Security and trust
How we protect your organization's records
MERIDIAN holds the financial records of schools and early-childhood programs, Head Start programs, nonprofits, churches, health providers and small businesses. This page says plainly what protects them today, who else handles data for us, and what is still to come.
What is built and running
Each item below is in the product today. Most are also checked by our daily automated control tests.
Your data is walled off In place
Every table in the database uses row-level security: a person can read only the organizations they belong to. A daily check confirms no table is missing it.
Second factor for finance roles In place
Treasurers, trustees, finance committee members and external auditors must use an authenticator app. The database itself refuses them without it. Sign-in uses one-time email codes, so there are no passwords to steal.
We see your records only with your permission In place
Our staff cannot browse customer records. Your treasurer grants access for a set time (at most a year) and can revoke it. Your treasurers and trustees are notified when a session opens, and every file opened is logged where you can see it.
Records that cannot be quietly changed In place
Saved readings, signed-off reports, the change log (who changed what, with before and after values) and legal records are append-only: the database refuses edits and deletion.
Legal requests under two-person control In place
A response to legal process needs counsel review and a second approver, is limited to what the process requires, is logged permanently, and you are told unless a court order forbids it. A legal hold preserves records while it is in force.
Your own protection level In place
Each organization chooses whether undoing or voiding records only notifies, waits 24 or 48 hours, or needs a second treasurer or trustee to approve.
Encryption In place
All traffic uses HTTPS. Our database and file storage provider encrypts data at rest, as its documentation states. Files and evidence carry SHA-256 fingerprints so changes are detectable.
Strict browser security In place
A strict Content-Security-Policy blocks inline script, plugins and framing by other sites, and everything shown on screen is escaped. Automated tests check both before each release.
Keys stay on the server In place
Service keys live only in our hosting provider's protected settings, never in the browser or the code. Payment webhooks are accepted only with a valid signature.
Limits against abuse In place
Sensitive and costly actions are rate-limited per person and per organization, and AI use is metered against your plan and the cap your treasurer sets.
Daily control tests and tamper-evident evidence In place
Every day our system records its security configuration as evidence, chains each item to the last by its fingerprint, tests each control, and alerts us when one fails.
Hourly security monitoring In place
Every hour our system sends any waiting security notices to your treasurers and trustees and looks for signs of an attack in progress: bursts of sign-in code requests or second-factor challenges, repeated requests for an organization a person does not belong to, unusual numbers of exports, legal productions or protected actions, new outside-auditor logins, a second factor removed from a finance account, rate-limit spikes, legal or PLC access activity at night, and payment webhooks with a bad signature. We are emailed when one appears, with counts only, and each hourly run is recorded as evidence. Failed sign-in codes themselves are not recorded by our sign-in provider, so we watch the requests it does record.
Written policies In place
Information security, access control, acceptable use, change management, incident response, continuity and backup, vendors, data classification and retention, encryption, secure development, risk assessment and privacy. Reviewed every year.
Controls in your hands
- AI on or off. Turn AI features off for your organization and nothing is sent to an AI provider. Every screen still works by hand.
- Protection level. Notify, delay or require a second approver for undo and void actions.
- Who has access. Your treasurers and trustees add and remove people and roles; external auditor access must have an end date.
- PLC access. You decide whether we can see your workspace, for how long, and you can end it at any time.
- Export. A treasurer can export your organization's records and files at any time without asking us.
How your data is handled
- Each organization's data is its own. We use it only to run MERIDIAN for you. We do not sell it, use it for marketing, or use it to train AI models.
- Cards never touch us. Card details are entered into Stripe's own fields and pages; they never reach our servers.
- Our owner console shows business figures only (plan, billing, counts), never your ledgers, statements, donations or documents.
- Student records. MERIDIAN is built for financial records, not student records. If a school stores records that identify a student, we handle them as a school official under the school's direct control and do not redisclose them (FERPA, 34 CFR 99.31 and 99.33).
- Health information. We do not accept protected health information today.
- If something goes wrong. If your organization's personal information is affected, we tell your treasurers and trustees immediately, and within 24 hours at most, and support the notices you need to send. We follow the New Jersey and Pennsylvania breach-notification laws and any other state law that applies.
Subprocessors
The companies that run parts of MERIDIAN for us, and what each one handles.
| Company | What it does | Data it handles |
|---|---|---|
| Vercel | Hosts the website and the application's server functions | All traffic to the site passes through it; short-lived platform logs |
| Supabase | Database, sign-in and file storage | Your records and files, the names and emails of the people you add, authenticator enrollments |
| Stripe | Payments and subscriptions | Card details (entered directly with Stripe), billing name, email and address |
| Resend | Email delivery | Recipient addresses and the content of notices and receipts |
| Anthropic | AI features, when your organization has AI on | Only the text or file a person chooses to send to an AI feature |
| OpenAI | AI features (a fallback for Anthropic), when AI is on | Same as above |
We review each provider's security reports and terms every year. We will update this list before a new provider handles customer data.
In progress
Stated as it is. None of these is in place yet.
Database backups Not yet
Our database plan does not include backups today. We will move to a plan with daily backups before we store paying customers' records, then add point-in-time recovery and test restores every quarter. Until then, keep your own exports.
Independent SOC 2 examination Planned
Our controls are mapped to the SOC 2 criteria and tested daily so an independent examination can begin from existing evidence. We have not been examined yet.
Independent penetration test Planned
Our code and database have had internal security reviews and a re-test. An outside test, repeated every year, is planned for 2027.
Cyber and professional insurance Planned
Cyber liability and errors-and-omissions coverage are planned and not in force today.
Continuity for a small company Planned
Princeton Ledger & Consulting is a small company. A written continuity arrangement with a named trusted person, to keep the service running or return every organization's data in order, is planned.
Accessibility review Planned
We design to WCAG 2.1 AA. A formal review and accessibility conformance report (VPAT) are planned.
Frameworks we map to
Our controls are mapped to these frameworks so reviewers can follow them. Mapped is not certified.
- SOC 2 Trust Services Criteria
- ISO/IEC 27001:2022 Annex A
- NIST CSF 2.0
- CIS Controls v8
- PCI DSS v4.0 SAQ A
- FERPA
- NJ and PA breach notification
- HIPAA Security Rule (only if PHI is ever accepted)
Security questionnaire
Our answers to the questions districts, nonprofits and churches usually ask: data location, encryption, access control, MFA, logging, incident response, retention, subprocessors, FERPA, accessibility, insurance and audit status.
Send us your own questionnaire or data privacy agreement and we will complete it. Policies are available on request.
Report a security issue or ask a question
Email info@princetonledgerconsulting.com, or call or text (215) 805-1364. We acknowledge security reports within two business days. Please do not test against other customers' data.