Security & trust

Last updated: August 2026

One engineering team builds both Riverge and Meritan on the same platform, so this page covers both. It describes what is true today, and says plainly what is not built yet. If you are running a vendor review, pair it with the DPA and the sub-processor list.

Code runs in the browser, never on our servers

JavaScript and TypeScript run in a Web Worker; Python runs as WebAssembly through Pyodide; HTML previews run in a sandboxed iframe with no same-origin access, so page code cannot reach cookies or storage. Our servers never compile or execute anyone’s code. That removes an entire class of risk, and it is also why a session cannot mine crypto on our infrastructure or read another customer’s files through ours.

Encryption

• All traffic runs over TLS, including the realtime websocket.
• Passwords are hashed with scrypt and a per-user random salt. We cannot read them.
• Sessions are HMAC-signed tokens in HttpOnly, SameSite cookies, so page scripts cannot read them even if a script were injected.
• Integration credentials, such as connected GitHub tokens, are encrypted at rest.
• Disk storage is encrypted at rest by our hosting provider.

Isolation between customers

Access is checked server-side on every request and again when the realtime connection is opened, not just in the interface. Interview data is scoped to the owning workspace; project rooms to their members. Read-only participants are enforced at the sync layer, which drops any edit they attempt rather than trusting the client to behave.

Integrity signals, recorded honestly

Meritan records blocked paste attempts and their size, tab focus changes and their duration, whether a second display is present, and unusually large insertions. It does not read the clipboard, the camera, the microphone, the screen outside the tab, or files on the device. Signals are written server-side where the candidate cannot edit them, and shown to reviewers as evidence to weigh, never as an automated verdict.

Your data is yours

• Delete any interview and its recording, integrity events and room contents go immediately.
• Owners can export the entire workspace as JSON at any time.
• Retention sweeps run automatically and delete expired recordings permanently.
• Business plans include an audit log of account actions.

Application security

• Database access is fully parameterised, so query text and data never mix.
• State-changing requests are origin-checked, on top of SameSite cookies, against CSRF.
• Authentication endpoints are rate-limited, and sign-in gives the same answer whether or not an account exists, so the form cannot be used to discover who has one.
• Password reset tokens are single-use, expire in 30 minutes, and are stored hashed, so a database copy cannot be used to reset anyone’s password.
• Guest interview links carry 192 bits of entropy and expire.
• Passwords are checked against common and easily guessed choices before they are accepted.
• Standard security headers are set, and crashes alert us automatically.

What we have not built yet

Honesty is worth more to you than a longer list. We do not hold SOC 2 or ISO 27001. We have not commissioned an external penetration test. There is no bug bounty. Single sign-on exists for Business but is not yet enabled by default. We run a single application instance, so a deploy briefly interrupts live connections, which reconnect automatically. If any of these is a requirement for you, tell us where it sits on your timeline and we will tell you honestly whether we can meet it.

Backups

Data is backed up regularly and restores are tested. A deleted item may persist in a recent backup for a short period before it is overwritten.

Responsible disclosure

Found something? Email founders@meritan.team with enough detail to reproduce it. We will acknowledge within two business days, keep you updated, fix what needs fixing, and credit you if you would like. Please do not test against other people’s accounts or data, and give us a reasonable chance to fix an issue before publishing it.