Trust Center

Last reviewed: 2026-08-27

One page for procurement, security, and privacy reviewers. Each section links to the canonical artifact. This page intentionally adds no new policy, so nothing here goes stale relative to the underlying documents.

Attestations + frameworks

Stated candidly. Where we do not yet hold an attestation, we say so rather than imply one.

Framework	Status
SOC 2 Type II	In progress: Type I target Q4 2026, Type II in 2027.
ISO 27001	Roadmap: anchored on the SOC 2 control set.
HIPAA	Available for the Self-Managed + Managed tiers under a BAA.
GDPR / UK GDPR	Processor under tenant DPA. See Privacy + Subprocessors.
CCPA	Right-to-Know + Right-to-Delete served by the DSAR endpoints.
FedRAMP	Pursuing FedRAMP 20x Class A. Not yet authorized — see the FedRAMP section below.

Pages + documents

Security

Architecture, NIST 800-53 control mapping, transport + storage controls, MFA + passkeys, RBAC, audit log, the security disclosure channel.

Security overview →

Compliance

SOC 2 Common Criteria evidence map, audit-trail architecture, penetration-testing program, vulnerability disclosure policy, incident response plan.

Compliance docs →

Privacy + DPA

Processor framing under Art. 28(3)(a), the personal-data categories we process, lawful basis, DSAR endpoints (Art. 15 export + Art. 17 erasure), cookie disclosure. Contact contact@meterbox.ai to execute a DPA.

Privacy page →

Subprocessors

Current subprocessor list with purpose, data processed, jurisdiction, and the per-tier enablement rule. Material changes notified at least 30 days in advance per Art. 28(2) GDPR.

Subprocessor list →

Accessibility

WCAG 2.1 Level AA conformance target for the marketing site + tenant dashboard, with the gaps we have not yet certified called out explicitly.

Accessibility statement →

Vulnerability disclosure

How to report a vulnerability, scope, safe-harbor terms, response SLAs. Mirrored from /.well-known/security.txt.

Reporting channel →

Architecture facts that drive most procurement questions

Data locality. Each tenant runs on a single-tenant data plane pod pinned to one region. The database and the cache are bundled in the Helm chart, with no managed datastores. Self-Managed deployments keep data inside your cluster.
Tenant isolation. Dedicated Kubernetes pods + per-(org, env) storage. No shared database, no row-level filters across tenants, no noisy neighbors.
Audit log. Append-only, SHA-256 hash-chained for every mutating /cp/* call. Tenants verify integrity via GET /cp/audit/verify and ship to a SIEM via GET /cp/audit/export (NDJSON).
Customer data egress. None by default. Optional, documented, opt-in egress only for the Meterbox Advisor feature (off until both the privacy toggle and an Anthropic API key are set).

Security

Compliance-grade from the first request: single-tenant isolation, NIST-aligned controls, and a hash-chained audit trail your security team will actually trust.

Built for SOC 2 & FedRAMP

Technical controls mapped to NIST 800-53 out of the box: access control, audit, session management, transport, and input validation. A compliance-ready foundation that shortens your path to an audit.

SOC 2 · FedRAMP · NIST 800-53

MFA, SSO & strong auth

TOTP multi-factor with one-time backup codes, OIDC single sign-on for Google and enterprise IdPs, bcrypt-hashed credentials, and NIST 800-63B password rules with breached-password screening via k-anonymity.

RFC 6238 · OIDC · NIST 800-63B

Session controls

The application enforces sliding idle session timeouts with a hard absolute session lifetime in alignment with FedRAMP AC-11 and AC-12. It implements CSRF protection using the double-submit cookie pattern and secures session cookies with the `HttpOnly`, `Secure`, and `SameSite` attributes. Sessions automatically expire after a period of inactivity and are terminated upon reaching the maximum allowed session duration. Long-lived (e.g., 30-day) session tokens are not permitted.

FedRAMP AC-11 / AC-12

Two append-only audit trails

User lifecycle events (signup, login, MFA, invites, role changes) land in a tamper-evident SHA-256-chained log on the control plane. A separate billing-ops trail captures plan / customer / credit mutations with before-after diffs. Both pull straight from the API with cursor pagination.

GET /cp/audit · /v1/audit

Your data never leaves your cluster

Single-tenant by design: includes a bundled in-cluster datastore and cache, with no managed or shared database. Optional encrypted off-cluster backups (using a tenant-supplied encryption key, never ours) can be sent to your S3, GCS, or Azure storage on a schedule you choose. Air-gap deployable for regulated and sovereign environments.

Air-gapped by design

Encryption in transit & at rest

Control-plane and data-plane traffic is mutually authenticated over mTLS, each side presenting its own certificate issued by an internal CA (not a shared wildcard cert), so a compromised tenant pod cannot impersonate another. Storage volumes use self-managed (CMEK) encryption keys rather than the cloud provider's default.

mTLS · CMEK

Hardened by default

The OWASP secure headers baseline is applied to every response, including strict `Content-Security-Policy` with violation reporting, HSTS, and cross-origin isolation. Defense in depth is built in from day one, not bolted on after launch.

OWASP · CSP · HSTS

FedRAMP

Meterbox is pursuing FedRAMP 20x Class A certification. We do not hold a FedRAMP authorization today — the technical controls above are already in place and mapped to NIST 800-53 (see Security above), but nothing on this page should be read as an authorization claim ahead of one actually being issued.

Secure Configuration Guide. Instructions for securely provisioning, configuring, operating, and decommissioning top-level administrative and privileged accounts live at /secure-configuration-guide. Public, no login required.
Contacts. Security: contact@meterbox.ai. Sales / procurement: contact@meterbox.ai.
Independent assessment. No third-party assessment organization is engaged yet — see Frameworks above for current status.
Machine-readable certification package overview. The FRC-CSO-PKG JSON this section and the Secure Configuration Guide are referenced from is published at /fedramp-certification-package-overview.json.

This section, together with the rest of this page, is this offering's FedRAMP Trust Center (CDS-CSO-UTC).

Request a DPA, SOC 2 letter, or security review

Email contact@meterbox.ai. Security-only disclosures go to the channel above under Security.