Sub-Processors

Purpose: Hosts the web application and API (serverless functions), runs scheduled jobs (Vercel Cron), and provides cookieless Web Analytics and Speed Insights

Data shared: All application traffic passes through it; request logs; page-view and performance metrics (no cookies)

Purpose: PostgreSQL database (with pgvector), Redis, the background worker, the document-processing service (Docling) and the Gulf data harvester

Data shared: All stored platform data: account data, deal content, extracted document text and embeddings, AI usage records, OAuth tokens (encrypted), audit logs

Purpose: S3 object storage for uploaded documents, meeting recordings and generated files, and for nightly database backups

Data shared: Uploaded files and recordings; logical database backups (encrypted at rest by S3)

Purpose: The language model (Claude) behind every agent, chat, drafting and classification feature

Data shared: Prompts, the deal and document context included in them, and the model's responses

Purpose: Speech-to-text transcription (Whisper) of meeting recordings you upload, when transcription is enabled. Not used for chat or agents.

Data shared: Recording audio

Purpose: Email delivery. Messages you compose, reply to, forward or send from a draft to external recipients are sent from your Meridian address (@meridianai.fyi) through Resend. Resend also delivers the emails the platform sends: deal-room and e-signature invitations, indication-of-interest and data-room Q&A messages, regulatory alerts, and account, billing and invitation emails. Password-reset, email-verification and waitlist emails go through an SMTP relay instead only if our deployment is configured for one; we will list that relay here before using it.

Data shared: Sender name and address, recipient and CC addresses, subject and message body (including your email signature)

Purpose: SMS messaging (when an organization connects its Twilio account)

Data shared: Phone numbers and message content

Purpose: WhatsApp messaging (when an organization connects its WhatsApp Business account)

Data shared: Recipient WhatsApp numbers and message content

Purpose: Slack workspace notifications (when an organization installs the Slack app)

Data shared: Workspace and channel IDs, message content sent on your behalf

Purpose: Video meeting infrastructure

Data shared: Meeting metadata, audio and video streams during active calls

Purpose: Push-notification delivery to the Meridian mobile app

Data shared: Device push token, notification title and body

Purpose: Deliver web push notifications to browsers where you enable them

Data shared: The browser's push endpoint and an end-to-end encrypted payload the push service cannot read

Purpose: Google sign-in, Google Calendar sync and Google Contacts import (People API). Gmail read and send permissions are not requested today.

Data shared: Account profile, OAuth tokens (stored encrypted), and the calendar events and contacts you choose to sync

Purpose: Microsoft account connection: Outlook Calendar sync and Outlook contacts import (Microsoft Graph). Email you send from Meridian does not go through your Outlook mailbox; it is sent from your Meridian address through Resend.

Data shared: Account profile, OAuth tokens (stored encrypted), and the calendar events and contacts you choose to sync. The connection requests calendar and contacts permissions only; Meridian does not read, import or send mail through your Outlook mailbox.

Purpose: Payment processing, subscription billing and the customer billing portal

Data shared: Payment details (held by Stripe; we receive only the customer ID and subscription metadata), billing address, organization name

Purpose: Error monitoring and performance tracing; for a small sample of browser sessions, and for sessions in which an error occurs, a session replay with page text and form inputs masked

Data shared: Error stack traces, request URL, status, browser and device details, timing data, and masked session replays

Purpose: Person enrichment (role, employer, education)

Data shared: Contact name, email address, organization and LinkedIn URL

Purpose: Person matching and professional profile enrichment

Data shared: Contact name, email address, organization and LinkedIn URL

Purpose: LinkedIn profile enrichment

Data shared: Contact LinkedIn URLs and names

Purpose: Company registry and officer search

Data shared: Organization names and contact names

Purpose: Beneficial-ownership register lookups

Data shared: Company names and identifiers you look up

Purpose: Company and funding-round data

Data shared: Organization names you look up

Purpose: MENA startup and deal data

Data shared: Organization names you look up

Purpose: English and Arabic news search

Data shared: Organization and person names used as search terms

Purpose: Global news and events search (public, free)

Data shared: Organization and person names used as search terms

Purpose: US court-records search (public)

Data shared: Names used as search terms

Purpose: Full-text search of public US securities filings

Data shared: Organization and person names used as search terms

Purpose: Consolidated sanctions and PEP dataset, downloaded in bulk

Data shared: None

Purpose: SDN list, downloaded nightly for sanctions screening

Data shared: None

Purpose: Polled to check each list's availability and freshness

Data shared: None

Purpose: Public business-news feed for the market intelligence page (fixed query)

Data shared: None

Purpose: Public tenders, state news and investment listings crawled by Meridian's own harvester service

Data shared: None

Purpose: VC/PE company and deal intelligence. Organizations cannot connect a PitchBook account yet; once they can, it will use the organization's own PitchBook credentials.

Data shared: Company names and IDs you look up (once active)

Purpose: Companion escrow service, used only where the integration is enabled. Sign-in handoff: when you choose to open Meridian Capital, Meridian gives your browser a signed sign-in link that expires after 5 minutes. Escrow coordination: when a user requests escrow on a deal, Meridian sends the deal to Meridian Capital, which passes it on to Billionaires Bank, a companion service that provisions the escrow account.

Data shared: Sign-in handoff: your user ID, email address, organization ID and organization name. Escrow request: the deal's ID, name, value, currency and corridor; the requesting user's ID; the names, email addresses and escrow roles of the deal's stakeholders; and a default milestone schedule. Billionaires Bank receives the same request except the corridor and the requesting user's ID.

Purpose: Source code repository and CI/CD pipelines

Data shared: No customer data; only source code and CI logs