CRM for Finance

Moraph resells, implements and runs Salesforce Financial Services Cloud for banks, credit unions, wealth managers and other financial firms. Sensitive client data is protected with Salesforce Shield Platform Encryption, and Moraph manages the key material in a key service outside Salesforce, so Salesforce does not store the keys that decrypt your data. Moraph also operates the org day to day: changes, releases, access, monitoring and support, under your approval.

The problem it solves

Financial firms want one view of each client relationship, but a CRM holding account numbers, tax identifiers, balances and financial plans is one of the most sensitive systems a firm runs. Security and risk teams ask who can read that data, who holds the encryption keys and what happens if the vendor is compelled or compromised. Meanwhile the CRM itself drifts: customizations pile up, permissions widen, releases arrive on the vendor's schedule, and the in-house admin team spends its time keeping up rather than improving it.

Who it’s for

• Heads of retail, commercial and wealth businesses who want one view of each relationship
• CISOs and third-party risk teams who need to answer for where client data is and who can decrypt it
• CRM and Salesforce administrators who need engineering and operations support
• Compliance officers responsible for privacy, recordkeeping and access to nonpublic personal information
• Internal audit and examiners reviewing controls over customer information

1. DesignMoraph works with your business, security and compliance teams to decide what data the CRM holds, which fields and files are encrypted, how keys are held and who can see what.
2. Build and migrateMoraph configures Financial Services Cloud, sets up Shield Platform Encryption with keys from Moraph's key service, and migrates data from your existing systems in tested loads.
3. OperateMoraph runs the org day to day: change requests, user and permission changes, release testing, monitoring and second-line support, with every change approved by your named owner.
4. Manage keysMoraph operates the key service, rotates key material on the schedule you approve, and handles requests to revoke or destroy keys under dual control, with each action recorded.

Relationship view

Financial Services Cloud brings households, related people and businesses, financial accounts and goals into one view of each client.

Shield Platform Encryption

Salesforce Shield encrypts selected fields, files and attachments at rest, using key material supplied from outside Salesforce.

Keys held outside Salesforce

Using Salesforce's Cache-Only Key Service, key material stays in Moraph's key service; Salesforce fetches it when needed and holds it only in cache, not in storage.

Dual-control key operations

Generating, rotating, revoking or destroying key material needs two Moraph operators and your key custodian's approval, and every action is logged.

Least-privilege access model

Profiles, permission sets and sharing rules designed so each role sees the clients and fields it needs, with field-level security on sensitive data.

Event monitoring

Where Shield Event Monitoring is licensed, Moraph reviews logins, report exports and API access for patterns that need attention and escalates them to you.

Field history retention

Where Shield Field Audit Trail is licensed, changes to sensitive fields are kept for the retention period you set, for compliance and investigations.

Release management

Changes and Salesforce seasonal releases are tested in sandboxes and deployed through a recorded release process with your sign-off.

Referrals and action plans

Financial Services Cloud's referral and action plan features configured for how your teams pass leads and run onboarding and review tasks.

Managed change control

Every change, from a new field to a permission set, goes through a request, approval, sandbox test and recorded deployment.

Access reviews

Periodic reports of who holds which permissions and who can see encrypted data, for your managers and security team to confirm or remove.

Third-party risk evidence

A pack describing key custody, encryption scope, access controls and change history, for your vendor risk and audit teams.

Relationship manager or advisor

Works client relationships in the CRM, seeing the clients and data their role allows

Client CRM owner

Owns the CRM for the business, sets priorities and approves changes

Key custodian

Approves key rotation, revocation and destruction on behalf of your institution

Compliance officer

Reviews access to nonpublic information, retention and evidence

Moraph Salesforce engineer

Builds and deploys approved changes and supports users

Moraph key operator

Runs the key service and carries out approved key actions under dual control

Core banking

Customer, account and balance data from your core system loaded on a schedule or through an integration layer, so relationship managers see current holdings.

