Global Compliance
Meridian maintains compliance certifications across a broad set of regulatory frameworks, enabling you to accept payments globally without building your own compliance infrastructure.
Core certifications
| Certification | Scope |
|---|---|
| PCI DSS Level 1 | Cardholder data security — global |
| SOC 2 Type II | Security, availability, and confidentiality — US |
| ISO 27001 | Information security management — global |
| GDPR | Data protection for EU customers |
Regional licenses and registrations
| Region | Status |
|---|---|
| United States | Money Transmitter Licenses in all required states |
| European Union | Licensed as a Payment Institution under PSD2 |
| United Kingdom | FCA-authorized Payment Institution |
| Canada | Registered with FINTRAC as an MSB |
| Australia | AUSTRAC-registered |
| Singapore | Licensed by MAS |
Data residency
By default, customer data may be processed and stored in any Meridian data region. For businesses with strict data residency requirements, Meridian offers regional data isolation — contact sales for availability.
GDPR and data protection
Meridian acts as a data processor when processing payments on your behalf. You are the data controller. Meridian's Data Processing Agreement (DPA) is available at Dashboard → Settings → Compliance → DPA.
Key points:
- Customer card data is encrypted at rest (AES-256) and in transit (TLS 1.2+)
- Meridian does not sell customer data to third parties
- Data subject requests (access, deletion) can be submitted via the Dashboard
Strong Customer Authentication (SCA)
For EU and UK transactions, Meridian automatically handles Strong Customer Authentication requirements under PSD2. This typically means triggering 3D Secure 2.0 for qualifying transactions. Meridian exemptions engine automatically applies eligible exemptions (low-value, low-risk, merchant-initiated) to minimize authentication friction.