Funds trust us with confidential deal documents, so security comes first in how we build and run Morpheus. This page explains what we do. If you need more, such as our policies or a security questionnaire, email hello@usemorpheus.ai and we will send it.
Our compliance programme
- We are preparing for a SOC 2 Type I audit, with our controls ready for assessment by January 2027.
- We are building our information security management system to the ISO 27001 standard.
- Morpheus AI Ltd is registered with the Information Commissioner's Office and follows UK GDPR.
- Our policies are approved by our directors, reviewed every year and accepted by everyone who works with us.
Where your data lives
Morpheus runs on Microsoft Azure. Our platform and its data are hosted in the United Kingdom and Europe (UK South, West Europe and Sweden Central). Some of the AI services we use can process requests in other regions. Claude models from Anthropic may be processed outside Europe. Our privacy policy lists every provider that handles personal data and where it processes it.
Keeping each fund's data separate
Each fund's data is kept separate from every other fund's. Fund data is not used to train AI models.
Protecting data
- Data is encrypted in transit and at rest, and backups are encrypted.
- Sign-in to company systems uses Microsoft accounts with multi-factor authentication. Customers sign in through a managed identity service.
- Access is based on role, approved by a director and removed within one working day when someone leaves.
- We keep logs of access and activity for a year and have alerts set up for unusual changes.
- Customer data is backed up, and we have a written plan for recovering the service after a major outage.
Our people and devices
- Everyone who works with us signs a confidentiality agreement.
- Everyone accepts our security policies when they join and every year, and completes security awareness training.
- Devices that can reach customer data use disk encryption, a screen lock, anti-malware software and a password manager, and are monitored for compliance.
Software development
Every change to the code is reviewed before it goes live. Development and production environments are kept apart, and we keep source code in a private repository with controlled access.
Suppliers
We assess the security of the suppliers who handle customer data, and we tell customers before we add a new sub-processor that handles their data. Our sub-processors are listed in our privacy policy.
If something goes wrong
We have a written incident response plan. If a personal data breach affects your data, we tell you without undue delay and in any event within 48 hours, so you can meet your own obligations.
Your data, your control
You can ask us to return or delete your data at any time, and we will do so within 30 days. When a contract ends, we keep data for up to two years so that you can pick up where you left off, and then delete it.
Report a security concern
If you have found a security issue, please email hello@usemorpheus.ai. We will reply within two working days. We will not take action against anyone who reports an issue in good faith.