Artifact: Diligence
Procurement Packet
Representative sample only. Buyer-inspectable evidence of Meridian intake infrastructure standards.
Purpose: Standard disclosure and diligence documentation for buyer teams to review security, privacy, and operational boundaries.
When Used: Procurement & Legal Review.
Buyer Value: Streamlines firm-side compliance and IT approval by providing pre-answered control disclosures.
Diligence Summary
- Data Residency: All primary database storage (Supabase) is hosted in Canadian or US regions (client selectable). Specific provider-by-provider review available on request.
- Subprocessor Governance: Meridian maintains Business Associate Agreements (BAA) and Data Processing Agreements (DPA) with all subprocessors.
- Access Control: MFA required for all Meridian partner access. Role-Based Access Control (RBAC) enforced via Row Level Security (RLS) on the client data layer.
- Privacy Logic: STOP/opt-out handling enforced for all communications. "Do-not-collect" field filtering active by default.
Vendor Control Assessment
| Control Area | Meridian Implementation | Compliance Basis |
|---|---|---|
| Encryption | Standard encrypted cloud infrastructure (provider-managed) | SOC2/HIPAA Standard |
| Data Residency | Primary storage in Canadian/US Regions | PIPEDA / GDPR / CCPA |
| Incident Response | 4-hour notice to Client Partner | Standard MSA |
Operating Controls
Incident & Risk
- Escalation Contact: Assigned Client Partner
- Rollback Owner: Meridian Systems Lead
- Notice Window: Prompt notice via email/phone
Pre-Launch Acceptance
- Architecture Blueprint review
- Script boundary sign-off
- Routing path connectivity test
Risk & Boundary Notes
- Professional Obligations: Client remains responsible for Law Society / Medical Board compliance regarding professional-client relationships.
- Insurance: Meridian maintains professional liability coverage for infrastructure operations.
Ready for a Private Intake Review?
Meridian reviews your current intake leakage and identifies recovery potential before proposing a deployment.
Request Private Intake Review