meridian
Start free trial

Trust Center

Security your merchants can trust.

How Meridian protects your apps and your merchants' data: policies, compliance, live status, backups and the vendors we rely on.

Talk to our team

Your customers’ data, protected.
How Meridian covers Shopify’s data protection requirements.

Shopify’s 6 security requirements, and how Meridian covers themShopify asks every app that reads customers’ personal details, such as names, emails or addresses, to meet these requirements before it gets access.Your app stays responsible for how it uses customer data.Source: Shopify’s protected customer data requirements, checked on 10 October 2026. Level 1 requirements (minimum data, consent, retention, merchant agreements) stay with your app.
Keep test and production data separate

Development and Production are separate environments, each with its own database, URL and secrets. Staging too, on Enterprise.

Have a data loss prevention strategy

Production databases are backed up daily and kept 7 days on Lite, 30 on Pro. Any backup can be restored or downloaded as a SQL dump.

Limit staff access to protected customer data

Organization and per-app roles for every collaborator. The database sits on a private network that only your app reaches.

Require strong passwords for staff accounts

Two-factor sign-in with an authenticator app or a passkey, on every plan. Single sign-on on Enterprise.

Keep an access log to protected customer data

On Enterprise, the activity log records every change made in Meridian, support sessions and database backup downloads: who, when and what.

Implement a security incident response policy

Report a vulnerability in Meridian to security@the-meridian.ai. Your app's own incident response policy stays with you.

At a glance.
Status, backups and hosting.

StatusLive statusUpdated every minute
BackupsDailyProduction, kept 7 days on Lite, 30 on Pro
Hosting regionEU (Belgium)EU or US on Enterprise

Compliance.
The standards we follow and our data processing agreement.

GDPRYour merchants’ data is hosted in the EU by default. Privacy questions and data requests go to our privacy team.Contact privacy
Data Processing AgreementThe European Commission’s standard contractual clauses, signed by Meridian and part of the Terms of Service. Nothing to sign or send back.Download the DPA (PDF)
Regional hostingChoose where your data lives. Available on Enterprise.See Enterprise

Security practices.
Built into the platform, not bolted on.

Google Cloud infrastructureApps run on Cloud Run. Webhooks travel over Google Cloud Pub/Sub. Google Cloud’s own SOC 2 and ISO 27001 certifications cover the infrastructure Meridian runs on.
Encrypted connectionsCustom domains are verified and served over SSL.
Roles and permissionsOrganization and per-app permissions for every collaborator.
Two-factor and passkeysAuthenticator apps or phishing-resistant passkeys, on every plan.
SSO and audit logsSingle sign-on and a full audit trail on Enterprise.

Sub-processors.
The vendors that process data on our behalf.

VendorPurposeLocation
Google Cloud PlatformHosting, databases and Pub/Sub messagingEU
SendGridTransactional and automated emailEU
AirwallexBilling for Meridian subscriptionsEU
SentryError monitoring for the Meridian dashboard and APIEU
AnthropicThe in-app assistant, and the analysis of Shopify API changesUS
Voyage AIText embeddings for the in-app assistantUS
CursorMeridian's internal support agentUS
Google Cloud Platform

Hosting, databases and Pub/Sub messaging

Location: EU
SendGrid

Transactional and automated email

Location: EU
Airwallex

Billing for Meridian subscriptions

Location: EU
Sentry

Error monitoring for the Meridian dashboard and API

Location: EU
Anthropic

The in-app assistant, and the analysis of Shopify API changes

Location: US
Voyage AI

Text embeddings for the in-app assistant

Location: US
Cursor

Meridian's internal support agent

Location: US

Found a vulnerability?

Report it to our security team. We review every report and keep you posted until it is resolved.

Report to security@the-meridian.ai

Report abuse

Report abuse of an app hosted on Meridian (phishing, malware or spam on the-meridian.app, or on a custom domain that points at edge.the-meridian.app) to security@the-meridian.ai. Include the full URL, a screenshot and when you saw it.

Questions.

Where is my data hosted?

On Google Cloud, in the EU (Belgium) by default, on every plan. On Enterprise you choose the EU or the US for each environment.

How are databases backed up?

Production databases are backed up daily and kept 7 days on Lite, 30 on Pro, and longer as agreed on Enterprise. Any backup can be restored, or downloaded as a standard SQL dump.

Is the database reachable from the internet?

No. Each database sits on a private network that only your app reaches. On Pro and Enterprise, you can give one outside system access with its own client certificate, limited to the networks you allow.

Is there an uptime SLA?

Yes, with Custom hosting: talk to us. Every plan can follow Meridian's live status on its public status page.

Which sign-in protections does Meridian support?

Two-factor authentication with an authenticator app or a passkey on every plan, roles and per-app permissions, and single sign-on with audit logs on Enterprise.

How do I report a security vulnerability?

Email security@the-meridian.ai. We review every report and keep you posted until it is resolved.