Trust Center
Last reviewed: 2026-08-27
One page for procurement, security, and privacy reviewers. Each section links to the canonical artifact. This page intentionally adds no new policy, so nothing here goes stale relative to the underlying documents.
Attestations + frameworks
Stated candidly. Where we do not yet hold an attestation, we say so rather than imply one.
| Framework | Status |
|---|---|
| SOC 2 Type II | In progress: Type I target Q4 2026, Type II in 2027. |
| ISO 27001 | Roadmap: anchored on the SOC 2 control set. |
| HIPAA | Available for the Self-Managed + Managed tiers under a BAA. |
| GDPR / UK GDPR | Processor under tenant DPA. See Privacy + Subprocessors. |
| CCPA | Right-to-Know + Right-to-Delete served by the DSAR endpoints. |
| FedRAMP | Listed on the FedRAMP Marketplace (20x Class A, package FR2633734927), now in Initial Implementation. See the FedRAMP section below. |
Pages + documents
Architecture, NIST 800-53 control mapping, transport + storage controls, MFA + passkeys, RBAC, audit log, the security disclosure channel.
Security overview →SOC 2 Common Criteria evidence map, audit-trail architecture, penetration-testing program, vulnerability disclosure policy, incident response plan.
Compliance docs →Processor framing under Art. 28(3)(a), the personal-data categories we process, lawful basis, DSAR endpoints (Art. 15 export + Art. 17 erasure), cookie disclosure. Accept the DPA in Settings → Privacy and download it as a PDF, or contact contact@meterbox.ai with questions. A public data catalog at /data-catalog (GDPR Art. 30) lists every dataset we hold, and a per-customer lineage query traces every record held about a customer, including the webhooks and warehouse syncs their data went to. An erasure reports anything still holding the subject’s details.
Privacy page →Current subprocessor list with purpose, data processed, jurisdiction, and the per-tier enablement rule. Material changes notified at least 30 days in advance per Art. 28(2) GDPR.
Subprocessor list →WCAG 2.1 Level AA conformance target for the marketing site + tenant dashboard, with the gaps we have not yet certified called out explicitly.
Accessibility statement →How to report a vulnerability, scope, safe-harbor terms, response SLAs. Mirrored from /.well-known/security.txt.
Reporting channel →Architecture facts that drive most procurement questions
- Data locality. Each tenant runs on a single-tenant data plane pod pinned to one region. The database and the cache are bundled in the Helm chart, with no managed datastores. Self-Managed deployments keep data inside your cluster.
- Tenant isolation. Dedicated Kubernetes pods + per-(org, env) storage. No shared database, no row-level filters across tenants, no noisy neighbors.
- Audit log. Append-only, SHA-256 hash-chained for every mutating
/cp/*call. Tenants verify integrity viaGET /cp/audit/verifyand ship to a SIEM viaGET /cp/audit/export(NDJSON). - Customer data egress. None by default. Optional, documented, opt-in egress only for the Meterbox Advisor feature (off until both the privacy toggle and an Anthropic API key are set).
Security
Compliance-grade from the first request: single-tenant isolation, NIST-aligned controls, and a hash-chained audit trail your security team will actually trust.
Technical controls mapped to NIST 800-53 out of the box: access control, audit, session management, transport, and input validation. A compliance-ready foundation that shortens your path to an audit.
SOC 2 · FedRAMP · NIST 800-53TOTP multi-factor with one-time backup codes, OIDC single sign-on for Google and enterprise IdPs, bcrypt-hashed credentials, and NIST 800-63B password rules with breached-password screening via k-anonymity. SCIM provisioning adds people who already have an account only on email domains you have verified with DNS, or once they accept your invite.
RFC 6238 · OIDC · NIST 800-63BThe application enforces sliding idle session timeouts with a hard absolute session lifetime in alignment with FedRAMP AC-11 and AC-12. It implements CSRF protection using the double-submit cookie pattern and secures session cookies with the `HttpOnly`, `Secure`, and `SameSite` attributes. Sessions automatically expire after a period of inactivity and are terminated upon reaching the maximum allowed session duration. Long-lived (e.g., 30-day) session tokens are not permitted.
FedRAMP AC-11 / AC-12User lifecycle events (signup, login, MFA, invites, role changes) land in a tamper-evident SHA-256-chained log on the control plane. A separate billing-ops trail captures plan / customer / credit mutations with before-after diffs. Both pull straight from the API with cursor pagination. Meterbox checks both for tampering every day, and when our staff look up one of your customers, it’s recorded in your log with who looked.
GET /cp/audit · /v1/auditSingle-tenant by design: includes a bundled in-cluster datastore and cache, with no managed or shared database. The provider keys and secrets you connect are encrypted where they are stored, under a key of their own for each of your environments. Optional encrypted off-cluster backups (using a tenant-supplied encryption key, never ours) can be sent to your S3, GCS, or Azure storage on a schedule you choose. Air-gap deployable for regulated and sovereign environments.
Air-gapped by designControl-plane and data-plane traffic is mutually authenticated over mTLS, each side presenting its own certificate issued by an internal CA (not a shared wildcard cert), so a compromised tenant pod cannot impersonate another. Storage volumes use self-managed (CMEK) encryption keys rather than the cloud provider's default. The control plane and data plane run their cryptography through OpenSSL's FIPS 140-3 validated provider.
mTLS · CMEK · FIPS 140-3The OWASP secure headers baseline is applied to every response, including strict `Content-Security-Policy` with violation reporting, HSTS, and cross-origin isolation. Defense in depth is built in from day one, not bolted on after launch. Each environment signs its customers' access tokens with its own key, so a key exposed in one environment can't be used against another.
OWASP · CSP · HSTSFedRAMP
Meterbox's FedRAMP 20x Class A package (ID FR2633734927) has been validated and is listed on the FedRAMP Marketplace, now in the Initial Implementation phase.
Note: this is a listing, not an authorization: we do not hold a FedRAMP authorization today. The technical controls above are already in place and mapped to NIST 800-53 (see Security above), but nothing on this page should be read as an authorization claim ahead of one actually being issued.
- Secure Configuration Guide. Instructions for securely provisioning, configuring, operating, and decommissioning top-level administrative and privileged accounts live at /secure-configuration-guide. Public, no login required.
- Contacts. Security: contact@meterbox.ai. Sales / procurement: contact@meterbox.ai.
- Independent assessment. No third-party assessment organization is engaged yet. See Frameworks above for current status.
- Machine-readable certification package overview. The FRC-CSO-PKG JSON this section and the Secure Configuration Guide are referenced from is published at /fedramp-certification-package-overview.json.
This section, together with the rest of this page, is this offering's FedRAMP Trust Center (CDS-CSO-UTC).
Request a DPA, SOC 2 letter, or security review
Email contact@meterbox.ai. Security-only disclosures go to the channel above under Security.