Privacy Policy
Effective 15 October 2026
This policy explains what personal data Societal Lab Inc. ("Societal Lab", "we", "us"), a New York corporation, collects through the Open Meridian platform at open-meridian.com (the "Platform"), why, who we share it with, and the choices you have.
The short version
- The Platform holds who you are (your name and verified email address, from your sign-in provider) and what you set up (your projects, their members, and your deployments).
- It does not hold your positions, balances, orders or account data. Open Meridian runs in your own environment, and that data stays there.
- We use no advertising, no analytics cookies and no tracking of visitors, and set only the cookies signing in needs.
- Your deployments send it instrument identifiers only in the schemes on its licence list, and, unless your deployment's administrator turns it off, a weekly count of how identifiers are used. Neither carries holdings, accounts or people, and a lookup that finds nothing is kept without which deployment asked.
- We do look at how the Platform and Open Meridian are used, from our own records and from usage information your deployments send about the software, to develop and improve them.
- Our staff may use AI agents to maintain the shared instrument reference data; what those agents read is described below.
- If someone at your deployment chooses to send us a diagnostic bundle for support, we keep it for 90 days, and record each time a member of our staff opens it.
- We do not sell your personal data.
What this policy covers
It covers the Platform: the public page at open-meridian.com and the signed-in application where you manage projects and deployments.
It does not cover the Open Meridian software you run yourself. That software runs in your environment, under your control and your own policies; we do not receive the data it holds, and receive from it only what is described under "What your deployment sends us". It also does not cover sites we link to, such as our documentation at open-meridian.dev or our repositories on GitHub, which are hosted by GitHub under GitHub's privacy statement.
What we collect
When you sign in
You sign in through our identity provider, ZITADEL. We never see or store your password. From your sign-in we receive and keep:
- an identifier for you at the provider (issuer and subject);
- your name, which you change in your account settings at the provider; we update ours at each sign-in;
- your email address, only if your provider has verified it. We update it at each sign-in, and remove it if it is no longer verified.
We also assign you a random Open Meridian identifier and record when your account was created.
What you and your colleagues set up
- Projects: their names, when they were created, closed or reopened, and by whom.
- Membership: who belongs to which project, in which role, when, and who granted it.
- Invitations: the email address invited, the role offered, who sent it, when it expires, whether it was accepted, and whether the email was delivered (including a delivery error message, if any).
- Deployments: the names you give them, when they were created, retired or last seen, and the public half of each deployment's key with its fingerprint. A deployment's private key never leaves your environment.
- Codes (enrolment, first-run, first-administrator, password reset): our database keeps only a one-way fingerprint (hash) of each code, with when it was issued, expires and was used. We do not learn who redeems a code.
What your deployment sends us
A deployment you run contacts the Platform for what it needs to work and to tell us how the Open Meridian software is used, and proves who it is with its key. It sends:
- Instrument lookups: requests for instrument identity, such as an identifier and a date, or a venue's code. A lookup that finds an instrument is answered and not stored, although it appears in our request logs. A lookup that finds nothing is kept, so we can see which instruments deployments need and add them: the identifier and date it asked with, when it arrived, and how many times it has been asked. Which deployment asked is not kept with it. We count how many deployments and projects asked with an approximate count that cannot list them, and keep for each deployment only a count of how many of its lookups and requests were recorded in each hour, to limit how fast it can ask, which names nothing it asked. A lookup with an identifier in a scheme not on the licence list (described next) is answered and not kept.
- Requests to match or add an instrument: when your deployment meets an instrument it cannot find, it sends what to look for: its identifiers, only in the identifier schemes on the licence list the Platform publishes to deployments (open schemes, such as FIGI, LEI, a ticker with its venue, CAIP-19, ISO 4217 codes and the SEC's fund identifiers); the kind of instrument; a random key for the request; and what its own records' sources say about the instrument, such as a name or a currency. Identifiers in licensed schemes, such as CUSIP, SEDOL and ISIN, stay in your deployment. The Platform refuses a request carrying an identifier in any other scheme, or a CUSIP, SEDOL or ISIN written in its text, and stores nothing of it. It checks the instrument against a source of its own, and adds what that source confirms to the shared instrument reference data. It keeps the request, with what it offered, beside it, without which deployment sent it. None of this carries a quantity, price, account or person.
- From earlier versions of the software: a deployment running a version of Open Meridian older than contract version 24 reports a missing instrument with the identifiers it has for it (which may include a broker's or venue's own symbol), its asset class and a date. We keep those identifiers as part of the shared instrument reference data, as before.
