Security at meo

Your documents are hosted in Montréal, Canada. The meo platform holds a SOC 2 Type 2 attestation.

A SOC 2 Type 2 attestation means that an independent auditor examined meo’s security controls and verified that they work over time, not just on paper.

Your clients’ credit cards are collected and kept by PCI Booking, a service provider assessed as compliant with the PCI DSS standard at level 1, the most demanding. meo never holds the card number. See Credit cards and PCI compliance.

• Encrypted. Your documents and data are encrypted at rest and in every transfer, with TLS 1.2 or later.
• A second layer for sensitive information. Your clients’ answers to information blocks and encrypted notes are encrypted a second time, with AES-256-GCM, with a key unique to each space.
• Backed up every day. A copy of your documents is made every day.
• Removed when due. If your space turns on automatic deletion, meo moves each document to the trash at the end of its retention period; it stays recoverable there for 30 days, then it is permanently deleted. See Retention and automatic deletion of expired documents.

• Access rules in the database. Every table enforces its own access rules: a user sees only the organisations and spaces they have access to, according to their role. These rules are put to the test at every release.
• Sensitive information kept apart. Only users who have access to clients’ sensitive information can display encrypted information.
• Two-factor authentication. Once it is on for your account, the database itself refuses access to your documents, contacts and requests until the code is entered.
• Passkeys. You can sign in with a passkey, such as Face ID, Touch ID or Windows Hello; if two-factor authentication is on, meo still asks for its code.
• Short sessions. By default, meo closes your session after 15 minutes of inactivity, and emails you whenever a sign-in comes from a new device.

See Secure your account.

• The activity log. Every change to contacts, documents, requests and access is logged automatically, with who made it and when. The Activity log exports as a CSV file.
• A fingerprint for every file. Every file gets a SHA-256 fingerprint at upload, and meo later compares it with the stored file: you know whether it has stayed identical.
• Your client’s consent. Before any upload, your client gives their consent, and meo keeps the proof in their record.
• The seal on signed documents. Every signed document is digitally sealed with a key that never leaves a hardware security module (HSM), then timestamped: any later change breaks the seal. See Legal value and verification of a signature.

• More than 8,000 tests at every release. Every meo release goes through more than 8,000 automated tests. The database is rebuilt from scratch, then more than 4,000 checks run against it, access rules included.
• A search for secrets in the code. Every change to the code is scanned for passwords or keys left by mistake, before it is merged.
• Third-party components checked. Before every release, a known serious flaw in a third-party component makes the checks fail.
• Monitoring every 15 minutes. Automated checks look for signs of attack, abuse or data leaks every 15 minutes, and alert meo’s team.
• Service status. It is published at all times at status.documeo.ca.

In Canada, PIPEDA is the federal baseline for private businesses, and British Columbia and Alberta have their own private-sector laws. Quebec’s Law 25 is the most demanding of these laws: meo is built to meet it, which also covers what the others require.

Your organisation remains responsible for its practices; the Privacy page helps you document them.

If you think a security problem affects meo, write to support@documeo.ca.

For a privacy incident involving your clients’ personal information, record it in the incident register: see Report a privacy incident affecting a client.

• Set up the privacy tools
• Frequently asked questions