What Meridian is, and is not

What is true

Meridian does not have a SOC 2 report. Do not tell a buyer that it does. Sign-in is per account. Briefings are not a public gallery. Card numbers stay at Stripe. A Firm pull runs a single read-only SELECT. Spreadsheet profiling runs in the browser.

Uploading a file is not a signed DPA. The Firm draft says Meridian processes the export to compute the briefing, sends computed metrics to the model that writes the memo, does not sell the file, and deletes a briefing when the account deletes it. Send the draft. Do not call it executed. SSO settings are not a live login until the server secret is set.