Security
Security is part of every build, not an add-on. Here’s what that means in practice: how we protect the software we build and host, how we handle sensitive data and AI, and how to report a problem.
How we build
The same baseline goes into every client project and every product we run ourselves.
Encrypted in transit
Every site we host is HTTPS-only, with TLS 1.2 or newer, HSTS, and certificates issued and renewed automatically by AWS.
Hardened by default
A strict Content Security Policy, clickjacking protection, and modern security headers go on every response, not just the login page.
Firewall and rate limits
Public APIs sit behind a web application firewall with managed rule sets and per-visitor rate limits. Requests that try to go around it are rejected.
Your data, isolated
Storage is private and served only through our CDN. In multi-tenant products, each customer’s data is separated in the database itself with row-level security, not just in application code.
Secrets stay secret
API keys live in a managed secrets store, never in source code. Credentials our customers connect are stored encrypted, and the application’s own database role can’t read them.
Email you can trust
We set up SPF, DKIM, and DMARC, so it’s hard for anyone to send convincing email that pretends to be your domain.
Healthcare and sensitive data
We’ve built and run systems that handle protected health information. That work runs on AWS under a signed Business Associate Agreement, with each client’s files isolated in encrypted storage and administrative access protected by multi-factor authentication.
If your project involves health, financial, or other regulated data, we scope those requirements before we write any code, so they shape the design instead of being bolted on at the end.
AI that can’t act on its own
When an AI feature can reach your connected accounts, it proposes and a person approves. Nothing is sent, posted, or scheduled until someone on your team says yes. We treat pasted documents, emails, and web pages as untrusted input, because that’s where prompt-injection attacks come from.
We use the business APIs of model providers, which don’t train on your data by default. Spending limits keep a runaway request from turning into a runaway bill.
After launch
Patched and watched
Hosting on every plan includes uptime monitoring, security patching, and backups with one-click rollback. It’s part of the monthly price, not an extra.
We review our own work
We run security reviews on the software we operate and fix what we find. This website was reviewed end to end in September 2026, and every finding was closed.
You own your data
Your domain, content, and data belong to you from day one. If you ever leave, you take them with you.
Report a vulnerability
If you believe you’ve found a security issue in anything we build or host, email meridiantechllc@meridian-hq.com with “Security report” in the subject. Include what you found, where, and the steps to reproduce it. We aim to reply within one business day.
Please act in good faith: don’t access or change data that isn’t yours beyond what’s needed to show the problem, don’t disrupt service, and give us a reasonable chance to fix it before you share details. We won’t pursue anyone who follows these guidelines. Our security.txt has the same contact details.
What we don’t claim
We’re a focused engineering studio, not an audited enterprise vendor. We don’t currently hold SOC 2 or ISO 27001 certification, and we won’t imply that we do.
If your procurement team needs a security questionnaire, a walkthrough of our controls, or specific commitments in your contract, tell us. We’ll answer plainly.
Have a security question about your project?
Ask before you commit. We’ll tell you exactly how we’d handle it.
Talk to us