Trust center

Security at Untethered.

How Meridian keeps your company's data, who can reach it and where it runs. The controls below are the ones in the product today; what depends on your deployment, or is still in progress, says so.

Talk to us Book a demo

AES-256

Encryption at rest, for databases, files and stored credentials

TLS 1.3

Encryption in transit, HTTPS on every connection

Anywhere

Hosted where you choose: our cloud, yours, or fully on-premise

Certifications and reports.

Our providers: The infrastructure under Meridian's cloud is audited: Vercel and Neon hold SOC 2 Type 2 and ISO 27001, and every provider listed below publishes its reports through its own trust center.
Untethered: Our own SOC 2 audit is planned and not yet complete. Until it is, we answer your security questionnaire directly and share our providers' reports on request.
Data processing agreement: Available on request and signed as part of every enterprise engagement. It names the subprocessors below and the safeguards for transfers outside your country.

Eight control points, under your administration.

How governance works in Meridian

Identity: People sign in with Google Workspace, an email code or a password. An agent acts as the person it works for and never holds more access than they do.
Source permissions: Every connected source keeps its own permissions. What a person cannot open in their mail, files or CRM, their agent cannot read either.
Scope limits: An agent has the skills and tools you attach to it and nothing more. Any tool can be switched off for any agent.
Credentials: API keys and connection tokens are stored encrypted with AES-256-GCM and used by name, so an agent never sees the secret itself.
Threat protection: Retrieved content is treated as data, never as instructions. Code an agent runs executes in an isolated, short-lived sandbox, never on a shared machine.
Action checks: Deleting, changing who can see something and sending email outside the workspace wait for a person to approve them.
Record of every run: Every agent run is recorded end to end: the thread, each tool call, the approval and the result, visible to the people allowed to see the sources it used.
Data location: The multi-tenant cloud runs in the United States. Single-tenant, private-cloud and on-premise deployments run in the region you choose, including Türkiye.

Infrastructure and subprocessors.

The providers that run Meridian's multi-tenant cloud, what each holds and where. A private-cloud or on-premise deployment replaces the first four with your own infrastructure.

1Vercel: Application hosting, edge network, serverless functions and file storage for the multi-tenant cloud. United States.; SOC 2 Type 2 · ISO 27001
2Neon: Managed Postgres: the platform's control plane and a database per workspace for synced records. AWS, US East.; SOC 2 Type 2 · ISO 27001 · ISO 27701
3Upstash: Redis for queues, locks and rate limits. No documents or records are stored here.; SOC 2 · GDPR
4Daytona and Vercel Sandbox: The isolated sandboxes where an agent runs code: seeded from the database per chat, stopped when idle, recreated after expiry, never a persistent machine.; Daytona SOC 2 Type 1 · Vercel SOC 2 Type 2
5Vercel AI Gateway: One door to the model providers. Requests go over Anthropic's, OpenAI's and Google's APIs, which do not train on your data; the workspace admin sets which models may be used.; No training on API data
6Pipedream: Brokers the OAuth connections in the connector catalog and holds their tokens. Google and Slack connect directly; their tokens are stored encrypted in Meridian.; SOC 2 Type 2 report on request
7Recall.ai: The meeting bot. It joins only the meetings you turn it on for, and the recording and transcript are stored in your workspace under the same access rules as everything else. United States.; SOC 2 · HIPAA, as stated by Recall.ai
8Resend: Transactional email: sign-in codes, notifications and mail your agents send.; SOC 2 Type 2
9Stripe: Billing for self-serve plans. Card details never touch Meridian.; PCI DSS Level 1
10PostHog: Product analytics: which features are used, not the content of your work, through a first-party proxy. Session replay runs only on untethered.team and the onboarding screens, with inputs masked. United States.; SOC 2 Type 2

Hosted where you need it.

Hosting as part of a deployment

Multi-tenant: Our managed cloud. Always current, watched by our team, logically isolated and autoscaling.
Single-tenant: A dedicated, isolated stack, kept current and configured the way you need.
Private cloud: Runs inside your cloud account. Data stays within your walls; you decide security, governance and when to upgrade.
On-premise: Fully offline on your hardware, nothing calling out, with our engineers on site to maintain it.

How we operate.

The practices behind the controls, as we run them today.

Data retention: Your data stays as long as your workspace is active. When an engagement ends, we delete the workspace at your request, and provider backups expire on their own schedule.
Employee access: Production access is limited to the engineers who operate the platform, and it is used for support and incidents only. Workspace content is isolated per workspace.
Incident response: If an incident affects your data, we tell you promptly: what happened, what was affected and what we did about it.
Vendor review: A provider joins the list above only after we have reviewed its security posture and reports, and the list is kept current.
Secure development: Every change is reviewed and tested before it ships, and dependencies are kept current.
Business continuity: Managed, replicated infrastructure with automated backups and point-in-time recovery for the databases.

Data protection

KVKK and GDPR, by role.

Türkiye

KVKK

Your company is the data controller (veri sorumlusu) for the personal data in its workspace; Untethered is the processor (veri işleyen).
Multi-tenant cloud data is processed in the United States. The transfer is covered by your data processing agreement, or avoided with a deployment in Türkiye.
Data subjects exercise their rights through you, and we support each request within the statutory period.
VERBİS registration and the legal basis for processing remain the controller's responsibility.

EU and UK

GDPR and UK GDPR

We act as processor under a data processing agreement, with the subprocessors listed on this page.
Transfers outside the EEA and the UK rely on the standard contractual clauses.
Access, correction, deletion and export requests are handled through the controller.
Personal data is processed only to deliver the service: never for advertising, and never to train models.

Questions about security.

No. Model calls go over the providers' APIs through Vercel AI Gateway; Anthropic, OpenAI and Google do not train on API data, and your workspace admin chooses which models are available at all.

Security questions

Ask us anything about security.

Questionnaires, the data processing agreement, provider reports and vulnerability reports all go to one address, and a person replies.

Email hello@untethered.team

Next step

See how it runs in your environment.

Two hours with your leadership. Ten days to a business case. Four weeks to a working agent on your data. No commitment.

Talk to us