01 — Repository Overview
What Meridian scanned
Flowise — 1,851 files, 309,899 lines, across javascript, jsx, tsx, typescript.
This repository consists of a web application built using JavaScript and TypeScript languages with frameworks such as Express for back-end services and React for front-end development. The application utilizes a Redis database and leverages advanced AI capabilities provided by LangChain, LlamaIndex, Ollama, and integrates with OpenAI SDK. Docker and Docker Compose are used for containerization, making the deployment process uniform and scalable.
Architecture: AI-enhanced web application
Technology Stack
javascript
jsx
tsx
typescript
Express
React
Redis
Docker
Docker Compose
GitHub Actions
Business Signals
Stores personal data: True
Uses AI: True
Primary jurisdiction: United States
Processes payments: True
Regulated financial entity: False
02 — What Meridian Detected
Compliance Readiness
Every capability Meridian evaluated, grouped by what's actually true about it — implemented in code, fixable in code, or something only documentation or an operational process can demonstrate.
Implemented (3)
- Authentication
- Cross Border Transfer Controls
- Data Classification
Code Improvement Recommended (8)
- Access Control
- Audit Logging
- Consent Management
- Data Lifecycle Management
- Data Retention
- Encryption At Rest
- Encryption In Transit
- Key Management
Requires Documentation (15)
- Asset Inventory
- Backup And Recovery
- Business Impact Analysis
- Configuration Management
- Data Deletion
- Data Masking
- Data Protection Impact Assessment
- Data Subject Request Handling
- Grievance Redressal
- Incident Response Plan
- Information Security Policy
- Log Retention
- Policy Management
- Privacy Impact Assessment
- Records Of Processing
Requires Operational Evidence (23)
- AI Risk Assessment
- Access Review
- BCP And DR Testing
- Bias Detection
- Change Management
- Data Loss Prevention
- Data Quality Management
- Governance Framework
- Incident Detection
- Maker Checker
- Model Monitoring
- Model Testing
- Patch Management
- Penetration Testing
- Physical Access Control
- Privileged Access Management
- Regulatory Change Monitoring
- Regulatory Reporting
- SOC Operations
- Security Awareness Training
- Third Party Risk Assessment
- Vendor Contract Management
- Vulnerability Scanning
03 — Applicable Regulations
Compliance Scope
Determined from what Meridian found in the repository and the business signals above — not every one of the 17 supported frameworks, only the ones that actually apply.
EU AI ActStatutory lawAI Governance & Responsible AI
Your repository deploys AI models or AI-powered systems.
Required: matched on ai_usage.
In force since August 2024 with phased application — prohibited practices first, general-purpose AI and high-risk obligations phasing in later; verify current phase-in dates.
PCI DSSContractual standardPayments & Financial Security
Your application processes payments or handles cardholder data.
Required: matched on processes_payments.
An industry standard enforced through card-network and acquirer agreements, not a statute; applies to entities that store, process, or transmit cardholder data.
SOC 2 Trust Services CriteriaVoluntary attestationTrust & Assurance
Your application is in production and handles customer data requiring independent assurance.
Optional: base condition met, but no additional signal beyond production.
A voluntary attestation framework (AICPA Trust Services Criteria) driven by customer and contractual demand, not law.
Not Applicable (14)
DPDPA 2023
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
DPDPA Rules, 2025
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
GDPR
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
RBI FREE-AI Framework
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI AI/ML Guidelines
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Digital Payment Security Controls
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
+ 8 more in the full report.
04 — Enterprise Readiness
What an enterprise security review would ask about first
Detected (1)
- Authentication
Recommended Improvements (6)
- Access Control
- Audit Logging
- Encryption At Rest
- Encryption In Transit
- Key Management
- Data Retention
Operational Requirements (6)
- Privileged Access Management
- BCP And DR Testing
- Penetration Testing
- Third Party Risk Assessment
- Vendor Contract Management
- Security Awareness Training
Documentation Required (2)
- Incident Response Plan
- Information Security Policy
05 — Top Priorities
What matters most
-
Access ControlCRITICAL
Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
-
AuthenticationCRITICAL
Can the multi-tenant service provider demonstrate logical separation between provider and customer environments with authorization controls?
-
Encryption In TransitCRITICAL
Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
-
Encryption At RestCRITICAL
Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
-
Key ManagementCRITICAL
Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
06 — Recommendations
Recommended actions, by effort
Quick Wins (4)
- Access Control
- Authentication
- Encryption In Transit
- Encryption At Rest
Medium Effort (19)
- Key Management
- Data Subject Request Handling
- Consent Management
- Audit Logging
- Privileged Access Management
- Backup And Recovery
- Data Retention
- Incident Response Plan
- Records Of Processing
- Maker Checker
- Model Testing
- Business Impact Analysis
- Data Lifecycle Management
- Grievance Redressal
- Data Masking
- Data Classification
- Policy Management
- Security Awareness Training
- Data Quality Management
Strategic Initiatives (7)
- AI Risk Assessment
- Bias Detection
- Data Loss Prevention
- Privacy Impact Assessment
- Data Protection Impact Assessment
- Physical Access Control
- Model Monitoring
07 — Compliance Roadmap
Now, next, later
Now · Quick Wins
- Access Control
- Authentication
- Encryption In Transit
- Encryption At Rest
Next · Medium Effort
- Key Management
- Data Subject Request Handling
- Consent Management
- Audit Logging
- Privileged Access Management
- Backup And Recovery
- Data Retention
- Incident Response Plan
- Records Of Processing
- Maker Checker
- Model Testing
- Business Impact Analysis
- Data Lifecycle Management
- Grievance Redressal
- Data Masking
- Data Classification
- Policy Management
- Security Awareness Training
- Data Quality Management
Later · Strategic Initiatives
- AI Risk Assessment
- Bias Detection
- Data Loss Prevention
- Privacy Impact Assessment
- Data Protection Impact Assessment
- Physical Access Control
- Model Monitoring
08 — Technical Findings
Evidence, for engineers
235 critical/high findings, each with file:line evidence traced back to the exact code that was or wasn't found — not shown here by design (this page is the summary; the full report is the audit trail). Open the full report below.