Security, data and compliance in Vital Records Digitization & Fraud Guard

How Vital Records Digitization & Fraud Guard protects data and supports your compliance obligations.

Security controls

Single sign-on

Staff sign in through your identity provider, so your password and multi-factor policies apply.

Role-based access

What each person can see and do follows their role; sealed records and fraud flags are limited to the roles you choose.

Encryption and keys

Client data is encrypted, with keys Moraph staff cannot use without explicit, time-bound authorization.

Complete audit trail

Every search, view, print, void and export is logged with the person and time, and cannot be edited.

US-only hosting

Data for US government clients is hosted in the United States region only.

Tested releases

Every release passes security testing gates before it ships, and a software bill of materials is kept for the product.

Requirements it supports

• Intelligence Reform and Terrorism Prevention Act of 2004, Section 7211 (birth certificate standards)
• REAL ID Act of 2005 and DHS regulations (6 CFR Part 37)
• Model State Vital Statistics Act and Regulations (2011 revision)
• State vital records statutes and rules on who may obtain a certified copy
• NIST SP 800-63 Digital Identity Guidelines (identity proofing for online requests)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Moraph cloud (US): Hosted and operated by Moraph in the United States region.
• Dedicated environment: A single-tenant environment for states whose policies require isolation, scoped in the proposal.
• With a managed service: Optionally run alongside a Moraph managed service for digitization project support and platform administration.

Limitations

• It is not a birth or death registration system. New events are registered in your existing electronic registration systems and loaded into the archive.
• Eligibility rules, accepted identification and fraud indicators are your office's decisions under your state's law; Fraud Guard applies and records them but does not set them.
• It does not supply security paper. Paper, printers and the physical security features on the paper come from your existing suppliers.
• Fraud indicators surface requests for review; they do not establish that fraud occurred. A trained person decides every held request.
• Indexing quality depends on the condition of the source records. Damaged or illegible originals may need manual research.
• Physical scanning of records is done by your staff or a digitization vendor; Moraph can scope scanning services separately.
• Participation in EVVE or other national verification services depends on your jurisdiction's own agreements.
• Fees are collected through your payment processor. Moraph does not hold funds.