MMeridian

Acceptable Use Policy

Last updated: [PLACEHOLDER: effective date]

This Acceptable Use Policy ("Policy") describes what you may not do when using the Meridian services at meridiansemantic.com and app.meridiansemantic.com, including the web application, the API, and any integrations (together, the "Service"). It is part of, and incorporated into, the Meridian Terms of Service. "Meridian", "we", and "us" mean [PLACEHOLDER: legal entity name]. "You" means the customer organization and every user acting under its account.

Meridian is a tool for engineering teams to understand what is deployed where. Most of this Policy comes down to one idea: use the Service for your own team's legitimate work, on data you are authorized to connect, without harming the Service or other customers.

No illegal use

Do not use the Service to violate any applicable law or regulation, or to store, transmit, or promote content that is unlawful — including content that is defamatory, fraudulent, deceptive, or that exploits or harms minors. Do not use the Service in violation of applicable export control or sanctions laws.

No infringement

Do not connect repositories, upload content (including codebase knowledge graphs), or submit data that infringes or misappropriates anyone's intellectual property rights, trade secrets, or privacy rights, or that you otherwise have no right to share with us.

Connect only what you are authorized to connect

The Service works by connecting to systems your organization controls — for example a GitHub organization, a Slack workspace, or your CI pipeline via API keys.

  • Only connect an integration (such as a GitHub App installation or Slack workspace) if you are authorized by the organization that owns that account to do so.
  • Do not use credentials, tokens, or API keys that belong to someone else or that you obtained without authorization.
  • Keep your API keys confidential, and revoke any key you believe has been exposed.
  • You are responsible for having the necessary rights to the data your connected systems send to Meridian, including information about your repositories and contributors.

No harm to the Service or other customers

Do not:

  • upload, transmit, or distribute malware, or use the Service to stage or deliver an attack on anyone;
  • probe, scan, or test the vulnerability of the Service, or attempt to breach any security or authentication measure, without our prior written permission (security testing: if you believe you have found a vulnerability, report it to [email protected] instead of exploiting it);
  • attempt to access another customer's workspace or data, or otherwise circumvent tenant isolation, authorization checks, or access controls;
  • interfere with or disrupt the Service, for example through denial-of-service attacks, resource exhaustion, or deliberately malformed payloads;
  • circumvent, or attempt to circumvent, rate limits, usage limits, or plan restrictions — including by rotating credentials, keys, accounts, or IP addresses to evade them.

API usage limits

API access is subject to rate limits, currently 60 requests per minute per API key and 30 requests per minute per IP address for requests without a valid key. We may change these limits, and may apply additional limits (such as payload size limits) to protect the Service. Requests over the limit receive an HTTP 429 response; back off and retry rather than working around the limit. Use the API only through your own issued keys and only with the scopes you actually need.

No reselling, scraping, or competitive extraction

Do not:

  • resell, sublicense, rent, or otherwise make the Service available to third parties, except to your own users as permitted by the Terms of Service;
  • scrape, crawl, or bulk-extract data from the Service by automated means outside the documented API;
  • access the Service to build a competing product or service, including by using automated extraction, systematic downloading, or the API to replicate the Service's features, data model, or output;
  • use AI-generated output from the Service to train a competing model or product.

Exporting your own workspace's data for your own internal use is always fine.

Enforcement

If you violate this Policy, we may — as set out in the Terms of Service — remove offending content, suspend or throttle access for a user, an API key, or an entire account, or terminate the agreement. Where practical, we will notify you and give you a chance to fix the problem first, but we may act immediately when needed to protect the Service, other customers, or third parties. We may also report unlawful activity to law enforcement where required or appropriate.

Reporting abuse

To report a suspected violation of this Policy, email [email protected]. To report a security vulnerability, email [email protected]. Include enough detail for us to investigate. We appreciate good-faith reports.

Changes to this Policy

We may update this Policy from time to time as the Service evolves. Material changes will be handled as described in the Terms of Service. The "Last updated" date above reflects the current version.