Meridian Compliance Report

Meridian provides automated compliance assessments and recommendations, not legal advice. Final compliance determinations should be reviewed by qualified legal, compliance, or security professionals where required.

Executive Summary

Applicable Controls

236

Controls determined to apply to this repository

Implemented

Requires Documentation

Requires Operational Evidence

Code Improvement Recommended

129

Repository Overview

In ProductionTrue

Technology Stack

323 files · 202635 lines

Languagesjavascript, python, typescript

FrameworksFastAPI, Starlette

Data & InfrastructureOpenTelemetry, Redis, SQL (via SQLAlchemy)

CI/CD & IaCDocker, Docker Compose, GitHub Actions

Business Signals

Stores personal dataTrue

Uses AITrue

Primary jurisdictionEuropean Union

Processes paymentsFalse

Regulated financial entityFalse

What Meridian Understood

This repository features a sophisticated technology stack with the use of JavaScript, Python, and TypeScript. It leverages FastAPI and Starlette for web framework capabilities, integrating various databases such as Redis and SQL via SQLAlchemy. AI capabilities are integrated through LangChain and PyTorch, along with multiple vector databases, pointing to its use in advanced data or AI-driven applications.

Architecture: AI-driven web application

Compliance Scope

Applicable Regulations

GDPRPrivacy & Data Protection

Your application stores or processes personal data of individuals in the European Union.

Required: matched on stores_personal_data, primary_jurisdiction.

EU AI ActAI Governance & Responsible AI

Your repository deploys AI models or AI-powered systems.

Required: matched on ai_usage.

SOC 2 Trust Services CriteriaTrust & Assurance

Your application is in production and handles customer data requiring independent assurance.

Optional: base condition met, but no additional signal beyond production.

Not Applicable Regulations

DPDPA 2023Privacy & Data Protection

Excluded: 'primary_jurisdiction' does not match the condition required for this framework.

DPDPA Rules, 2025Privacy & Data Protection

Excluded: 'primary_jurisdiction' does not match the condition required for this framework.

RBI FREE-AI FrameworkAI Governance & Responsible AI

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

SEBI AI/ML GuidelinesAI Governance & Responsible AI

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI Digital Payment Security ControlsPayments & Financial Security

Excluded: 'processes_payments' does not match the condition required for this framework.

PCI DSSPayments & Financial Security

Excluded: 'processes_payments' does not match the condition required for this framework.

RBI IT Governance & Risk ControlsCybersecurity & Operational Security

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI NBFC IT FrameworkFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI NBFC Outsourcing DirectionsFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI Outsourcing DirectionsFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI Payments Banks Outsourcing DirectionsFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI Small Finance Banks Outsourcing DirectionsFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

SEBI Cybersecurity FrameworkCybersecurity & Operational Security

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

CERT-In DirectionsCybersecurity & Operational Security

Excluded: 'primary_jurisdiction' does not match the condition required for this framework.

Compliance Readiness

Implemented

Access Control Audit Logging Authentication Cross Border Transfer Controls Data Classification Data Lifecycle Management

Code Improvement Recommended

Consent Management Data Retention Encryption At Rest Encryption In Transit Key Management

Requires Documentation

Asset Inventory Backup And Recovery Business Impact Analysis Configuration Management Data Deletion Data Masking Data Protection Impact Assessment Data Subject Request Handling Grievance Redressal Incident Response Plan Information Security Policy Log Retention Policy Management Privacy Impact Assessment Records Of Processing

Requires Operational Evidence

AI Risk Assessment Access Review BCP And DR Testing Bias Detection Change Management Data Loss Prevention Data Quality Management Governance Framework Incident Detection Maker Checker Model Monitoring Model Testing Patch Management Penetration Testing Physical Access Control Privileged Access Management Regulatory Change Monitoring Regulatory Reporting SOC Operations Security Awareness Training Third Party Risk Assessment Vendor Contract Management Vulnerability Scanning

Enterprise Readiness

Detected

Authentication Access Control Audit Logging

Recommended Improvements

Encryption At Rest Encryption In Transit Key Management Data Retention

Operational Requirements

Privileged Access Management BCP And DR Testing Penetration Testing Third Party Risk Assessment Vendor Contract Management Security Awareness Training

Documentation Required

Incident Response Plan Information Security Policy

SOC 2 Scope

The subset of the capabilities above that SOC 2's own controls actually reach.

