Independently checked · October 2026

Our TLS setup scores A+ on SSL Labs, and you don't have to take our word for it.

Every scanner below is run by a third party. Click any badge to re-run the scan against Meridian yourself. No login required, no cooperation from us needed.

A+

SSL Labs

TLS & transport encryption. A+ on thenovasystem.com, checked 25 October 2026 · TLS 1.3 · HSTS preload.

Verify on ssllabs.com →
A+

Mozilla Observatory

Web security headers. A+ on thenovasystem.com, 12 of 12 tests passed, checked 25 October 2026.

Verify on mozilla.org →

AES-256 at rest

Records and documents are encrypted at rest. Files in a case's drive use a key that belongs to your firm.

Multi-tenant isolation

Built for PIPEDA and BC PIPA. Every firm's data is walled off. Firm A can't see Firm B's.

Our iron-clad data promise

Your client data is yours. Period.

The #1 concern every RCIC has before adopting new technology. We built Meridian around this principle from day one.

  • We store your client data only to run Meridian for you.
  • Your client conversations belong to you and your firm alone. We understand the CICC Code of Professional Conduct and the rules around consultant-client privilege.
  • When you subscribe, you control exactly who sees what. Full stop.

Never sold

Never sold or shared for advertising. The providers that run the service are listed on our sub-processors page.

Consent-gated access

Files in a case's drive are encrypted with a key that belongs to your firm. Staff access needs the owner's approval, can be revoked in one click, and every action is logged.

Designed around the CICC Code

Designed around the CICC Code. Compliance stays with the licensee.

100% data ownership

Export anytime. Delete anytime. Cancel anytime and everything goes with you. No lock-in contracts, no hostage games.

Encrypted at every step

TLS on every connection and AES-256 at rest. Files in a case's drive use a key that belongs to your firm. No crossover between firms.

Built for PIPEDA

Built to follow PIPEDA's ten principles, and BC and Alberta PIPA.

Where we stand

Honest compliance status.

What is in place today, labelled plainly. No dressing up.

Breach notice without undue delay, as PIPEDA requires CASL compliant SOC 2 Type II · not certified yet Early access · no contractual uptime guarantee yet

Read our complete Privacy Policy, Terms of Service, or browse the full Legal & Trust Center.

Questions about your data? Ask directly.

Security is the first thing every RCIC asks about. We'll walk you through data isolation, audit logs, and exporting your data, on a sample account.

Join the waitlist

We are not adding new firms until the next version is ready to release. Tell us about your practice and you go on the list. You hear from us first when it opens, with a walkthrough on a sample case file.

You are on the list.

We have your details. You will hear from us first when the next version opens.