Security at Morpheos

Responsibility

Morpheos LLC designs, builds, and operates AI tools, workflow systems, and data platforms for organizations handling sensitive and compliance-relevant information. Brandon Hogstad, PhD, Founder and Security Lead, is responsible for the security of every Morpheos-operated system and client implementation.

How we build

Access is least-privilege, with single sign-on where the client's environment supports it. Sensitive data stays in client-controlled or self-hosted environments when requirements call for it. Secrets are managed outside source code. Code, dependencies, and configuration are reviewed before deployment and after significant changes. Administrative access to managed infrastructure runs over encrypted private networking.

Authorized testing only

When an engagement includes security assessment, testing happens only with written authorization from the system owner, within a defined scope, approved environments, permitted methods, and a documented testing window. Findings go to the authorized client contact with remediation recommendations. Morpheos does not test third-party, public, or client systems outside an authorized engagement.

AI-assisted security work

Morpheos uses AI models, including frontier models, to assist with code review, vulnerability analysis, and remediation. This work is limited to systems Morpheos owns or operates and to client systems within an authorized engagement scope.

Reporting a vulnerability

To report a security issue in a Morpheos-built system, email [email protected].

Last updated October 2026