Security and data boundaries
MeroFoundry is operated by MERO Consulting Inc. on infrastructure we own and administer from Linode LLC.
Safeguards
These are the controls we represent in our Privacy Policy.
Transport
TLS encryption for information transmitted to and from the Service. HTTPS is enforced on all public surfaces, certificates are issued by Let's Encrypt and renewed automatically, and HTTP requests are redirected.
Credentials at rest
Service credentials are encrypted at rest.
Access
Role-based access controls and audit logging.
Supply chain
Automated dependency, secret, and container scanning in the development and build process, with findings tracked to closure in a managed defect tracker.
Application protection
A web application firewall running the OWASP Core Rule Set inspects requests to production.
Your side of the line
Customers are responsible for configuring their applications, roles, credentials, integrations, and access controls appropriately, and for the prohibited-data restrictions on this page.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Any breach-notification commitment applies only under a Data Processing Addendum or other agreement effective with the applicable customer.
Compliance and Regulation
MeroFoundry is not ISO27001, SOC2, or NIST Certified. Do not store payment card data, protected health information, biometrics, children's data, credentials, or government records requiring a compliance boundary we do not hold.
Hosting
MeroFoundry runs on Linode LLC compute owned and administered by MERO Consulting Inc., in data centers in the United States.
The Service is intended for U.S.-focused business use. We do not currently represent that it is configured for regulated international transfers.
Reporting a security issue
Write to security@merofoundry.com. It is monitored.
For more detail about MeroFoundry's security and hosting, contact sales@merofoundry.com with your questions.