Your data. Your control.
Meridian is built for organisations that take data security seriously. Australian-hosted, fully encrypted, and designed to meet the compliance requirements of energy and resources companies.
Security infrastructure
Enterprise-grade security, built in from day one
Every layer of Meridian is designed to protect your data, meet regulatory requirements, and give your security team confidence.
Data Residency
Hosted in Australia on AWS Sydney (ap-southeast-2). Your data never leaves Australian jurisdiction unless you explicitly choose otherwise. We support data sovereignty requirements for government and regulated entities.
Encryption
AES-256 encryption at rest for all stored data, including backups and database snapshots. TLS 1.3 enforced for all data in transit. No unencrypted connections are permitted at any layer of the stack.
Access Control
Role-based access control (RBAC) with granular permissions at workspace, project, and scenario level. Enforce least-privilege access, manage team roles, and control who can view, edit, or approve economic models.
Audit Trail
Every action is logged with a timestamp, user identity, and change detail. Know who changed what, when, and why. Audit logs are immutable and retained for the life of your subscription plus 12 months.
Backup & Recovery
Daily automated backups with 30-day retention. Point-in-time recovery available within the retention window. Backups are encrypted and stored in a geographically separate AWS availability zone within Australia.
SOC 2 Type II
We are actively pursuing SOC 2 Type II certification with a target completion date of Q4 2026. Our security programme is built around the trust services criteria of security, availability, and confidentiality.
Compliance
Compliance roadmap
Our security programme is structured around a clear roadmap towards SOC 2 Type II certification.
Infrastructure Security Baseline
CompletedAWS Well-Architected review, VPC isolation, security group hardening, and IAM policy enforcement.
Encryption & Access Controls
CompletedAES-256 at rest, TLS 1.3 in transit, RBAC implementation, and MFA enforcement for all accounts.
Audit & Logging Framework
In ProgressImmutable audit trail, centralised log management, and automated alerting for security events.
Penetration Testing
PlannedThird-party penetration test conducted by an accredited Australian security firm. Remediation of any findings.
SOC 2 Type II Certification
PlannedFormal audit by an independent CPA firm covering security, availability, and confidentiality trust services criteria.
Authentication
- Multi-factor authentication (MFA)
- SSO via SAML 2.0 and OIDC
- Password complexity enforcement
- Session timeout controls
Network Security
- VPC isolation with private subnets
- Web Application Firewall (WAF)
- DDoS protection via AWS Shield
- IP allowlisting available
Data Handling
- Data classification framework
- Automated PII detection
- Data retention policies
- Secure data deletion on termination
Questions about security?
Our team is happy to walk through our security architecture, compliance programme, and data handling practices. We can also complete your vendor security questionnaire.