Security Policy
Security Policy
Meld builds products with security top of mind. Meld's security practices aspire to exceed industry standards, with numerous controls in place to keep your data safe. We use secure cloud infrastructure, best-in-class encryption protocols, two-factor authentication, and 24/7 monitoring to protect customers’ data. These policies are continuously monitored and updated. This policy is not meant to be exhaustive, but rather a guide to our overall security and information security postures.
HTTPS secure connections
Meld forces HTTPS for all our services, including our public website and the Dashboard to ensure secure connections: Our API gateway and web servers detect HTTP connections and automatically redirect them to connect via HTTPS.
All Meld APIs are served over TLS, with version 1.2 being the required minimum.
Meld’s Dashboard, Bank Linking widget and Crypto purchase widget accesses Meld’s servers over TLS and verify TLS certificates on each connection.
We leverage AWS Certificate Manager to create certificates from a trusted certificate authority, and auto-renew them to ensure no interruptions to our services. We regularly review the ciphers AWS supports, upgrading to the latest recommended version when available.
Authenticated API access
All API calls (directly from the customer or via the Dashboard) are authenticated by our servers.
Customers calling our APIs are required to pass in an Authentication header that is populated with the Meld API Key issued to them. This same key is used for Authorization, allowing access to specific features the customer’s account is configured for. These keys are generated leveraging AWS KMS, using AES-GCM with an HMAC-based extract-and-expand key derivation function (HKDF), an Elliptic Curve Digital Signature Algorithm (ECDSA) signature, and a 256-bit encryption key.
Lifecycle of the Meld API Key
Can customers rotate it? – Yes. Our customers can log into the Dashboard, navigate to the Developer > API Keys page, select the desired key and roll the key.
What happens to it when a customer stops using Meld? – Besides marking the customer’s account as inactive we will also disable the corresponding key. This helps ensure there can be no fraudulent transactions with the key going forward.
Customers logging into our Dashboard need a username and password. They will receive an email from Meld to set up their user account. After logging in, a secure time-bound token is generated and used by the Dashboard to access various Meld APIs.
Data storage encryption
All data is encrypted at rest using AES-256. The cryptographic keys are stored on separate machines from the database servers. The databases need to retrieve the keys to perform encryption/decryption when executing queries.
The encryption & decryption is handled at the database layer, therefore the applications themselves do not have access to the cryptographic keys.
Data is retained for seven (7) years, after which it is purged.
Sensitive data encryption
In addition to the standard data encryption at rest, Meld performs additional steps for the following sensitive data types:
PCI
Meld does not store PCI data. For certain Fiat payment flows we simply pass through card numbers to the service provider. This is completely handled in-memory, and the data is never logged anywhere.
Customer’s Service Providers credentials
When a customer uploads their service provider’s (SP) credentials to Meld (usually via our Dashboard) it is secured throughout the flow:
Logging into the Dashboard is done over HTTPS/TLS.
Inputting your credentials in the Dashboard and saving it to our servers is done over HTTPS/TLS.
When our servers receive your credentials we use AWS KMS + AWS Encryption SDK to encrypt it using AES-GCM (1st level of encryption).
We write the encrypted credentials to the database, which performs its own encryption on it (2nd level of encryption).
Dashboard credentials
The user’s username & password are never stored in the primary databases. Instead, they are stored in AWS Cognito, which uses RS256 (an RSA signature with SHA-256) to encrypt these credentials.
Systematic security updates
We regularly apply non-critical security updates and patches to our servers on a predefined schedule. Critical updates are applied ASAP that minimizes impact to our customers.
Coding best practices
Feature development follows industry-standard secure coding best practices, like those recommended by OWASP.
As part of our product development cycle we have a gated quality control process requiring multiple rounds of testing in our staging environments before releasing new code into production.
Internal Security
Application data is strictly controlled on a need-to-know basis.
Cryptographic keys are stored in AWS KMS and can never be downloaded or accessed by anyone in the firm, not even by the firm’s AWS Admins.
Meld requires 2FA and strong password controls for administrative access to Production systems. Currently, only the CEO & CTO has access to these, which are stored in 1Password.
All access to secure services and data is logged and audit logs are reviewed on a regular basis.
Addendum: Information Security Policy
Purpose
This Information Security Policy establishes the framework by which Meld Universal Inc. (“Meld”) protects its information assets and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.
The objective of this policy is to ensure the confidentiality, integrity, and availability (“CIA”) of information in alignment with industry best practices and the expectations of Meld’s partners and stakeholders.
Scope
This policy applies to:
All employees, contractors, and service providers engaged by Meld
All information systems, networks, platforms, and applications operated or managed by Meld
All data processed, stored, or transmitted by Meld in connection with its services
Information Security Principles
Meld maintains an information security program based on the following principles:
Confidentiality
Information is protected against unauthorized access and disclosure through:
Role-based access controls (RBAC)
Strong authentication mechanisms
Encryption of sensitive data in transit and at rest
Data classification and handling procedures
Integrity
Information is safeguarded against unauthorized modification through:
Change management processes
System and data validation controls
Logging and monitoring of system activity
Version control and audit trails
Availability
Systems and data are accessible when needed through:
Redundant infrastructure and failover mechanisms
Regular data backups and recovery testing
Incident response and business continuity planning
Performance monitoring and capacity management
Information Security Program
Meld maintains a formal information security program designed to protect its platform and the integrity of integrations with third-party providers.
Governance and Risk Management
Identification, assessment, and management of information security risks
Periodic risk assessments and mitigation planning
Defined security roles and responsibilities
Access Control
Least privilege access principles
User provisioning and deprovisioning procedures
Periodic access reviews
Asset Management
Inventory and classification of information assets
Ownership and accountability for all systems and data
Data Protection
Encryption standards for sensitive data
Secure data storage and transmission practices
Data retention and disposal procedures
Security Monitoring and Logging
Continuous monitoring of systems and networks
Centralized logging of security-relevant events
Alerting for suspicious or unauthorized activities
Incident Response
Documented incident response procedures
Defined escalation and communication protocols
Post-incident review and remediation
Business Continuity and Disaster Recovery
Business continuity planning to ensure operational resilience
Disaster recovery procedures with defined recovery objectives
Periodic testing of recovery capabilities
Vendor and Third-Party Security
Security assessments of critical vendors and infrastructure providers
Contractual security requirements where applicable
Ongoing monitoring of third-party risk
Responsibilities
Management: Ensure implementation and enforcement of this policy across Meld
Employees and Contractors: Adhere to all security requirements and promptly report security incidents or concerns
Designated Security Function: Maintain and oversee Meld’s information security program