- Identifier-usage reports: weekly, your deployment sends counts for each identifier scheme: how many of its instruments carry it, how many it can identify only through it, and how many instruments it could not find whose only identifier was in it; and the names of the schemes your firm says it is licensed for. A report carries no identifier values, holdings, quantities, accounts or people. Sending it is on by default, and your deployment's administrator can turn it off with the setting "Report identifier usage". We keep each deployment's latest report, with the counts of the report before it to show whether use is rising or falling. The Platform shows our staff only totals across deployments, and a scheme's totals only once three or more deployments contribute to them, never one deployment's figures.
- Component reports: each component's name, version, health and a short status message, and when it started. We keep the latest report, and when each component first reported. A status message carrying a CUSIP, SEDOL or ISIN is refused, and nothing of that report is kept.
- Usage information about the Open Meridian software itself, which a deployment may send: which components and plugins it runs, their versions and roles, how many, and how much each is used (for example, how many people use a plugin at each access level, or how often its operations are called). It is counted rather than itemised: it carries no positions, balances, orders, account data or instrument holdings, and names nobody.
- When the deployment was last seen, from any of the above.
A deployment never sends us positions, balances, orders, account data or instrument holdings, and never sends anything about any of your staff as a person, except what a diagnostic bundle may carry, described next.
When your deployment sends a diagnostic bundle
Your deployment sends us a diagnostic bundle only when a person there chooses to, usually so that we can help with a support question. We have no way to ask your deployment for one or to fetch one. Before it is sent, your deployment's administrator sees everything in it and can remove any item from it. A bundle describes the Open Meridian software and how your deployment is set up: reports from its components and plugins, their versions, counts of requests they refused and why, and settings that are not secret. It does not contain logs, positions, balances, orders, account data or instrument holdings.
Unless your deployment's administrator removes them, a bundle may include the names of your deployment's user accounts and the access groups each belongs to.
We keep a bundle exactly as it was sent, with when it arrived and which deployment sent it. We know the deployment because it signs what it sends with its own key; we do not record which person at your deployment sent it.
Only members of our staff who hold a permission for reading diagnostic bundles can open one. Each time one of them does, we record who opened it and when, and we keep that record. AI agents our staff connect cannot read bundles. We use a bundle only to give you support: to understand and fix a problem with the Platform or the Open Meridian software that your deployment has run into.
We delete a bundle 90 days after it arrives. To ask about a bundle your deployment sent, write to us at privacy@open-meridian.com.
When our staff connect an AI agent
Our staff maintain the shared instrument reference data. A member of our staff who does may let an AI agent do some of that work for them: the agent acts in their name, on their authority, until a date they choose of at most 90 days, and only on the kinds of instrument our staff allow it. Only our staff can do this, so what follows is about them and their agents. For it we keep:
- Agent clients: the name an agent registers with, the addresses it registers for receiving access, and when it registered.
- Delegations: who delegated to which agent, what authority, when, and until when; what the agent may work on, and who set that and when; when the agent last acted, and why it was last refused and when; whether the delegation was revoked, when, by whom and why; and when we emailed the person about its expiry.
- Codes and tokens an agent is given: as for the codes above, our database keeps only a one-way fingerprint (hash) of each, with where it may be used, when it was issued, expires and was used.
- What the agent does: each change it makes to an instrument is recorded in that instrument's history, naming the agent and the person it acts for, with the source and research note it gave. A change it may not make itself is kept as a proposal, with its note, until a member of staff accepts or rejects it, and we record who decided, when, and any note they gave.
When you visit
Our servers and our cloud provider record each request: your IP address, the address requested, your browser's user agent, the referring page and the time. We use these records to run and secure the Platform.
Cookies
We set only cookies the Platform needs to work:
| Cookie | Purpose | Lasts |
|---|---|---|
sessionid | Keeps you signed in | Until you sign out, or until it expires |
csrftoken | Protects forms against cross-site request forgery | One year |
We use no analytics, advertising or tracking cookies, and load no third-party scripts or fonts. Your sign-in provider sets its own cookies on its own domain, under its own policy.
How we use it
- to provide the Platform: sign you in, show your projects and deployments, and let deployments enrol, look up instruments and report their health;
- to give you support, from a diagnostic bundle someone at your deployment chose to send us;
- to send the email the Platform needs: invitations you or a colleague send, security notices to staff, and notices to a member of staff a week before an agent's access they delegated ends, and when it has;
- to keep the Platform and its users secure, and to investigate misuse, including revoking an agent's access and tracing what an agent changed and for whom;
- to maintain the shared instrument reference data, including through an agent acting for the member of staff who delegated to it;
- to understand how the Platform and Open Meridian are used, and to develop and improve them: from the Platform's own records, such as how many of the people who sign up in a week go on to register a deployment, and from the usage information deployments send;
- to see which identifier schemes deployments depend on, from the totals of their identifier-usage reports, so that we can decide which the shared instrument reference data should carry;
- to bill for plugins sold through the Platform, where we sell them;
- to comply with the law.
