Diligence, without the sales call.
Everything a reviewer needs, on the page rather than behind a form.
Eight questions get asked every time. Here they are, each with its own page.
- Where your data livesWhere the infrastructure runs, who runs it, and whose law can reach the data.
- SubprocessorsEvery third party that touches customer data, and what each one sees.
- SecurityTenant isolation, staff access, and the supply chain.
- Privacy and your rightsThe processing agreement, retention, export, deletion and breach notice.
- AI and your dataWhat uses a model, what gets sent, and whether it trains on anything.
- AccessibilityWhat has actually been checked, what has not been assessed, and how to report a barrier.
- ComplianceWhat we hold, what we are working towards, and what we do not have.
- Report a vulnerabilityHow to reach us, what is in scope, and what happens after you do.
What is true today. Only claims we can point at code or a contract for.
- The company
- Mercleo Technologies Inc., a Canadian company.
- Tenant isolation
- Every row of customer data is scoped to the account and enforced by row-level security in the database, not by application code. A static audit checks it on every build.
- Staff access
- Administrative and entitlement changes are logged, and access to personal data is recorded separately. Records are soft-deleted rather than destroyed, so history stays reviewable.
- Sign-in
- Centralized across every product. Bring your own SSO: Google Workspace, Microsoft Entra, Okta, or any OIDC provider. Membership is invitation-based and access is role-aware.
- Payments
- Processed by Stripe. Card data never touches Mercleo.
- Every marketing send carries an unsubscribe link and a preference centre. Consent tooling ships in the product rather than being your problem.
- Supply chain
- Dependencies are pinned exactly, installed from a frozen lockfile, scanned on every pull request, and held for 72 hours after publication before adoption.
And what is not, yet. Listing the gaps is cheaper than being caught in one.
A trust centre that lists only strengths tells a reviewer nothing, because every trust centre lists only strengths. So the pages above also say what we do not have: no certifications yet, no third-party penetration test yet, no published recovery targets, no Canadian residency claim. Each gap is stated on its page, next to what we do instead.