How we protect your data.
You're trusting us with your portfolio, not just your email address. Here's exactly what that means in practice.
Authentication & MFA
Accounts are authenticated through AWS Cognito. Multi-factor authentication is available via authenticator app (TOTP) or SMS, and can be required before sensitive actions.
Encrypted in transit & at rest
All traffic between your browser and Meridian is encrypted over TLS. Your data is stored in an encrypted AWS Aurora database — nothing is written to disk in plain text.
Rate limiting & abuse protection
Login and API requests are throttled by a dedicated rate limiter, making brute-force and credential-stuffing attempts impractical against your account.
Audit logging
Every request across our APIs flows through an audit pipeline (CloudWatch → Firehose → S3), giving us a durable, queryable record for investigating any incident.
Payments via Stripe
Billing is handled entirely by Stripe. Your card details are sent directly to Stripe’s PCI DSS-compliant infrastructure — Meridian never sees or stores them.
No brokerage access
Meridian never connects to, authenticates with, or requests access to your brokerage or bank. Holdings are entered manually — there is no read or write access to any external financial account.
Hosted in Canada
Our infrastructure runs on AWS in the Canada (Central) region. Your data doesn’t need to leave the country to be analyzed.
Meridian is a research tool, not a broker or investment advisor — we never have access to move or withdraw your money.