HTTPS/443 onlyBuild 2026.6.29.5Last updated June 2026No PHI by design

IT & Security Reference for Meridyon

This page gives hospital IT and security teams the data, hosting, authentication, and operational facts needed to review Meridyon — plus the domains, browser requirements, email delivery guidance, and support escalation paths needed to prepare for go-live.

It doubles as a starting point for security questionnaires. For a security packet or any questions, email [email protected].

Data & Privacy

Meridyon is PHI-free by design. It stores no patient records or clinical data — it schedules clinicians, not patients. Because no PHI is stored, a HIPAA Business Associate Agreement is generally not required; we recommend IT confirm with their own counsel. Your security review covers a workforce-scheduling tool, not a clinical data system.

Data Meridyon stores

Provider names and work contact information
Shift schedules and assignments
FTE / cFTE workforce targets
Organization configuration (teams, call cycles, rules)
Audit logs of administrative and scheduling changes

Hosting & Data Residency

Hosted on dedicated US-based virtual servers, with production in a US East region data center.
Fronted by Cloudflare at the US edge for CDN, DNS, and TLS.
HTTPS/TLS terminates at the Cloudflare edge; traffic continues to the origin over the provider network.

Authentication & Access

Session-based sign-in with bcrypt-hashed passwords and HttpOnly cookies
Passkeys (WebAuthn) for strong, phishing-resistant authentication
Enterprise SSO via OIDC (Okta, Azure AD, Google Workspace) with full ID-token verification — signature, issuer, audience, expiry, and nonce, plus email_verified enforced
12-character minimum password policy
Account lockout and login rate limiting on repeated failed attempts
Role-based access: Admin, Provider, and Team Assigner

Passkeys (WebAuthn) provide phishing-resistant strong authentication today, alongside enterprise SSO with full ID-token verification.

Application Security

CSRF protection on all state-changing requests
Security headers across the app: Content Security Policy, HSTS, X-Frame-Options, X-Content-Type-Options
Audit logging with before/after values, retained 2 years by default (configurable), exportable as CSV or JSON
Tenant isolation — each organization’s data is scoped server-side and is not accessible across organizations

Encryption

In transit: TLS 1.2+ — HTTPS on port 443 only.

At rest: data at rest is managed by the hosting provider’s infrastructure.

Backups & Disaster Recovery

Automated daily database backups.
An off-site copy is replicated to a separate facility.
Restore drills are performed — a restore was verified in June 2026 (backups are tested, not just taken).
Initial recovery targets: RPO ~24 hours, RTO ~1 hour (stated as targets, not guarantees).

Subprocessors

Third-party vendors Meridyon relies on to operate the service.

Cloudflare

CDN, DNS, email routing, edge TLS termination

US hosting provider

Compute and database (dedicated US-based virtual servers)

Stripe

Billing — card data never touches Meridyon servers

Resend

Transactional email delivery

Anthropic

AI features — parsing inbound email requests; no patient data is sent

Sentry

Error telemetry (when enabled)

Certifications — What We Don’t Claim Yet

No SOC 2, ISO 27001, or HITRUST certification yet. If your organization requires one, ask us where we are on the path.
Uptime and availability figures are internal targets, not contractual SLAs. We publish a status page and operate with recovery objectives, but offer no contractual uptime guarantee yet.

We state this plainly because it’s deliberate. What we do stand behind: no patient records or clinical data, verified-ID-token SSO, audit trails with real before/after values, backups we’ve actually restored from, and a public status page.

Allow List URIs

Critical

Meridyon will not function reliably without these.

*.meridyon.comHTTPS/443
schedule.meridyon.comHTTPS/443

Important

The app can run without these, but monitoring, analytics, or email may degrade.

*.sentry.ioHTTPS/443
api.resend.comHTTPS/443
static.cloudflareinsights.comHTTPS/443
cloudflareinsights.comHTTPS/443

Meridyon is designed to sit behind CDN and reverse-proxy infrastructure. Do not pin access to a single static IP address unless Meridyon has provided a site-specific deployment note. Domain allowlisting is the supported default.

Supported Browsers

Windows

Chrome, Edge, Firefox

macOS

Chrome, Edge, Firefox, Safari

iOS/iPadOS

Safari, Chrome

Android

Chrome

Meridyon supports current stable browser versions and does not support Internet Explorer or legacy embedded webviews.

Email Allow List

Meridyon sends transactional scheduling mail from sender addresses on the meridyon.com domain. Allow these domains for notifications, request replies, invitations, and password reset messages.

meridyon.comresend.com

Data Portability & Exit

No lock-in. Customers can export their data at any time:

Schedules as CSV.
Per-provider calendar feeds (iCal).
Audit logs as CSV or JSON.

Support

For production support, contact [email protected].

Include your organization, affected workflow, browser/device, approximate time, screenshots when safe, and whether the issue blocks patient-care scheduling operations.

Response Targets

Critical outage

Scheduling unavailable, login broadly broken, or production data at risk.

Acknowledge within 1 business hour.

High impact

A core scheduling workflow is degraded for one or more teams.

Acknowledge within 1 business day.

Standard

Configuration help, how-to questions, non-urgent workflow issues.

Acknowledge within 2 business days.

Security and Reliability

Role-based access controls for Team Assigner, provider, and admin workflows.
Audit logs with before/after values for administrative and scheduling changes.
Public system health dashboard at /status.
Error telemetry through Sentry when configured.
Daily backups with off-site copies; restore drills documented and performed.

View system health

Go-Live Readiness

Production and testing health endpoints are monitored.
Release checklist covers migration validation, tests, build, health check, and smoke test.
Daily backups are verified and restore drills are documented.
Incident runbooks cover outage, deploy, migration, email, and rollback scenarios.

IT & Security Reference for Meridyon

It doubles as a starting point for security questionnaires. For a security packet or any questions, email [email protected].