Trust

Security

AI labs trust us with unreleased models and evaluation data, and experts trust us with their credentials and payout details. This page explains how we protect both.

Last updated: October 17, 2026 · Report a security issue: support@meredenai.com

1. Data protection

  • Encryption in transit: all traffic to meredenai.com and our API uses HTTPS (TLS).
  • Encryption at rest: our database and file storage are hosted with cloud providers that encrypt stored data.
  • Passwords: stored only as one-way bcrypt hashes. We never see or store your password in plain text.
  • Sessions: sign-in uses signed tokens in HTTP-only, secure cookies that page scripts cannot read.
  • Payments: card details are handled by Stripe, a PCI DSS Level 1 certified provider. Card numbers never reach Mereden's servers.

2. Access control

  • Admin access to expert profiles and applications is limited to named Mereden staff who need it for their role.
  • Our API only accepts requests from approved Mereden web addresses (cross-origin restrictions).
  • Production credentials and API keys are stored as protected environment secrets, never in source code.
  • Access is removed promptly when someone no longer needs it.

3. Client data and confidentiality

  • Every expert agrees to confidentiality terms before working on a project. Projects can require an additional NDA.
  • Experts see only the materials needed for their assigned tasks.
  • Client project materials are not used for any other client or purpose, and are not used to train AI models other than as the Client directs.
  • On request, we delete or return Client project materials at the end of an engagement, subject to legal record-keeping duties.

4. Expert data

  • Labs see an expert's profile only when the expert applies or is shortlisted for their project. Payout and tax details are never shared with labs.
  • When expert-written prompts are sent to AI models for evaluation, the expert's name, contact details, and resume are not included.
  • We do not use webcam monitoring, screen recording, or keystroke tracking.

See our Expert Privacy Notice for details.

5. Service providers

We use a small number of trusted providers to run Mereden. Each receives only the data it needs to provide its service.

  • Netlify: website hosting and contact forms
  • Railway: API and database hosting
  • Google: Google Sign-In
  • Resend: account and password-reset emails
  • Stripe: card payments from Clients
  • Wise and Indian banks: payouts to experts
  • AI model API providers: running evaluation tasks and checking assessments, without expert identity data

We will update this list when we add or change a provider that handles personal data.

6. Incident response

If we become aware of a security incident affecting personal data, we will investigate at once, contain it, and notify affected users and Clients without undue delay. We will also notify the authorities where the law requires, including the Data Protection Board of India and CERT-In within the timelines set by Indian law.

7. Compliance

We follow the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 in India, and the GDPR for users in the EEA and UK. Mereden does not yet hold a SOC 2 or ISO 27001 certification. Clients can request our security questionnaire responses by emailing support@meredenai.com.

8. Report a vulnerability

If you believe you have found a security issue, email support@meredenai.com with the subject "Security report" and enough detail for us to reproduce it. Please give us reasonable time to fix it before sharing it publicly, and do not access, change, or delete other people's data while testing. We will acknowledge your report within 3 business days and will not take legal action against good-faith research that follows these rules.