Security, stated plainly
What we do to protect your data, who else touches it, and — just as importantly — which certifications we do not yet hold.
Written for the questionnaire, not for a wall of badges
Most vendor security pages are a row of certification logos over a paragraph about taking security seriously. That document is close to useless to the person it was written for: a procurement reviewer opens it holding a list of specific questions, and a badge answers none of them. This page is ordered the way that review actually runs — what is in place, what is not, who else touches the data, and what we can send you.
Everything under ‘in place today’ restates something the site already claims elsewhere: the payment rails named on the Pacific POS page, the role model described in the FAQ, the hosting arrangement behind every product. Nothing here is a fresh promise written to win a contract, which is the only condition under which a page like this is worth reading at all.
The section that earns the page is the one listing what we do not have. We hold no SOC 2 and no ISO 27001, we have no third-party penetration test report to share, and we do not currently sign Business Associate Agreements. For a company at this size those are ordinary absences — what is not ordinary is publishing them next to the strengths instead of waiting to be asked.
If one of those gaps is a blocker for you, this page is a much better place to find that out than question forty of a vendor questionnaire three weeks into a procurement cycle. Bring the questionnaire to the demo and we will fill it in there.
How your data is protected
Every item here is a practice we run now — not a roadmap.
Encryption in transit and at rest
Traffic to our products runs over TLS, and stored data is encrypted at rest by the cloud platforms we build on.
Role-based access control
Every product enforces roles: a shift manager sees their own team and their own location, not the whole company. Access is granted per role, and revoking someone who has left is a single change.
Append-only audit trail
Every privileged action — a role change, a publish, a deletion — is written to a log that has no update path and no per-row delete, by design rather than by policy. The trail also holds no foreign key to the user table, so it survives the deletion of the account it describes: an administrator cannot remove the record of what they did by removing themselves.
Single-use tokens, stored hashed
Password-reset and email-verification tokens are stored as SHA-256 hashes, never in the clear, and are consumed atomically — a token presented twice loses the race and revokes every session for that account rather than being quietly accepted. Access and refresh secrets are separate values and the application refuses to start if they match.
Private files are never publicly addressable
Uploaded documents live under an owner-scoped prefix and are read only through short-lived signed URLs; nothing private is served from a permanent address. Uploads are checked against an allow-list of types and sizes before storage, and images are re-encoded on the way in — which strips EXIF metadata, including the GPS coordinates a phone camera writes into a photograph.
Authorization changes are their own permission
Being able to edit a user is not the same as being able to change what they may do: granting a role is a separate permission, nobody may alter their own, and the hierarchy is fixed in code rather than editable as data — so a permission set cannot be used to grant a promotion. Operations that would leave the account with no administrator are refused outright.
Continuous monitoring
Infrastructure and application monitoring flags anomalies as they happen — an unexpected traffic spike, a resource that shouldn't be running — rather than after they appear on a bill.
Hardened cloud infrastructure
Our products run on managed cloud platforms rather than machines we rack ourselves, so patching, network isolation and physical security inherit the provider's controls.
PCI DSS handled by the payment rails
Pacific POS does not store card numbers. Card data goes directly to Worldpay and Verifone, who carry the PCI DSS obligation for processing it — the same arrangement the FAQ describes.
Least-privilege internal access
Engineers get access to a customer environment when a specific piece of work requires it, and that access is removed when the work is done.
What we don't have
A security page that lists only strengths is marketing. These are the questions every procurement review asks, answered before you have to.
SOC 2 Type II
Not held today. We have not completed a SOC 2 audit and do not claim one. If a SOC 2 report is a requirement for your purchase, tell us during the demo — we will say so honestly rather than let it surface late in a questionnaire.
ISO 27001
Not held today.
HIPAA / Business Associate Agreement
Our Electronic Health Record product is built for clinical workflows, but we do not currently sign BAAs. A covered entity should treat that as a blocker and talk to us before scoping.
Independent penetration test
No third-party penetration test report is available to share at this time.
What we can send you
Security questionnaire
We complete standard vendor questionnaires (CAIQ, SIG Lite, or your own) as part of the sales process.
Data deletion and export
Your data is yours. Ask and we will export it in a portable format, or delete it and confirm when it is gone.
Who else touches your data
Third parties that may process customer data on our behalf.
| Vendor | Purpose | Region |
|---|---|---|
| Worldpay | Card payment processing | United States |
| Verifone | Payment terminals and processing | United States |
| Amazon Web Services | Application hosting and storage | United States |
| Microsoft Azure | Application hosting for selected products | United States |
Reporting a vulnerability
If you believe you have found a security issue in one of our products, email us with the details and steps to reproduce. We will acknowledge within one business day. Please give us a reasonable window to fix the issue before disclosing it publicly — we will not pursue action against good-faith research that respects that.
info@merilsoft.comSecurity questions before you buy?
Bring your questionnaire to the demo — we'd rather answer it early than have it stall a contract later.
Or call us: 1-225-573-9244