Meridian Compliance Report

Meridian provides automated compliance assessments and recommendations, not legal advice. Final compliance determinations should be reviewed by qualified legal, compliance, or security professionals where required.

Repository Summary

Applicable Controls

122

Controls determined to apply to this repository

Automatically Verified

Requires Documentation

Requires Operational Evidence

Requires Code Changes

Security Maturity

0.07

0.0 - 1.0 scale

Risk Score

0.38

Severity-weighted violations

Business Profile

In productionTrue

Stores personal dataTrue

Uses AITrue

Primary jurisdictionUnited States

Processes paymentsFalse

Regulated financial entityFalse

Compliance Scope

Applicable Regulations

EU AI ActAI Governance & Responsible AI

Your repository deploys AI models or AI-powered systems.

Required: matched on ai_usage.

SOC 2 Trust Services CriteriaTrust & Assurance

Your application is in production and handles customer data requiring independent assurance.

Optional: base condition met, but no additional signal beyond production.

Not Applicable Regulations

DPDPA 2023Privacy & Data Protection

Excluded: 'primary_jurisdiction' does not match the condition required for this framework.

DPDPA Rules, 2025Privacy & Data Protection

Excluded: 'primary_jurisdiction' does not match the condition required for this framework.

GDPRPrivacy & Data Protection

Excluded: 'primary_jurisdiction' does not match the condition required for this framework.

RBI FREE-AI FrameworkAI Governance & Responsible AI

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

SEBI AI/ML GuidelinesAI Governance & Responsible AI

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI Digital Payment Security ControlsPayments & Financial Security

Excluded: 'processes_payments' does not match the condition required for this framework.

PCI DSSPayments & Financial Security

Excluded: 'processes_payments' does not match the condition required for this framework.

RBI IT Governance & Risk ControlsCybersecurity & Operational Security

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI NBFC IT FrameworkFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI NBFC Outsourcing DirectionsFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI Outsourcing DirectionsFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI Payments Banks Outsourcing DirectionsFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

RBI Small Finance Banks Outsourcing DirectionsFinancial Sector Regulations

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

SEBI Cybersecurity FrameworkCybersecurity & Operational Security

Excluded: 'regulated_financial_entity' does not match the condition required for this framework.

CERT-In DirectionsCybersecurity & Operational Security

Excluded: 'primary_jurisdiction' does not match the condition required for this framework.

What Meridian Detected

Authentication Cross Border Transfer Controls Data Classification

Top Priorities

Access Control (CRITICAL) — Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
Encryption At Rest (CRITICAL) — Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
Encryption In Transit (CRITICAL) — Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
Key Management (CRITICAL) — Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
Data Subject Request Handling (HIGH) — Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?

Full breakdown by effort below.

Recommended Actions

Quick Wins

Access Control (CRITICAL)
Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
Encryption At Rest (CRITICAL)
Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
Encryption In Transit (CRITICAL)
Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?

Medium Effort

Key Management (CRITICAL)
Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
Data Subject Request Handling (HIGH)
Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?
Consent Management (HIGH)
Can the organization demonstrate that it has implemented appropriate safeguards when processing special categories of personal data for bias detection and correction?
Audit Logging (HIGH)
Can the organization demonstrate that high-risk AI systems have logging capabilities for automatic event recording throughout their lifetime?
Privileged Access Management (HIGH)
Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
Backup And Recovery (HIGH)
Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?
Data Retention (HIGH)
Can the organization demonstrate that it retains automatically generated logs for at least six months (or as otherwise required) for high-risk AI systems?
Incident Response Plan (HIGH)
Can the organization demonstrate that it authorizes, designs, implements, maintains, and monitors environmental protections, backup processes, and recovery infrastructure?
Records Of Processing (MEDIUM)
Can the organization demonstrate that it has drawn up and maintains up-to-date technical documentation for high-risk AI systems as required by Annex IV?
Maker Checker (MEDIUM)
Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
Model Testing (MEDIUM)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
Business Impact Analysis (MEDIUM)
Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?
Data Lifecycle Management (MEDIUM)
Can the organization demonstrate that it retains all required documentation for 10 years after placing a high-risk AI system on the market?
Grievance Redressal (MEDIUM)
Can the organization demonstrate that it has procedures to handle complaints regarding infringement of the AI Act?
Data Masking (MEDIUM)
Can the organization demonstrate that it selects and develops general control activities over technology to support the achievement of objectives?
Data Classification (MEDIUM)
Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
Policy Management (LOW)
Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?
Security Awareness Training (LOW)
Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
Data Quality Management (INFORMATIONAL)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Strategic Initiatives

AI Risk Assessment (HIGH)
Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
Bias Detection (HIGH)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
Data Loss Prevention (HIGH)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
Data Protection Impact Assessment (HIGH)
Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?
Privacy Impact Assessment (HIGH)
Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?
Model Monitoring (MEDIUM)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
Physical Access Control (MEDIUM)
Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Compliance Roadmap

Now · Quick Wins

Access Control
Encryption At Rest
Encryption In Transit

Next · Medium Effort

Key Management
Data Subject Request Handling
Consent Management
Audit Logging
Privileged Access Management
Backup And Recovery
Data Retention
Incident Response Plan
Records Of Processing
Maker Checker
Model Testing
Business Impact Analysis
Data Lifecycle Management
Grievance Redressal
Data Masking
Data Classification
Policy Management
Security Awareness Training
Data Quality Management

Later · Strategic Initiatives

AI Risk Assessment
Bias Detection
Data Loss Prevention
Data Protection Impact Assessment
Privacy Impact Assessment
Model Monitoring
Physical Access Control

Next Steps

Start with Top Priorities above, then work through the full Quick Wins/Medium Effort/Strategic Initiatives breakdown. Technical Findings below show exactly where each gap was detected in your repository; export to PDF/HTML for a shareable version, or JSON/SARIF to feed a CI pipeline.

Technical Findings (54)

Showing top 50 of 54, ranked by severity then confidence. Export to JSON or SARIF for the complete list.

Critical SOC2_CC6_6 — External Threat Protection Requires Code Changes

Satisfied: Data Classification

Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management

src/features/Auth/SignIn/useSignIn.ts:25-25 (data_classification)

src/routes/(main)/[workspaceSlug]/settings/stats/index.tsx:14-14 (data_classification)

src/features/Auth/ResetPassword/useResetPassword.ts:14-14 (data_classification)

src/features/Auth/VerifyEmail/useVerifyEmail.ts:9-9 (data_classification)

src/app/(backend)/api/webhooks/casdoor/__tests__/route.test.ts:6-6 (data_classification)

src/features/Auth/VerifyEmail/VerifyEmailContent.tsx:10-10 (data_classification)

src/features/Auth/SignIn/useSignIn.ts:35-35 (data_classification)

packages/chat-adapter-imessage/src/api.ts:26-26 (data_classification)

src/features/Auth/SignIn/useSignIn.ts:30-30 (data_classification)

src/features/Auth/ResetPassword/ResetPasswordContent.tsx:10-10 (data_classification)

Critical SOC2_CC6_8 — Unauthorized and Malicious Software Control Requires Code Changes