Security
This page sets out how Merido handles the financial information you import. It covers where your data lives, how it is protected, how we govern it, and who has access. It then covers deleting your data, reporting a security problem, our registration, and what we do not yet have.
Where your data lives
Merido runs on Amazon Web Services in London. Your account and your financial information are stored there and stay in the United Kingdom. A small number of other companies handle limited data on our behalf, under contract, and none may use it for their own purposes. Our sub-processor list names each one, what it does, where it processes data, and the safeguard that covers it.
How it is protected
- Every connection is encrypted with TLS 1.3 in modern browsers, and never below TLS 1.2. TLS 1.3 is the latest version of the standard that secures traffic across the internet. That covers your browser to Merido, Merido's edge to its servers, and the app to its database. Unencrypted connections are refused on every leg.
- Your data is encrypted where it is stored, using AES-256 with keys held in AWS Key Management Service. That covers the database, its backups and the server's disk.
- The database is not reachable from the internet. It runs in a private network inside our AWS account.
- Credentials such as database passwords live in an encrypted secrets store inside AWS. Merido's servers fetch them at start-up, and they are never written into code, configuration files or any device we use.
- The app measures how it is used without cookies. Nothing is stored on your device unless you turn on Help improve Merido in Settings. Every piece of text is masked in your browser before anything is sent. This website sets no cookies.
How we govern it
Access to your data is governed by written policies. Each is versioned, approved by the directors, and reviewed at least once a year.
- A production access policy: who holds access, by which routes, for which purposes, and what happens when someone leaves.
- A breach response procedure, with the 72-hour deadline for telling the Information Commissioner's Office (ICO) written into it.
- A retention schedule that sets a fixed period for every kind of data we hold, matched to the privacy notice.
- A data protection impact assessment (DPIA), a record of processing activities (ROPA), and a legitimate interests assessment (LIA) for each use that relies on one.
- An annual review of every provider that handles personal data, including where their own suppliers process it.
These documents are available on request to customers and partners. Email security@merido.co.uk.
Who has access
Under the access policy above, two people can reach the systems Merido runs on: the company's two directors. This page calls them the administrators. Nobody else at Merido has access. Administrators go into production only to run the service: to fix a fault, to act on a request from you, or to maintain the system. Looking at customer records for any other reason is not permitted, and the logs show who did what.
- Each administrator signs in with a hardware security key. Every session is recorded, and every action is attributable to one administrator by name.
- Administrators develop and test with fictional data. Your data is never copied out of production.
No other customer can access your data. Every row in the database is tagged with the account it belongs to, and the database enforces that boundary itself. The app connects as a role that can only read and write the rows of the account signed in on that request. A mistake in the app's code cannot widen that to another account, because the rule lives in the database rather than in the app. This is Postgres row-level security, and our tests check it against the live schema.
What we collect, and what we never do with it, is set out in the privacy notice.
Deleting your data
You can delete your account from Settings at any time, or ask us to do it for you. Deletion removes your account and everything you imported. In practice it is immediate, and it is complete within one month at most. It cannot be undone. Backup copies expire within 24 hours. The privacy notice sets out how long we keep every other kind of information, such as email you send us.
Reporting a security problem
If you think you have found a security problem in Merido, email security@merido.co.uk. We read every report and reply to each one. We ask two things in return: give us a reasonable time to fix the problem before you publish it, and do not access, change or delete data that is not yours. The public demo holds fictional data, if you need somewhere safe to look. Our contact details are also published at /.well-known/security.txt, the standard place for them.
Registration
Merido Technologies Ltd has paid the data protection fee to the Information Commissioner's Office. Our registration reference will appear here once the ICO issues it.
What we do not yet have
Merido is in early access. Some of the things a larger company would show here are not in place yet. We would rather say so than imply them.
- We hold no security certification yet. Cyber Essentials, the UK government-backed scheme, is the first we intend to obtain, and it will appear here when we do.
- No independent penetration test has been carried out yet. We will publish a summary here when one has.
Questions
Email privacy@merido.co.uk. The administrator responsible for data protection reads that inbox. Our privacy notice covers what we collect and your rights over it, and our terms cover the service itself.