1. Scope
This policy explains how Meridian stores, secures, retains, and deletes the data you and your clients put into the platform: Polaris, Aurora, the Meridian Bar, and the automatic form filler.
2. What we store
Client and case records, uploaded documents, messages, form data and generated forms, calendar and booking data, and operational metadata and logs.
3. Where Customer Data is hosted
Customer Data is hosted on Cloudflare's infrastructure with a Western North America location. It may be stored and processed in the United States or Canada. Each firm's data is kept separate from every other firm's. The providers we use are named on our Sub-processors page.
4. Encryption
Data is encrypted in transit (TLS 1.3) and at rest (AES-256), with per-tenant isolation so one firm can never access another firm's data.
5. Storage allowances
Each plan includes a storage allowance (see the Pricing Terms). Documents, tenant backups, and attachments count toward it. Additional storage is available as an add-on, and we may notify you as you approach the limit.
6. Retention
Customer Data is kept for the life of your subscription plus a 30-day grace period after termination (for export or recovery), then deleted from production and purged from backups on the normal cycle. Billing records are kept for approximately seven years (legal and tax requirements); support records for approximately two years; security and audit logs for approximately twelve months. These periods match the Privacy Policy and the Data Processing Addendum.
7. Backups & recovery
We take hourly snapshots of the database and the key-value store, and the database can be restored to any minute in the last 30 days. Uploaded documents are not covered by these backups. Backups are access-controlled and used only to restore service.
8. Export & deletion
You own your data and can export or request deletion at any time (see Account Deletion).
9. No model training
Stored Customer Data is never used to train any third-party AI model. To deliver the features you use, Meridian AI sends requests to our AI providers, who are named on our Sub-processors page.
10. Your responsibilities
Do not store content prohibited by the Acceptable Use Policy; you are responsible for the accuracy and lawfulness of what you upload.