# Trust Center: security and data protection · Meridian

> How Meridian protects your apps and your merchants' data: security practices, backups, hosting region, compliance and the vendors we rely on.

Source: https://www.the-meridian.ai/trust

Trust Center

## Security your merchants can trust.

How Meridian protects your apps and your merchants' data: policies, compliance, live status, backups and the vendors we rely on.

[Talk to our team](https://www.the-meridian.ai/contact-sales)

### Your customers’ data, protected.  
How Meridian covers Shopify’s data protection requirements.

Shopify’s 6 security requirements, and how Meridian covers them  
Shopify asks every app that reads customers’ personal details, such as names, emails or addresses, to meet these requirements before it gets access.  
Your app stays responsible for how it uses customer data.  
Source: Shopify’s [protected customer data requirements](https://shopify.dev/docs/apps/launch/protected-customer-data), checked on 10 October 2026. Level 1 requirements (minimum data, consent, retention, merchant agreements) stay with your app.

#### Keep test and production data separate

Development and Production are separate environments, each with its own database, URL and secrets. Staging too, on Enterprise.

#### Have a data loss prevention strategy

Production databases are backed up daily and kept 7 days on Lite, 30 on Pro. Any backup can be restored or downloaded as a SQL dump.

#### Limit staff access to protected customer data

Organization and per-app roles for every collaborator. The database sits on a private network that only your app reaches.

#### Require strong passwords for staff accounts

Two-factor sign-in with an authenticator app or a passkey, on every plan. Single sign-on on Enterprise.

#### Keep an access log to protected customer data

On Enterprise, the activity log records every change made in Meridian, support sessions and database backup downloads: who, when and what.

#### Implement a security incident response policy

Report a vulnerability in Meridian to security@the-meridian.ai. Your app's own incident response policy stays with you.

### At a glance.  
Status, backups and hosting.

[Status  
Live status  
Updated every minute](https://app.the-meridian.ai/status)

Backups  
Daily  
Production, kept 7 days on Lite, 30 on Pro

Hosting region  
EU (Belgium)  
EU or US on Enterprise

### Compliance.  
Standards we follow and documents you can request.

GDPR  
Your merchants’ data is hosted in the EU by default. Privacy questions and data requests go to our privacy team.  
[Contact privacy](mailto:privacy@the-meridian.ai)

Regional hosting  
Choose where your data lives. Available on Enterprise.  
[See Enterprise](https://www.the-meridian.ai/contact-sales)

### Security practices.  
Built into the platform, not bolted on.

Google Cloud infrastructure  
Apps run on Cloud Run. Webhooks travel over Google Cloud Pub/Sub. Google Cloud’s own [SOC 2](https://cloud.google.com/security/compliance/soc-2) and [ISO 27001](https://cloud.google.com/security/compliance/iso-27001) certifications cover the infrastructure Meridian runs on.

Encrypted connections  
Custom domains are verified and served over SSL.

Roles and permissions  
Organization and per-app permissions for every collaborator.

Two-factor and passkeys  
Authenticator apps or phishing-resistant passkeys, on every plan.

SSO and audit logs  
Single sign-on and a full audit trail on Enterprise.

### Sub-processors.  
The vendors that process data on our behalf.

| Vendor | Purpose | Location |
| --- | --- | --- |
| Google Cloud Platform | Hosting, databases and Pub/Sub messaging | EU |
| SendGrid | Transactional and automated email | EU |
| Airwallex | Billing for Meridian subscriptions | EU |
| Sentry | Error monitoring for the Meridian dashboard and API | EU |

### Found a vulnerability?

Report it to our security team. We review every report and keep you posted until it is resolved.

[Report to security@the-meridian.ai](mailto:security@the-meridian.ai)

### Questions.

#### Where is my data hosted?

On Google Cloud, in the EU (Belgium) by default, on every plan. On Enterprise you choose the EU or the US for each environment.

#### How are databases backed up?

Production databases are backed up daily and kept 7 days on Lite, 30 on Pro, and longer as agreed on Enterprise. Any backup can be restored, or downloaded as a standard SQL dump.

#### Is the database reachable from the internet?

No. Each database sits on a private network that only your app reaches. On Pro and Enterprise, you can give one outside system access with its own client certificate, limited to the networks you allow.

#### Is there an uptime SLA?

Yes, with Custom hosting: talk to us. Every plan can follow Meridian's live status on its public status page.

#### Which sign-in protections does Meridian support?

Two-factor authentication with an authenticator app or a passkey on every plan, roles and per-app permissions, and single sign-on with audit logs on Enterprise.

#### How do I report a security vulnerability?

Email security@the-meridian.ai. We review every report and keep you posted until it is resolved.