Subprocessors
Last updated: [PLACEHOLDER: effective date]
This page lists the third-party service providers ("subprocessors") that [PLACEHOLDER: legal entity name] ("Meridian") engages to process customer data in the course of providing the Meridian service at app.meridiansemantic.com. It also explains which third-party connections are not subprocessors because you, the customer, direct them yourself.
This list is incorporated by reference into our Data Processing Addendum (DPA). We keep it current: we will update this page and notify customers before any new subprocessor begins processing customer data.
What counts as a subprocessor
A subprocessor is a third party that Meridian engages, under Meridian's own agreements, to process customer data on our behalf — for example, the cloud platform that hosts our database. Before a new subprocessor begins processing customer data, we will evaluate its security and privacy practices and put a written agreement in place that imposes data-protection obligations consistent with our commitments to you. [PLACEHOLDER: confirm data-protection terms (DPA or equivalent) are in place with each vendor listed below before publishing this sentence — see comment note 9.]
Not every third party our product talks to is a subprocessor. Integrations that you connect and control — your GitHub organization, your Slack workspace, your users' Google sign-in — are covered separately below.
Infrastructure subprocessors
These providers process customer data for every Meridian customer as part of operating the service.
| Subprocessor | Purpose | Customer data processed | Processing location |
|---|---|---|---|
| Fly.io, Inc. | Application hosting and primary database (managed PostgreSQL), including database backups | All customer data stored in Meridian: workspace and member data (names, email addresses, roles), sessions (IP addresses, browser user agents), ingested GitHub metadata (commit messages and commit author handles and email addresses, pull request titles and descriptions, release notes, deployment and CI status), codebase knowledge graphs uploaded via the API, AI chat conversations, audit logs, and integration credentials | United States (Ashburn, Virginia) |
| Cloudflare, Inc. | DNS, content delivery, TLS termination, and reverse proxy in front of the application; hosting for our public marketing site | All traffic between your browser and the service, in transit (TLS-encrypted on each hop — browser to Cloudflare, Cloudflare to our hosting provider; Cloudflare terminates TLS at its edge to proxy traffic; customer application data is stored on Fly.io, not Cloudflare) | Global edge network |
| Functional Software, Inc. (Sentry) | Application error monitoring | Error reports and stack traces, tagged with pseudonymous numeric workspace and user identifiers. We disable Sentry's default collection of personal data; error messages may incidentally contain fragments of customer data | [PLACEHOLDER: Sentry organization region — US or EU] |
AI features. Meridian's AI-assisted features do not currently send your data to any third-party AI provider — there is no AI subprocessor on this list. If we engage one in the future, we will add it here and give advance notice before it begins processing customer data, exactly as described below.
Customer-directed integrations (not subprocessors)
Meridian connects to several third-party services at your direction and under your own agreements with those providers. You install and authorize each of these yourself, and you can disconnect the GitHub and Slack integrations at any time. Because these providers act on your instructions — not as vendors engaged by Meridian to process data on our behalf — they are not subprocessors, they do not appear in the table above, and changes to them do not trigger subprocessor-change notices under the DPA.
| Service | How it's connected | What is exchanged |
|---|---|---|
| GitHub, Inc. | You install the Meridian GitHub App on your organization and choose which repositories it can see | GitHub sends Meridian webhook events and API data about your repositories: commits, pull requests, releases, workflow runs, and deployments (metadata and prose only — Meridian does not ingest source code, diffs, or file contents) |
| Slack Technologies, LLC (Salesforce) | You install the Meridian Slack app in your workspace and pick a channel | Meridian posts deploy, promotion, rollback, and approval notifications (project names, environments, short commit identifiers, actor handles) and receives your workspace's slash commands |
| Google LLC | Your users choose "Sign in with Google" | Google shares the signing-in user's email address, name, and profile picture URL with Meridian to create and authenticate their account |
Two practical consequences of this distinction:
- Your DPA with us covers our subprocessors; your own agreements cover your integrations. Data GitHub, Slack, or Google process on their side of these connections is governed by your contracts with them.
- The optional Codebase Understanding integration runs on your infrastructure. The open-source analyzer executes in your own GitHub Actions with your own AI-provider credentials; the analyzer does not send your repository contents to Meridian, and any AI processing in that flow happens under your account with that provider, not ours. Meridian receives only the knowledge-graph file that you choose to upload (file paths, structural summaries, and relationships; its exact contents are determined by the analyzer run you control).
Changes to this list
We will update this page whenever we add, remove, or materially change a subprocessor. For any new subprocessor that will process customer data, we will provide at least [PLACEHOLDER: notice period, e.g., 30 days] advance notice via [PLACEHOLDER: notification mechanism — email to workspace administrators / a mailing list you can subscribe to / RSS feed] before the new subprocessor begins processing customer data.
Removing a subprocessor or updating descriptive details (for example, a vendor's legal name) does not require advance notice; we will reflect such changes on this page with an updated "Last updated" date.
Objecting to a new subprocessor
If you have a reasonable, data-protection-related objection to a new subprocessor, notify us at [email protected] within [PLACEHOLDER: objection window, e.g., 30 days] of our notice, describing the grounds for your objection. We will work with you in good faith to address the concern — for example, by suggesting a configuration change that avoids the new subprocessor. If we cannot resolve the objection, you may terminate the affected portion of the Service and receive a pro-rata refund of prepaid, unused fees for it, as provided in the DPA.
Contact
Questions about this list or our vendors: [email protected]
Contract and DPA questions: [email protected]