01 — Repository Overview
What Meridian scanned
nocodb — 2,093 files, 437,114 lines, across javascript, tsx, typescript.
This repository is primarily a web application developed using JavaScript and TypeScript with frameworks like Express, NestJS, React, and Vue. It incorporates a backend likely using Express and NestJS, with a frontend possibly using React and Vue. It seems designed for robustness in handling sensitive data with encryption and secure data management practices.
Architecture: Web application
Technology Stack
javascript
tsx
typescript
Express
NestJS
React
Vue
Docker Compose
GitHub Actions
Business Signals
Stores personal data: True
Uses AI: False
Primary jurisdiction: United States
Processes payments: False
Regulated financial entity: False
Offers goods/services to the EU: True
Monitors individuals in the EU: False
Offers goods/services to India: False
02 — What Meridian Detected
Compliance Readiness
Every capability Meridian evaluated, grouped by what's actually true about it — implemented in code, fixable in code, or something only documentation or an operational process can demonstrate.
Implemented (5)
- Authentication
- Cross Border Transfer Controls
- Data Classification
- Data Lifecycle Management
- Encryption At Rest
Code Improvement Recommended (6)
- Access Control
- Audit Logging
- Consent Management
- Data Retention
- Encryption In Transit
- Key Management
Requires Documentation (15)
- Asset Inventory
- Backup And Recovery
- Business Impact Analysis
- Configuration Management
- Data Deletion
- Data Masking
- Data Protection Impact Assessment
- Data Subject Request Handling
- Grievance Redressal
- Incident Response Plan
- Information Security Policy
- Log Retention
- Policy Management
- Privacy Impact Assessment
- Records Of Processing
Requires Operational Evidence (23)
- AI Risk Assessment
- Access Review
- BCP And DR Testing
- Bias Detection
- Change Management
- Data Loss Prevention
- Data Quality Management
- Governance Framework
- Incident Detection
- Maker Checker
- Model Monitoring
- Model Testing
- Patch Management
- Penetration Testing
- Physical Access Control
- Privileged Access Management
- Regulatory Change Monitoring
- Regulatory Reporting
- SOC Operations
- Security Awareness Training
- Third Party Risk Assessment
- Vendor Contract Management
- Vulnerability Scanning
03 — Applicable Regulations
Compliance Scope
Determined from what Meridian found in the repository and the business signals above — not every one of the 17 supported frameworks, only the ones that actually apply.
GDPRStatutory lawPrivacy & Data Protection
Your application stores or processes personal data of individuals in the European Union.
Required: matched on stores_personal_data, offers_goods_services_to_eu.
In force since May 2018; applies extraterritorially to organizations offering goods or services to, or monitoring, individuals in the EU.
SOC 2 Trust Services CriteriaVoluntary attestationTrust & Assurance
Your application is in production and handles customer data requiring independent assurance.
Optional: base condition met, but no additional signal beyond production.
A voluntary attestation framework (AICPA Trust Services Criteria) driven by customer and contractual demand, not law.
Not Applicable (16)
DPDPA 2023
Excluded: none of 'primary_jurisdiction', 'offers_goods_services_to_india' match the conditions required for this framework.
DPDPA Rules, 2025
Excluded: none of 'primary_jurisdiction', 'offers_goods_services_to_india' match the conditions required for this framework.
EU AI Act
Excluded: 'ai_usage' does not match the condition required for this framework.
RBI FREE-AI Framework
Excluded: 'ai_usage' does not match the condition required for this framework.
SEBI AI/ML Guidelines
Excluded: 'ai_usage' does not match the condition required for this framework.
RBI Digital Payment Security Controls
Excluded: 'processes_payments' does not match the condition required for this framework.
+ 10 more in the full report.
04 — Enterprise Readiness
What an enterprise security review would ask about first
Detected (2)
- Authentication
- Encryption At Rest
Recommended Improvements (5)
- Access Control
- Audit Logging
- Encryption In Transit
- Key Management
- Data Retention
Operational Requirements (6)
- Privileged Access Management
- BCP And DR Testing
- Penetration Testing
- Third Party Risk Assessment
- Vendor Contract Management
- Security Awareness Training
Documentation Required (2)
- Incident Response Plan
- Information Security Policy
05 — Top Priorities
What matters most
-
Access ControlCRITICAL
Can the organization (as a non-EU controller/processor) demonstrate that it has designated a representative in the Union?
-
Encryption At RestCRITICAL
Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
-
Encryption In TransitCRITICAL
Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
-
Key ManagementCRITICAL
Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
-
Consent ManagementHIGH
Can the organization demonstrate that it provides information free of charge and has procedures for manifestly unfounded or excessive requests?
06 — Recommendations
Recommended actions, by effort
Quick Wins (4)
- Access Control
- Encryption At Rest
- Encryption In Transit
- Log Retention
Medium Effort (20)
- Key Management
- Consent Management
- Privileged Access Management
- Audit Logging
- Incident Response Plan
- Backup And Recovery
- Data Retention
- Records Of Processing
- Data Masking
- Model Testing
- Maker Checker
- Business Impact Analysis
- Asset Inventory
- Configuration Management
- Data Lifecycle Management
- Information Security Policy
- Data Classification
- Policy Management
- Security Awareness Training
- Data Quality Management
Strategic Initiatives (7)
- Bias Detection
- AI Risk Assessment
- Data Loss Prevention
- Privacy Impact Assessment
- Data Protection Impact Assessment
- Model Monitoring
- Physical Access Control
07 — Compliance Roadmap
Now, next, later
Now · Quick Wins
- Access Control
- Encryption At Rest
- Encryption In Transit
- Log Retention
Next · Medium Effort
- Key Management
- Consent Management
- Privileged Access Management
- Audit Logging
- Incident Response Plan
- Backup And Recovery
- Data Retention
- Records Of Processing
- Data Masking
- Model Testing
- Maker Checker
- Business Impact Analysis
- Asset Inventory
- Configuration Management
- Data Lifecycle Management
- Information Security Policy
- Data Classification
- Policy Management
- Security Awareness Training
- Data Quality Management
Later · Strategic Initiatives
- Bias Detection
- AI Risk Assessment
- Data Loss Prevention
- Privacy Impact Assessment
- Data Protection Impact Assessment
- Model Monitoring
- Physical Access Control
08 — Technical Findings
Evidence, for engineers
59 critical/high findings, each with file:line evidence traced back to the exact code that was or wasn't found — not shown here by design (this page is the summary; the full report is the audit trail). Open the full report below.