Security, data and compliance in Voice Recording Compliance

How Voice Recording Compliance protects data and supports your compliance obligations.

Security controls

Single sign-on

Your staff and Moraph's engineers sign in through identity providers with multi-factor authentication, so your access policies apply.

Role-based access

Who can search, play back and export recordings follows their role and scope; administering the platform is separate from listening to it.

No routine access to content

Moraph staff cannot listen to, read or export recordings without your explicit, time-bound authorization, and keys are handled on the same basis.

Complete audit trail

Searches, playbacks, exports, holds and configuration changes are logged with the person and time.

Data residency

Recordings stay in the hosting region agreed for your deployment; Moraph-hosted components run in the United States, United Kingdom or Australia.

Controlled changes

Configuration changes and Verint updates are tested before they are applied, and Moraph-built connectors pass its security testing gates and carry a software bill of materials.

Requirements it supports

• SEC Rule 17a-4 (broker-dealer records preservation)
• FINRA Rule 3110 (Supervision) and Rule 3170 (Tape Recording of Registered Persons by Certain Firms)
• CFTC Regulation 1.35 (records of commodity interest and related cash or forward transactions, including oral communications)
• CFTC Regulation 23.202 (swap dealer daily trading records)
• FCA Handbook SYSC 10A (recording telephone conversations and electronic communications)
• MiFID II Article 16(7) (recording of telephone conversations relating to client orders)

The product supports these requirements; meeting them remains your organization's responsibility.

Where it runs

• Verint cloud, run by Moraph: Verint's hosted service, licensed through Moraph and configured and operated by Moraph's team.
• In your environment: Verint installed in your data center or cloud account, with Moraph operating it under agreed remote access.
• Co-managed: Your team keeps some administration, such as user changes, and Moraph runs monitoring, configuration and service reporting.

Limitations

• Moraph is not the vendor. Verint owns the platform, and Verint's own service commitments, roadmap and outages apply.
• Licences are subject to Verint's terms, which you accept as part of the agreement.
• Moraph can only monitor the lines and devices you tell us are in scope. Deciding who must be recorded is your compliance team's decision.
• Recording depends on your telephony, network and mobile setup. Calls made on unenrolled devices or unapproved channels are not captured.
• Moraph does not review calls for misconduct. Supervision and surveillance remain your responsibility, though recordings can feed tools that support them.
• Transcription accuracy varies with audio quality, accents and trading jargon, and transcripts do not replace the recording.
• Whether a recording gap must be reported to a regulator is your decision. Moraph reports the gap and its affected period to you.
• Text, chat and email archiving is not included; see Communication Archiving.