Meridian Payments Security

1. Approach

Security follows least privilege, separation of duties, tenant isolation, and verifiable financial change. This page describes product controls and makes no claim of certification that has not been obtained.

2. Accounts

• Argon2id password hashing;
• email verification and secure account recovery;
• short-lived access sessions and refresh-session rotation;
• secure cookies and CSRF controls;
• mandatory TOTP for administrators and optional TOTP for merchants;
• global session revocation and a device log.

3. Payment and personal data

PAN and CVV are never stored. Payer PII is separated from merchant data and encrypted with AES-256-GCM. Merchant responses, exports, and webhooks contain no PII. Administrative reveal is a dedicated protected operation recorded in the audit trail.

4. Financial integrity

• immutable double-entry ledger;
• money values without floating point;
• idempotency for write operations;
• fee, FX, and T+N snapshots at transaction time;
• balance reservation for payouts;
• audited early release and manual FX fallback.

5. API and webhooks

• API keys are stored as hashes and shown once;
• merchant webhooks use HMAC-SHA256 signatures;
• HTTPS is mandatory and private-network targets and unsafe redirects are blocked;
• delivery attempts are idempotent and logged;
• tenant filtering runs server-side on every request.

6. Infrastructure and observability

Stateless services scale independently. Background work uses lease/locking and an outbox. Structured logs must exclude secrets and clear-text PII. Health checks, backups, and recovery procedures are validated regularly.

7. Reporting a vulnerability

Do not publish the issue or access another user’s data. Send a description, reproduction steps, and impact estimate through the contact form with the subject “Security.” We will acknowledge receipt and arrange a secure channel for details.