Security and Privacy
How the portal protects your records, and how you can protect your own access.
Security measures applied to this portal
The measures below are implemented in this application. No claim is made about external certifications, regulatory approvals or audits unless the operator has separately published them.
Password protection
Passwords are stored only as a one-way bcrypt hash with a per-password salt. The original password is never stored and cannot be recovered — only reset.
Two-factor authentication
You can enable an authenticator-app second factor, with single-use recovery codes for the event that you lose the device.
Server-side authorization
Every page and every action re-checks your role and your ownership of the record on the server. Hiding a button in the interface is never the only control.
Session protection
Sessions expire after a period of inactivity and have an absolute maximum lifetime. Signing out destroys the session immediately.
Login throttling
Repeated failed sign-in attempts are counted per account and per network address, and access is temporarily locked once a threshold is reached.
Private document storage
Uploaded documents are stored outside the public web directory under randomly generated names. They are never reachable by a direct URL.
Audit logging
Sign-ins, failed attempts, document access, record changes and approvals are written to an append-only audit log that the application cannot modify.
Request protection
All state-changing requests carry a CSRF token, and all database access uses parameterised queries to prevent injection.
How your data is handled
Personal information is collected only to administer your beneficiary record. The portal applies data minimisation: it asks for what the administration process requires and no more.
- Storage location
- Records are held in a private database on the operator's hosting account.
- Document storage
- Uploaded files are held outside the public web directory and served only to authorised users.
- Access
- Access is limited to the record owner and staff whose role requires it. Every access is attributable.
- Retention
- Records are retained for as long as the administration process and applicable law require.
Protecting your own access
It will never ask for your online banking password, card security code, PIN, or a one-time banking verification code. Any message that does is fraudulent, whoever it appears to come from.
- Use a long, unique password that you use nowhere else.
- Enable two-factor authentication in Account Settings.
- Check the address bar before signing in, and never follow a link from an unexpected message.
- Keep your recovery codes somewhere offline and private.
- Sign out when you have finished.
Reporting a security concern
- If you believe your account has been accessed without authorisation, change your password immediately from Account Settings.
- Then contact support using the published details so the access can be investigated and the audit log reviewed.
- If you receive an email claiming to be from the portal asking for credentials or payment, do not respond. Report it to the operator.
- Do not send identity documents by ordinary email. Use the Document Center, which stores them privately.
Report to the operator
- Operator
- Meridian Asset Administration Services
- Security email
- support@example.com
- Telephone
- +1 (555) 010-2200