Security at Meridian

Data isolation

Meridian is multi-tenant: every advisory firm's data lives in the same database but is strictly isolated using PostgreSQL Row-Level Security (RLS) via Supabase. Every query is scoped to the authenticated firm — one firm cannot query, see, or accidentally receive another firm's client data, even in the event of an application-level bug.

Encryption

• All data in transit is encrypted via TLS.
• All data at rest is encrypted at the database and storage layer (Supabase/AWS infrastructure defaults).

Authentication

• Managed via Supabase Auth.
• Passwords are hashed and never stored in plain text.
• Two-factor authentication and single active-session enforcement (a new login invalidates any prior session) are on our near-term roadmap.

Infrastructure

• Application: hosted on Vercel, deployed from a private GitHub repository.
• Database: Supabase (PostgreSQL), hosted on AWS eu-west-1 (Ireland).
• Access to production infrastructure is restricted to authorised personnel only.

Backups

• Automated daily backups, retained on a rolling 30-day window.

Data separation: illustrative vs real client data

Meridian does not distinguish between real and illustrative client data — both are treated with the same security controls at all times.

Vendor transparency

Our full list of sub-processors (infrastructure and service providers who may process data on our behalf) is published and kept current: see our Sub-processor List.

Incident response

In the event of a security incident affecting Customer data, Meridian will notify affected firms without undue delay, consistent with the notification timeline in our Data Processing Agreement.

Reporting a vulnerability

If you believe you've found a security issue, contact support@meridiancashflow.com. We ask that you report responsibly and do not access or modify data beyond what's needed to demonstrate the issue.