Trust & security
Your security team evaluates the controls. Your legal team evaluates whether the obligations it lists can be relied on. This page covers both, and the product is designed to withstand the legal review.
Intelligence integrity
A certification does not show that an obligation cites a provision that says what the obligation claims. The controls below address that.
Obligation text is never written by a model
Analysis comes from curated templates tied to the provisions they come from. Content that cannot show that origin is dropped before it is stored, not labeled and delivered. No path exists by which generated prose reaches a customer document.
A citation that is not active is held back
Every citation is checked against the verified Meridian. An obligation whose citation is not active in the Meridian is held back, not printed; the rest of the record is delivered.
An unanswered question is never silently a no
The dynamic intake form is a questionnaire that asks only what your earlier answers make relevant. It requires the answers a determination needs. A determination is the list of laws that apply to one AI use case (one tool used for one purpose), each cited to the provision. An unanswered question is never silently treated as a “no”: where a law was kept in because a question went unanswered, the record says so.
Both outcomes are recorded
Laws assessed and found not to apply appear in the document with the reason. The absence of an obligation is only evidence if you can show it was looked for.
Stored documents do not silently change
A document you received stays exactly as issued when the Meridian improves. You are told which documents depended on what moved; you decide whether to regenerate.
Platform controls
Where a claim would need an auditor to be meaningful, it is not made here.
Tenant data is scoped by organization at the row level, and the database enforces that scope, not only the application code. A request for another tenant’s resource returns not-found rather than forbidden, because the difference between those two responses would disclose the existence of the record.
Authorization comes from the signed-in user’s organization, never from an identifier supplied in the request. That specific mistake produces cross-tenant access, so it is closed at the framework level.
Free text typed into the intake form — the fields most likely to contain something sensitive about an AI use case — is encrypted at rest in addition to the platform’s own encryption.
Determinations record their provenance, including the version of the Meridian. At portfolio scale the provenance question is asked about the process, not only the document.
Infrastructure, payments and transactional email are provided by named third parties. The current list is maintained in the data processing agreement rather than here, so there is one authoritative version rather than two that can disagree.
A determination runs on what you tell us. We do not connect to your systems, hold credentials into your estate, or ingest your data stores.
What we do not claim. This page names no certification, attestation or audit report, because a claim of one that we do not hold would be inaccurate. If your procurement process requires a specific attestation, ask us directly and we will tell you what exists today and what does not.
For procurement
Legal should read the methodology and open two citations from a real determination. Security should read this page and ask us for the data processing agreement and the current sub-processor list.
Both reviews go faster on a real output than on a questionnaire, so the usual fastest path is to add one AI use case first. The first five are free, so that step needs no budget approval. Enterprise terms are agreed with us in discussion. Single sign-on is by arrangement: tell us what your identity provider requires.
Two reviews, one artifact
Security reads the controls and legal opens the citations. A determination is the record that serves both, so we ask you to evaluate one rather than read promotional material. Your first five AI use cases are free, with everything included.