Security

Every database table has an org_id column. Supabase RLS policies enforce that all queries — including from compromised tokens — are restricted to your organization's rows. One center cannot see another center's data by design, not by application logic.

All data is encrypted at rest in Supabase (AES-256). All connections use TLS 1.3. Passwords are hashed with bcrypt via Supabase Auth. API keys are environment variables — never exposed to the browser.

Meridian uses multi-tenant architecture with hard data boundaries. Your leads, students, and parents are never in the same query as another center's data.

We store only what you enter. We do not track browsing behavior, install analytics SDKs, or sell data. The only third-party services that touch your data are Supabase (storage), Gemini (AI drafts — inquiry text only), and Resend (email notifications).

Hosted on Vercel (CDN + serverless functions) and Supabase (managed Postgres on AWS us-east-1). Both providers maintain SOC 2 Type II compliance. Database backups run daily with 90-day retention.

Role-based access: owner and staff roles. Only owners can invite new users or change billing. All authentication is handled by Supabase Auth. Sessions expire automatically. You can revoke access by removing a team member in Settings → Team.