Detected

Authentication Access Control Audit Logging

Recommended Improvements

Encryption At Rest Encryption In Transit Key Management Data Retention

Operational Requirements

Privileged Access Management BCP And DR Testing Penetration Testing Third Party Risk Assessment Vendor Contract Management Security Awareness Training

Documentation Required

Incident Response Plan

AI Governance

Critical AI Findings

AI frameworksPyTorch, LangChain

AI infrastructurenone detected

Vector databasesChromaDB, Milvus, Pinecone, Qdrant, Weaviate

Notebooks0

AI regulations evaluatedEU Artificial Intelligence Act

Not mapped (no real control data available): ISO_42001, NIST_AI_RMF, OECD_AI_PRINCIPLES

Deployment Profile

Vector database

AI Governance Posture

Replaces a bare AI maturity score with the actual capabilities checked.

Detected

Audit Logging

Requires Operational Processes

Governance Framework AI Risk Assessment Model Monitoring Model Testing Bias Detection Maker Checker Penetration Testing

Top Priorities

Access Control (CRITICAL) — Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Authentication (CRITICAL) — Can the organization demonstrate that it has procedures to verify the identity of data subjects making requests?
Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
Encryption In Transit (CRITICAL) — Can the organization demonstrate that it has implemented appropriate technical and organisational security measures?
Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
Encryption At Rest (CRITICAL) — Can the organization demonstrate that it has implemented appropriate technical and organisational security measures?
Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
Key Management (CRITICAL) — Can the organization demonstrate that it has implemented appropriate technical and organisational security measures?
Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.

Full breakdown by effort below.

Recommended Actions

Quick Wins

Access Control (CRITICAL)
Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Authentication (CRITICAL)
Can the organization demonstrate that it has procedures to verify the identity of data subjects making requests?

Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
Encryption In Transit (CRITICAL)
Can the organization demonstrate that it has implemented appropriate technical and organisational security measures?

Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
Encryption At Rest (CRITICAL)
Can the organization demonstrate that it has implemented appropriate technical and organisational security measures?

Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.

Medium Effort

Key Management (CRITICAL)
Can the organization demonstrate that it has implemented appropriate technical and organisational security measures?

Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
Data Subject Request Handling (HIGH)
Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?

Improves compliance posture for: EU AI Act.
Consent Management (HIGH)
Can the organization demonstrate that it has implemented appropriate safeguards when processing special categories of personal data for bias detection and correction?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Audit Logging (HIGH)
Can the organization demonstrate that high-risk AI systems have logging capabilities for automatic event recording throughout their lifetime?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Privileged Access Management (HIGH)
Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Backup And Recovery (HIGH)
Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?

Improves compliance posture for: EU AI Act, SOC 2 Trust Services Criteria.
Data Retention (HIGH)
Can the organization demonstrate that it retains automatically generated logs for at least six months (or as otherwise required) for high-risk AI systems?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Cross Border Transfer Controls (HIGH)
Can the organization demonstrate that it provides data subjects with their data in a structured, commonly used, and machine-readable format?

Improves compliance posture for: GDPR.
Incident Response Plan (HIGH)
Can the organization demonstrate that it authorizes, designs, implements, maintains, and monitors environmental protections, backup processes, and recovery infrastructure?

Improves compliance posture for: SOC 2 Trust Services Criteria.
Records Of Processing (MEDIUM)
Can the organization demonstrate that it has drawn up and maintains up-to-date technical documentation for high-risk AI systems as required by Annex IV?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Maker Checker (MEDIUM)
Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Model Testing (MEDIUM)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Improves compliance posture for: EU AI Act, GDPR.
Business Impact Analysis (MEDIUM)
Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Data Lifecycle Management (MEDIUM)
Can the organization demonstrate that it retains all required documentation for 10 years after placing a high-risk AI system on the market?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Grievance Redressal (MEDIUM)
Can the organization demonstrate that it has procedures to handle complaints regarding infringement of the AI Act?

