Your documents, and what we do with them

When you paste text or upload a PDF, the text is extracted on our server, sent to a model provider to produce your memo, and stored in our database against your account so you can open the memo again later. That is the whole journey.

The text is transmitted over TLS 1.2 or better and stored encrypted at rest by our database provider. It is never posted anywhere public, never shared with another user, and never sent to any third party other than the model provider that produces your memo.

Meridian routes across providers. In this deployment the live provider is OpenAI, and the routing table on the How the AI works page shows which model handles which step of the memo. The routing is generated from code, not written by hand.

We use these providers under their business API terms, which prohibit training on API traffic. We do not fine-tune any model on customer decks, we do not use your documents to improve prompts without asking, and we do not sell or license customer text to anyone for any purpose.

Confidential deal documents are sent to a model provider solely to produce your memo and for nothing else. They are not retained by the provider, they are not indexed, and they are not used to train future models.

Access to the production database is limited to the two engineers who operate it, used to fix things rather than to browse. We do not read customer decks for product research.

If you open a support ticket about a specific memo and share the link, we may open that one memo to answer your question. If you would rather we did not, say so in the ticket and we will work from your description instead.

• Memos and the source text stored with them: until you delete them, or until 30 days after you delete your account, whichever is sooner.
• Account records: for as long as the account is open, then 30 days.
• Form submissions from the contact, help and careers forms: 24 months.
• Server logs, which record request paths and timings but not document text: 30 days.
• Backups: rolling 7 days, after which deleted data is gone from backups too.

Delete any single memo from your dashboard, which removes the source text and the memo content with it. Delete your whole account from Settings, which removes every memo, the stored text and the account record.

Both are immediate and neither needs a support ticket. Export any memo from the memo view before deleting if you want a copy. If you want written confirmation of deletion for your own records, email us and we will send it.

Uploaded PDFs are held in memory only for as long as it takes to extract the text, then discarded. We do not keep the original file. The document size limit exists because pitch decks are text, and a file significantly larger than that limit is usually a deck that was exported as low-resolution images, which we cannot read reliably.

• Passwords are hashed with scrypt and a per-user salt. We never store or log a password, and nobody at Meridian can see one.
• Sessions are httpOnly, sameSite cookies signed with a server-side secret, and they expire after 30 days.
• Google sign in is supported so you do not have to keep another password.
• Every request for a memo checks that the memo belongs to the account asking for it, in the database query itself rather than in the page.

• Two-factor authentication is required on every service Meridian uses, with no exceptions and no shared logins.
• Production access is limited to two engineers and reviewed quarterly.
• Dependencies are updated on a weekly cadence and security advisories are actioned within 72 hours for anything reachable from production.
• We do not yet hold a SOC 2 report. We are a pre-seed company and would rather tell you that than imply otherwise. If you need a completed security questionnaire for procurement, email us and we will fill it in honestly.

Email security@meridianalabs.com. We acknowledge within two business days, we will not threaten you for reporting in good faith, and we will tell you when it is fixed. If you want to be credited, say so and we will.