Security
Meridian is built on institutional-grade security from the ground up — from how you authenticate to how every cent is recorded in the ledger.
Our compliance certifications
TLS 1.3
256-bit encryption in transit
FDIC Insured
Customer funds protected
ISO 27001
Information security standard
SOC 2 Type II
Annual security audit
Our security practices
End-to-end encryption
All data is encrypted at rest (AES-256-GCM) and in transit (TLS 1.3). Sensitive secrets — like your 2FA key — are encrypted with a per-instance master key that never leaves the server.
Two-factor authentication
TOTP-based 2FA (Google Authenticator, Authy) is enforced on all admin accounts and available to every customer. One-time recovery codes let you regain access if you lose your device.
Full audit logging
Every admin action, every session event, every account change is written to an append-only audit log with a timestamp, actor, IP, and description. It is immutable — nothing is ever deleted.
Rate limiting
All public endpoints are protected by per-IP rate limiting. Repeated failed login attempts trigger account lockout. Webhook endpoints require valid HMAC signatures.
CSRF protection
Every state-changing POST request requires a valid, per-session CSRF token. Our token format uses cryptographically random bytes and is verified server-side on every request.
Role-based access control
Every admin action is gated by server-side permission checks. Permissions are additive — a role only gets what is explicitly granted. All permission checks are in the application layer, not the database.
"Every line of code, every feature, every decision starts with the question: is this safe for our customers? Encryption, RBAC, and auditability are not add-ons — they are the foundation."— The Meridian Security Team
Security at every step
You authenticate
Login with your email and password. If 2FA is enabled, a TOTP code is required. Sessions are HttpOnly, Secure, SameSite=Lax.
Every action is authorized
RBAC permissions are checked server-side before any data is read or written. Admin actions are logged before they execute.
The ledger is updated atomically
Balance changes happen inside database transactions with row-level locking. The double-entry ledger is balanced before and after every write.
Open your account today
Benefit from institutional-grade security — open your free account in minutes.