Security & Trust

1. Summary

Immigration files hold some of the most personal documents a person has. We want you to know exactly how we protect them, and exactly where we are still growing.

• Meritocrat runs on Amazon Web Services (AWS).
• Data is encrypted in transit, and uploaded files are encrypted at rest.
• Our Privacy Policy and Terms set out binding commitments on how data is used, shared, and protected.
• We have not completed a SOC 2 audit or any other formal security certification.

2. Certifications

We have chosen to focus first on the controls and legal commitments described on this page. A formal audit is something we will pursue as our customer base grows. When that changes, we will update this page. Until then, please do not rely on Meritocrat as if it holds a certification it does not have.

3. Who Meritocrat Is Built For

Meritocrat is built for individual applicants, solo immigration practitioners, and small to mid-size firms. It is not currently designed for enterprise procurement.

If your firm or employer requires a SOC 2 report, a completed vendor security assessment, or other enterprise compliance documentation before adopting a tool, Meritocrat may not meet those requirements today. We are happy to answer questions so you can make that call. See Security Questions.

4. Where Your Data Lives

• Hosting: the Meritocrat website and application run on AWS.
• Files: documents you upload are stored in Amazon S3.
• Application data: case and account records are stored in a PostgreSQL database.
• AI processing: some features send content to third-party AI model providers to generate outputs. How we handle AI-assisted processing is described in our Privacy Policy.

5. How Data Is Protected

• In transit: connections to Meritocrat use HTTPS, and our servers connect to the database over SSL.
• At rest: files stored in Amazon S3 are encrypted at rest using server-side encryption.
• Short-lived file links: links for uploading and opening documents are signed and expire after a few minutes, so a copied link does not stay usable.
• Separation between firms:an attorney's knowledge base content is isolated to that firm's workspace and is not accessible to another firm.

No security system is impenetrable, and we do not claim that ours is.

6. Our Legal Commitments

These commitments are part of our published Privacy Policy and Terms of Service, not just marketing copy:

• We use technical and organizational measures, including encryption in transit and at rest, access controls, and audit logging.
• Meritocrat does not use attorney workspace data, client case files, or knowledge base content to train AI foundation models.
• We do not sell attorney workspace client data or use it for cross-context behavioral advertising.
• For attorney workspaces, the attorney is the data controller and Meritocrat processes client data on the attorney's behalf.
• If a breach affects attorney workspace data, we will notify the workspace customer within 72 hours of discovery, and we will notify affected users and authorities as required by law.
• You can request access to, correction of, or deletion of your personal information as described in the Privacy Policy.

7. Your Part

• Keep your sign-in details private and sign out on shared devices.
• Share your workspace only with people you intend to give access to.
• Attorneys remain responsible for their own professional confidentiality obligations and for obtaining any client consents they need.

8. Security Questions

If you are evaluating Meritocrat for your practice and have questions about how we handle data, or if you believe you have found a security issue, contact us.