01 — Repository Overview
What Meridian scanned
mem0 — 1,051 files, 197,808 lines, across javascript, python, tsx, typescript.
This repository primarily focuses on AI capabilities using both language models and vector databases, integrated into a web application or service. The backend is primarily implemented using FastAPI and Starlette, with a front-end utilizing React and Next.js technologies. The application uses Docker for containerization and GitHub Actions for continuous integration and deployment.
Architecture: AI-driven web application
Technology Stack
javascript
python
tsx
typescript
FastAPI
Next.js
React
Starlette
Redis
SQL (via SQLAlchemy)
Docker
Docker Compose
GitHub Actions
Business Signals
Stores personal data: True
Uses AI: True
Primary jurisdiction: United States
Processes payments: True
Regulated financial entity: False
02 — What Meridian Detected
Compliance Readiness
Every capability Meridian evaluated, grouped by what's actually true about it — implemented in code, fixable in code, or something only documentation or an operational process can demonstrate.
Implemented (4)
- Authentication
- Cross Border Transfer Controls
- Data Classification
- Data Lifecycle Management
Code Improvement Recommended (7)
- Access Control
- Audit Logging
- Consent Management
- Data Retention
- Encryption At Rest
- Encryption In Transit
- Key Management
Requires Documentation (15)
- Asset Inventory
- Backup And Recovery
- Business Impact Analysis
- Configuration Management
- Data Deletion
- Data Masking
- Data Protection Impact Assessment
- Data Subject Request Handling
- Grievance Redressal
- Incident Response Plan
- Information Security Policy
- Log Retention
- Policy Management
- Privacy Impact Assessment
- Records Of Processing
Requires Operational Evidence (23)
- AI Risk Assessment
- Access Review
- BCP And DR Testing
- Bias Detection
- Change Management
- Data Loss Prevention
- Data Quality Management
- Governance Framework
- Incident Detection
- Maker Checker
- Model Monitoring
- Model Testing
- Patch Management
- Penetration Testing
- Physical Access Control
- Privileged Access Management
- Regulatory Change Monitoring
- Regulatory Reporting
- SOC Operations
- Security Awareness Training
- Third Party Risk Assessment
- Vendor Contract Management
- Vulnerability Scanning
03 — Applicable Regulations
Compliance Scope
Determined from what Meridian found in the repository and the business signals above — not every one of the 17 supported frameworks, only the ones that actually apply.
EU AI ActStatutory lawAI Governance & Responsible AI
Your repository deploys AI models or AI-powered systems.
Required: matched on ai_usage.
In force since August 2024 with phased application — prohibited practices first, general-purpose AI and high-risk obligations phasing in later; verify current phase-in dates.
PCI DSSContractual standardPayments & Financial Security
Your application processes payments or handles cardholder data.
Required: matched on processes_payments.
An industry standard enforced through card-network and acquirer agreements, not a statute; applies to entities that store, process, or transmit cardholder data.
SOC 2 Trust Services CriteriaVoluntary attestationTrust & Assurance
Your application is in production and handles customer data requiring independent assurance.
Optional: base condition met, but no additional signal beyond production.
A voluntary attestation framework (AICPA Trust Services Criteria) driven by customer and contractual demand, not law.
Not Applicable (14)
DPDPA 2023
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
DPDPA Rules, 2025
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
GDPR
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
RBI FREE-AI Framework
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI AI/ML Guidelines
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Digital Payment Security Controls
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
+ 8 more in the full report.
04 — Enterprise Readiness
What an enterprise security review would ask about first
Detected (1)
- Authentication
Recommended Improvements (6)
- Access Control
- Audit Logging
- Encryption At Rest
- Encryption In Transit
- Key Management
- Data Retention
Operational Requirements (6)
- Privileged Access Management
- BCP And DR Testing
- Penetration Testing
- Third Party Risk Assessment
- Vendor Contract Management
- Security Awareness Training
Documentation Required (2)
- Incident Response Plan
- Information Security Policy
05 — Top Priorities
What matters most
-
Access ControlCRITICAL
Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
-
AuthenticationCRITICAL
Can the multi-tenant service provider demonstrate logical separation between provider and customer environments with authorization controls?
-
Encryption In TransitCRITICAL
Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
-
Encryption At RestCRITICAL
Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
-
Key ManagementCRITICAL
Can the designated entity demonstrate that response procedures are in place for cleartext PAN found outside the CDE?
06 — Recommendations
Recommended actions, by effort
Quick Wins (4)
- Access Control
- Authentication
- Encryption In Transit
- Encryption At Rest
Medium Effort (19)
- Key Management
- Data Subject Request Handling
- Consent Management
- Audit Logging
- Privileged Access Management
- Backup And Recovery
- Data Retention
- Incident Response Plan
- Records Of Processing
- Maker Checker
- Model Testing
- Business Impact Analysis
- Data Lifecycle Management
- Grievance Redressal
- Data Masking
- Data Classification
- Policy Management
- Security Awareness Training
- Data Quality Management
Strategic Initiatives (7)
- AI Risk Assessment
- Bias Detection
- Data Loss Prevention
- Privacy Impact Assessment
- Data Protection Impact Assessment
- Physical Access Control
- Model Monitoring
07 — Compliance Roadmap
Now, next, later
Now · Quick Wins
- Access Control
- Authentication
- Encryption In Transit
- Encryption At Rest
Next · Medium Effort
- Key Management
- Data Subject Request Handling
- Consent Management
- Audit Logging
- Privileged Access Management
- Backup And Recovery
- Data Retention
- Incident Response Plan
- Records Of Processing
- Maker Checker
- Model Testing
- Business Impact Analysis
- Data Lifecycle Management
- Grievance Redressal
- Data Masking
- Data Classification
- Policy Management
- Security Awareness Training
- Data Quality Management
Later · Strategic Initiatives
- AI Risk Assessment
- Bias Detection
- Data Loss Prevention
- Privacy Impact Assessment
- Data Protection Impact Assessment
- Physical Access Control
- Model Monitoring
08 — Technical Findings
Evidence, for engineers
235 critical/high findings, each with file:line evidence traced back to the exact code that was or wasn't found — not shown here by design (this page is the summary; the full report is the audit trail). Open the full report below.