Skip to content
Security

Your Data, Protected at Every Level

Security is not a feature we added. It is how we built the platform.

Defence in Depth

Multiple layers of protection at every level of the stack. No single point of failure.

Least Privilege

Every user, service, and system has only the minimum access required. Nothing more.

Transparency

We publish our sub-processor list, our security practices, and our incident response process.

Data protection

How We Protect Your Data

Encryption in Transit

All data encrypted via TLS 1.2+ between your browser, our servers, and every third-party service.

Encryption at Rest

Sensitive fields encrypted using AES-256-GCM. Database backups encrypted. API keys stored with authenticated encryption.

Tenant Isolation

Every club's data is completely isolated. Every database query is scoped by tenant. No club can access another club's data.

No Data Selling or Sharing

We never sell your data, share it for advertising, or use it to benefit other clubs. Your data is yours.

No AI Training

Your data is never used to train AI models. AI features process data only to generate outputs for your specific requests.

PCI Compliance

Payment card data is handled entirely by Stripe (PCI DSS Level 1). Card numbers never touch our servers.

Infrastructure

Built for Reliability

  • Two hosting regions. Clubs in the UK, Ireland and Europe are hosted in the EU, on Hetzner servers in Germany with ISO 27001 certified data centres. US clubs go live on a dedicated US East environment, so US member data stays in the United States.
  • The US environment runs across multiple availability zones behind a load balancer, with a standby database in a second zone, point-in-time recovery and backups copied to a second US region.
  • Cloudflare sits in front of the platform for TLS, a web application firewall and DDoS protection. Backend services run on private networks, unreachable from the public internet.
  • Every night the database is backed up, encrypted and then decrypted again to prove the copy is sound before it is kept. We rehearse full restores, so recovery is a practised drill, not a hope.
  • Real-time error tracking, uptime monitoring and automated alerts, around the clock.
Access control

Who can access what

  • Role-based permissions configurable per staff member (owner, manager, staff). Members see only their own data.
  • Passwords hashed with Argon2id. Two-factor sign-in with an authenticator app, and passkeys. Single sign-on available via Google and Microsoft.
  • Clubs can require every staff member to sign in with two-factor authentication.
  • Access tokens expire after two hours and renew through a secure refresh. CSRF protection and HttpOnly cookies.
  • Automated brute force detection with lockout. Alerts triggered after repeated failed login attempts.
  • Links Meridian staff cannot browse your club's data. Support access needs your club's permission: support asks with a reason, a club admin approves it for a set time and can end it at any moment, and your club is told when a session starts and ends. Your club can instead allow read-only support without asking, and only a security incident lets our security lead open read-only access unasked, which your club is told about at once. Access is limited to a small set of platform staff, requires fresh re-authentication, is read-only by default, and every action taken is logged against the named staff member.
  • Every staff change in your club is recorded in a tamper-evident audit log: who, what, when and from where, with secrets redacted. The log is hash-chained and verified every night, so an edited entry is detected.
Incident response

If Something Goes Wrong

  • We monitor systems around the clock for security anomalies.
  • Security incidents are classified, contained, and communicated within 72 hours per GDPR requirements.
  • Affected customers are notified directly with details of the incident, impact assessment, and remediation steps.
  • Active incidents appear as a banner inside the platform itself, in real time, targeted to the clubs affected. Platform-wide incidents are also published to our public status page, which is readable without signing in.
  • To report a security vulnerability, contact [email protected].
Testing

How We Prove It

  • More than 2,300 automated test files, over 500 of them run against a real PostgreSQL database, and more than 130 scripted journeys that sign in as members and staff and work through the product end to end.
  • On money and booking code we deliberately break the code to prove the tests catch each break.
  • Load and soak tests replay a busy club day under heavy load, with no oversold tee time and no unbalanced journal afterwards.
  • An internal red-team review and a nine-area application security audit, repeated before every new environment goes live and at least once a year.
  • Continuous automated scanning of our code, dependencies and containers, and every release passes one gate of builds, type checks, migration guards and static analysis before it reaches production.
  • From go-live: quarterly external vulnerability scans by a PCI Approved Scanning Vendor and an independent penetration test every year.
Responsible disclosure

Found a vulnerability?

  • Report a suspected vulnerability to [email protected]. We acknowledge reports within three business days and keep you updated until it is resolved.
  • Good-faith research within these rules is welcome, and we will not pursue legal action against researchers who follow them.
  • Test only against your own accounts. Do not access, change or keep another club's or member's data; stop at the minimum needed to show the issue.
  • No denial-of-service, spam, social engineering, physical attacks or automated scanning that degrades the service.
  • Give us reasonable time to fix an issue before any public disclosure. We do not run a paid bug bounty.
Compliance

Standards We Meet

FrameworkStatus
UK GDPRCompliant
EU GDPRCompliant
PCI DSS (via Stripe)Compliant
WCAG 2.1 AACompliant

Our Providers' Certifications

  • Stripe (card payments): PCI DSS Level 1 service provider, assessed every year by an independent Qualified Security Assessor. SOC 1 and SOC 2 Type II reports.
  • Hetzner (hosting, Germany): ISO/IEC 27001 certified data centres.

These represent our self-assessed compliance status. We do not currently hold third-party certifications such as SOC 2 or ISO 27001 for Links Meridian itself.

In writing

The Commitments Behind the Platform

Security sits inside a wider set of promises we publish rather than reserve for a sales call.

Published pricingEvery tier, every price, on the site.Read itContract promiseFair terms. No lock-in.Read itYour data, yoursOwn it. Export it anytime.Read itReliability & SLAOur uptime posture, in writing.Read itSecurityGDPR, tenant isolation, PCI via Stripe.Read it

Find us on G2, Capterra, and GetApp.

For more details, see our Data Processing Agreement and Sub-processor List.

Questions about our security practices? Contact [email protected]