Improves compliance posture for: EU AI Act.
Data Masking (MEDIUM)
Can the organization demonstrate that processing of criminal conviction data is under official control or authorised by law with appropriate safeguards?

Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
Data Classification (MEDIUM)
Can the organization demonstrate that it has implemented appropriate technical and organisational security measures?

Improves compliance posture for: GDPR, SOC 2 Trust Services Criteria.
Configuration Management (MEDIUM)
Can the organization demonstrate that appropriate technical and organisational measures are in place to ensure the security of personal data?

Improves compliance posture for: GDPR.
Policy Management (LOW)
Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Security Awareness Training (LOW)
Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Data Quality Management (INFORMATIONAL)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Improves compliance posture for: EU AI Act, GDPR.

Strategic Initiatives

AI Risk Assessment (HIGH)
Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Bias Detection (HIGH)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Improves compliance posture for: EU AI Act, GDPR.
Data Loss Prevention (HIGH)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Improves compliance posture for: EU AI Act, GDPR.
Privacy Impact Assessment (HIGH)
Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Data Protection Impact Assessment (HIGH)
Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?

Improves compliance posture for: EU AI Act, GDPR, SOC 2 Trust Services Criteria.
Physical Access Control (MEDIUM)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Improves compliance posture for: EU AI Act, GDPR.
Model Monitoring (MEDIUM)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Improves compliance posture for: EU AI Act, GDPR.

Compliance Roadmap

Now · Quick Wins

Access Control
Authentication
Encryption In Transit
Encryption At Rest

Next · Medium Effort

Key Management
Data Subject Request Handling
Consent Management
Audit Logging
Privileged Access Management
Backup And Recovery
Data Retention
Cross Border Transfer Controls
Incident Response Plan
Records Of Processing
Maker Checker
Model Testing
Business Impact Analysis
Data Lifecycle Management
Grievance Redressal
Data Masking
Data Classification
Configuration Management
Policy Management
Security Awareness Training
Data Quality Management

Later · Strategic Initiatives

AI Risk Assessment
Bias Detection
Data Loss Prevention
Privacy Impact Assessment
Data Protection Impact Assessment
Physical Access Control
Model Monitoring

Next Steps

Start with Top Priorities above, then work through the full Quick Wins/Medium Effort/Strategic Initiatives breakdown. Technical Findings below show exactly where each gap was detected in your repository; export to PDF/HTML for a shareable version, or JSON/SARIF to feed a CI pipeline.

Technical Findings (120)

Showing top 50 of 120, ranked by severity then confidence. Export to JSON or SARIF for the complete list.

Critical GDPR_ART_9_002 — Special Categories - Explicit Consent Code Improvement Recommended

Satisfied: Data Classification

Missing: Access Control, Consent Management, Encryption At Rest, Encryption In Transit, Key Management

backend/open_webui/models/feedbacks.py:111-111 (data_classification)

backend/open_webui/models/auths.py:75-75 (data_classification)

backend/open_webui/models/auths.py:67-67 (data_classification)

backend/open_webui/routers/channels.py:459-459 (data_classification)

backend/open_webui/models/users.py:88-88 (data_classification)

backend/open_webui/routers/analytics.py:42-42 (data_classification)

backend/open_webui/models/users.py:242-242 (data_classification)

backend/open_webui/models/auths.py:81-81 (data_classification)

backend/open_webui/models/auths.py:61-61 (data_classification)

backend/open_webui/models/auths.py:40-40 (data_classification)

backend/open_webui/routers/scim.py:155-155 (data_classification)

backend/open_webui/models/users.py:207-207 (data_classification)

backend/open_webui/models/users.py:246-246 (data_classification)

backend/open_webui/models/users.py:258-258 (data_classification)

Critical GDPR_ART_32_001 — Security of Processing Code Improvement Recommended

Satisfied: Audit Logging, Data Classification

Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management

backend/open_webui/utils/audit.py:140-140 (audit_logging)