Compliance & Trust

MeterBox's public compliance posture. For the technical control narrative see our Security page; to report a vulnerability, email contact@meterbox.ai (details below).

MeterBox is billing infrastructure for the AI era. Because we meter and bill on usage data, we treat that data as sensitive by default and build to the controls that enterprise, healthcare, and public-sector customers expect.

Data locality & tenancy

Single-tenant by design. Each customer org runs an isolated control plane plus per-environment data-plane workloads; cross-tenant network paths are denied by default (NetworkPolicies enforced by the cluster CNI).
Your data stays in your cluster. MeterBox bundles its own Postgres and Redis — there are no managed, off-cluster datastores. For on-prem and air-gapped deployments, billing data never leaves the customer environment.
Staff never access tenant data as a standing posture; operational access is least-privilege (read-only Postgres roles for ops / SIEM / auditors).

Security program

Encryption in transit — TLS at ingress with HSTS; in-cluster-only data movement.
Authentication — OIDC SSO, server-side sessions with idle + absolute lifetime caps, and TOTP multi-factor (RFC 6238) with backup codes.
Access control — role-based (owner / admin / member); access removal revokes sessions and memberships.
Auditability — an append-only audit log of mutating control-plane actions, with configurable retention and NDJSON export for off-host SIEM ingestion.
Vulnerability management — continuous dependency scanning (Dependabot + Trivy), an SBOM on every build, and a published remediation SLA.
Independent validation — an annual external penetration test and a coordinated vulnerability disclosure program (see below).

The full control mapping (NIST 800-53) lives on our Security page.

Frameworks

We map our controls to the major frameworks and are progressing each toward a formal assessment. Status below reflects our technical control readiness — not a completed certification:

Framework	Where it fits	Status
SOC 2 Type II	Anchor cert for B2B trust	Controls in place; evidence collection underway
ISO 27001	International SOC 2 analog	Substantial control overlap; assessment planned
HIPAA	AI billing on PHI workloads	In-cluster / air-gap model fits; BAA on request
GDPR / CCPA	We process limited account PII	Data-locality + deletion controls in place
FedRAMP	On-prem / public-sector tier	Targeted via the on-prem deployment model

We publish status honestly: a framework listed here means our technical controls are built and mapped to it — not that a certification has been issued. We name a certification only once it is held.

Reporting a vulnerability

We welcome reports from security researchers under our vulnerability disclosure policy — email security@meterbox.ai, also published at /.well-known/security.txt. Good-faith research within scope is authorized and protected by safe harbor.

Subprocessors

MeterBox uses a small set of subprocessors for payments and communications (e.g. Stripe, Resend). A subprocessor register and the corresponding DPAs are maintained as part of our vendor-management program and available to customers under NDA.