A)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Azure Virtual Desktop in your Azure tenant: Session hosts run in your Azure subscription in the region you choose, with Moraph operating them under delegated, logged administrative access.
• Citrix with hosted workloads: Citrix's cloud service brokers sessions to session hosts in Azure or another hosting environment you choose, operated by Moraph.
• Existing Citrix environment: Where you already run Citrix in your own data center, Moraph can take over operation and plan any move to hosted workloads.

Limitations

• Moraph is not Citrix or Microsoft. The platform belongs to its vendor, and the vendor's own service commitments, roadmap and outages apply to it.
• Licences are subject to the vendor's terms, including any minimum counts, term lengths and changes the vendor makes to its licensing.
• Data-transfer policies reduce the ways customer information can leave a session, but they cannot stop someone photographing a screen or retyping data. They work alongside your acceptable-use policy and training.
• Applications that are not supported in a hosted desktop, or that need special hardware, may need to stay on local devices; this is identified during discovery.
• User experience depends on the network connection staff use to reach the service.
• The service manages the hosted desktops, not the laptops or thin clients staff connect from. Device management is a separate service, such as Moraph's managed Mobile Device Management.
• Hosting costs in your own Azure subscription are billed to you by Microsoft and are separate from Moraph's service.
• Decisions about who gets access and what data may leave a session remain your institution's; Moraph implements and evidences them.