We do not use your data for advertising, and we do not sell it.
Legal bases
Where the GDPR or a similar law applies, we rely on:
- performance of our contract with you, to provide the Platform and support for it, and to bill for what you buy through it;
- our legitimate interests in securing the Platform, maintaining its reference data, communicating with project members about invitations, and understanding how the Platform and Open Meridian are used so that we can develop and improve them;
- legal obligation, where the law requires us to keep or disclose data.
Who we share it with
We use these service providers, who process data on our behalf:
| Provider | What for | Where |
|---|---|---|
| Google Cloud | Hosting the Platform, its database, backups and logs | United States |
| ZITADEL | Signing you in, and the email that confirms your address or resets your password | United States |
| Brevo | Sending the Platform's email | European Union |
| Microsoft 365 | Receiving email sent to us | United States |
AI providers our staff choose. What an agent reads through the Platform's agent connector goes to the provider of the AI service that runs it, under the agreement between the member of our staff who connected it and that provider. That person chooses the provider; we do not choose or control it, and it does not act for us. An agent reads instrument records and their history, which names by identifier the people and agents who changed them, with their notes; the instruments deployments could not find, and how often and by about how many deployments each was asked for, a count that names none of them; the placeholder records made for them; and the identifier schemes in use. It reads nothing else: no person's name or email address, and nothing about your projects, members or deployments beyond those identifiers. This applies to our staff and their agents, and to you only as far as the identifiers your deployments reported and your deployments' own identifiers.
Other project members see your name and role in projects you share. Your email address is not shown to them, except that while an invitation to you is open, the project page shows the address it was sent to.
We disclose data if the law requires it, to protect our rights and users, or as part of a merger or sale of our business, under this policy.
International transfers
We are based in the United States and host the Platform there. If you are elsewhere, your data is transferred to the United States. Where the law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
How long we keep it
We keep personal data for as long as we need it to run and secure the Platform, and for security, legal and audit purposes. In particular:
- Your account and what you set up are kept while your account exists. Records of projects, membership and invitations are kept after they end, as the history of who did what.
- Request logs are kept for as long as we need them to run and secure the Platform, and for security, legal and audit purposes.
- Your sign-in session lasts until you sign out or it expires.
- Instrument identifiers the Platform receives from your deployment, in schemes on its licence list, become part of the shared reference data and are kept, and so are lookups and requests that found nothing, with when they were made but not which deployment made them. The hourly counts that limit how fast a deployment may ask are kept for as long as we need them for that.
- Identifier-usage reports: each deployment's latest report is kept, with the counts of the one before it, until its next report replaces them; a deployment that stops sending them leaves its last one in place.
- Usage information your deployments send, and what we work out from it and from our own records, is kept for as long as we need it to understand how the Platform and Open Meridian are used, to develop and improve them, and to bill for plugins.
- Delegations to agents, and the agent and person each change and proposal names, are kept after the delegation ends, as the history of who changed what. They, agent clients, and the fingerprints of the codes and tokens agents were given, are kept for as long as we need them to run and secure the Platform, and for security, legal and audit purposes.
- Diagnostic bundles are kept for 90 days from when they arrive, and then deleted. The record of which member of our staff opened a bundle, and when, is kept after the bundle is deleted, for security, legal and audit purposes; it holds nothing the bundle contained.
- After you delete your account, we keep your name, email address, sign-in identifier and when you deleted it, for security, legal and audit purposes. Only our staff can see it, and it is not deleted.
- Backups of our database keep what it held when each was taken, until that backup expires.
To delete your account, write to us at privacy@open-meridian.com. We delete your account and your personal data, except what we keep for security, legal and audit purposes: your name, email address, sign-in identifier and when your account was deleted, which only our staff can see. Records we keep as the history of who did what show "Deleted account" where your name was. We also delete your account with our sign-in provider, ZITADEL.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your personal data, and to receive it in a portable form. You can change your name in your account settings at any time. To exercise any other right, write to us at privacy@open-meridian.com. We will answer within the time the law requires. You may also complain to your data protection authority.
Security
Sessions are carried in secure, HTTP-only cookies. Passwords are held by our sign-in provider, never by us. Deployments prove who they are with keys whose private half never leaves them. Our database keeps codes, and the tokens agents are given, only as one-way fingerprints. An agent's access lasts at most 90 days, and revoking it, or the authority of the person who delegated it, refuses the agent's next request. No system is perfectly secure; tell us at privacy@open-meridian.com if you find a problem.
Children
The Platform is for businesses and professionals, and not for anyone under 18. We do not knowingly collect data from children.
Changes
We will post changes here and update the effective date. If a change is significant, we will tell signed-in users before it takes effect.
Contact
Societal Lab Inc., New York, United States. Privacy questions: privacy@open-meridian.com.