Meridian TMS
Security
Meridian runs carriers' operations, so the platform is built around one rule: your data is reachable only by the people your organization granted, and every exception is explicit and recorded.
Practices
Per-division access control
Every read and write is authorized against the caller's membership and module grants in that division — enforced in the application on every request, not by convention.
Encrypted sensitive data
Tax IDs (SSN/EIN) and bank account numbers are encrypted at the application layer before they reach the database. Passwords are stored as salted bcrypt hashes.
No internal identifiers exposed
Links and API payloads carry random public identifiers, never database IDs — an identifier leaks nothing about volume or sequence, and guessing one reads as not found.
Audited support access
Platform staff reach a tenant only through an explicit, time-boxed support session that shows a banner to the staff member and logs every request it makes — including refused ones.
Separate staff realm
Staff operations run in a separate realm with its own sign-in; a staff credential reaches no customer screen, and the separation is covered by automated tests.
Access ends with employment
Terminating a driver revokes their mobile API tokens immediately and structurally — a separated driver cannot keep using the apps.
Reporting a vulnerability
If you believe you have found a security issue, write to devteam@meridiantms.com with enough detail to reproduce it. Please do not access data that is not yours while demonstrating an issue — a description or minimal proof of concept is enough.
Subprocessors
| Vendor | Purpose | Region |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting and storage | United States |
| Google (Firebase Cloud Messaging) | Mobile push notification delivery | United States |
| HERE Technologies | Address geocoding and truck routing | United States / EU |
Something you need to know that this page does not answer? Ask at devteam@meridiantms.com.