Bank-grade by design. Boring on purpose.

Your money is held in segregated accounts at regulated partner banks. It is never lent out, never co-mingled with Meridian's company assets, and never used to fund company operations. In the unlikely event of Meridian ceasing operations, customer balances remain fully accounted for at the partner bank.

Every Meridian account is protected by a second factor at sign-in and before sensitive actions like withdrawals or adding a new payee:

• Time-based codes from any authenticator app (Google Authenticator, 1Password, Authy, and similar).
• Hardware security key support (WebAuthn / FIDO2) for the strongest phishing-resistant protection.
• Device approval — new devices must be approved from a trusted one before they can sign in.

Data is encrypted in transit and at rest, at every layer of our stack:

• TLS 1.3 for all traffic between your device and our servers.
• AES-256 encryption for data at rest, including database and backup storage.
• Short-lived, scoped API tokens for every request — no long-lived credentials on the wire.

Every transfer flows through an anomaly-detection pipeline that scores it against your normal behaviour and known fraud patterns. Suspicious activity triggers an immediate account freeze and an out-of-band notification, so nothing moves until you confirm it was you.

To open an account, we verify your identity with a government-issued ID, proof of address, and a live selfie check. This meets our regulatory obligations and — just as importantly — makes it materially harder for anyone else to open an account in your name or take over an existing one.

If you believe you've found a vulnerability or security issue, please email support@getmeridian.online. We investigate every report, acknowledge receipt within one business day, and will keep you informed until the issue is resolved. We do not pursue legal action against researchers who act in good faith and follow responsible disclosure.