Wealth and custody platforms

Holdings, positions and account details from your wealth or custody platform for advisors' views of client assets.

Moraph key service

Salesforce's Cache-Only Key Service calls Moraph's key service for key material over an authenticated connection.

Identity provider

Staff sign in to Salesforce through your identity provider using SAML single sign-on, so your MFA and leaver process apply.

Electronic signature

Documents generated from the CRM sent for signature through a signing platform such as DocuSign, with the status returned to the record.

Marketing and communications

Consent and preference data shared with your marketing platform, so campaigns respect what clients have agreed to.

Data warehouse and SIEM

CRM data delivered to your data warehouse, and event monitoring data to your SIEM, where licensed.

Keys outside Salesforce

Key material for Shield Platform Encryption is generated and held in Moraph's key service, and Salesforce holds it only in cache.

Dual control and your approval

Moraph staff cannot use key material without your explicit, time-bound authorization and a second operator; every key action is logged.

Single sign-on

Staff sign in through your identity provider, so your password, MFA and leaver policies apply.

Role-based access

What each person sees follows their profile, permission sets and sharing rules; Moraph's engineers and key operators have separate, limited roles.

Complete audit trail

Configuration changes, deployments and key actions are recorded with the person, approval and time, and Salesforce's setup audit trail records administrator changes.

Key service hosting

Moraph's key service runs in the region you choose: the United States, the United Kingdom or Australia, and is covered by Moraph's SOC 2 Type II and ISO/IEC 27001 audits.

New org through Moraph

Moraph resells Financial Services Cloud and Shield and builds a new org, with key material held in Moraph's key service.

Your existing org

If you already use Salesforce, Moraph reviews the org, adds Shield encryption with Moraph-held keys where you license it, and takes over operation.

Client-held keys

If your policy requires your institution to hold key material itself, Moraph can run the org while you operate the key service, with the split written into the responsibilities.

Discovery and data classification

We map business processes and data sources, and classify sensitive fields and files with your security and compliance teams.

Key custody design

We agree how key material is generated and held, who approves key actions, the rotation schedule and what happens if keys are unavailable.

Org configuration

Financial Services Cloud is configured in a sandbox for your relationship model, roles and processes, with the access model built in.

Encryption and testing

Shield Platform Encryption is applied to the agreed scope and tested, including the effect on search, reports and integrations.

Integration and migration

Integrations are built and data is migrated in trial loads, reconciled with your team before the production load.

Go-live and handover

Users are trained, the production org goes live, and change control, approvers, key procedures and reporting move into day-to-day operation.

• Moraph is not Salesforce. Salesforce operates the platform, and Salesforce's own service commitments, roadmap, maintenance and outages apply.
• Licences are subject to Salesforce's terms. Shield Platform Encryption, Event Monitoring and Field Audit Trail are add-ons that need their own licences.
• Shield encrypts data at rest. Users your access model allows to see a field see it in clear; encryption does not replace good permissions.
• Encrypting a field limits some Salesforce functions on it, such as certain search, sort, filter and formula uses, as Salesforce documents. These are reviewed during design.
• If the key service cannot be reached and cached key material has expired, encrypted data cannot be read until it is restored. Destroyed key material makes the data it protected unrecoverable.
• Salesforce briefly holds key material in cache while using it; holding keys outside Salesforce controls storage and revocation, not every moment of use.
• Moraph does not decide what data your institution collects or keeps; data classification, retention and privacy decisions are yours.
• Not every field type and file can be encrypted with Shield. The encryption scope is limited to what Salesforce supports.

• List the sensitive fields and files you would encrypt and review the effect on search, reports and integrations
• Ask your third-party risk team to review the key custody design and its evidence
• Walk through a key rotation from request to recorded action
• Walk through a change request from approval to recorded deployment
• Review what happens to users if the key service is unavailable
• Confirm the split of responsibilities between Moraph, Salesforce and your team