Meridian
Join the beta

Privacy Policy & Consumer Data Right (CDR) Policy

Applicable Law: Privacy Act 1988 (Cth), APPs • CDR Rules 2020 • Last Updated: October 2026

1. Overview & Privacy-First Architecture

Meridian is engineered from the ground up to protect personal financial sovereignty. Unlike conventional cloud-based personal finance apps that store and monetize your bank statements on external servers, Meridian operates on a local-first architecture:

  • Your financial transactions, balances, tax records, and superannuation data remain exclusively on your computer.
  • Data is encrypted at rest using ChaCha20-Poly1305 authenticated encryption (256-bit key) via SQLite3MultipleCiphers.
  • The database key is a random 256-bit key generated on your device. It is stored only in wrapped (encrypted) form, protected by AES-256-GCM under a key derived on your device from your master password with scrypt (with optional biometric quick-unlock, such as Touch ID on Mac, via your operating system's keychain).
  • Meridian Finance Labs has no access to, nor do we ever store, your financial statements on our servers.

2. Data Classification: Server vs. Local Device

2.1 Server-Side Account Metadata (Minimal Cloud Footprint)

Our authentication servers store only minimal data required to manage user identity and account access:

  • Account Identity: Email address and cryptographically hashed password (or OAuth subject ID).
  • Account Status: Account identifier and beta invite verification status.
  • Open Banking Consent Records: End-user mapping identifier and mandatory CDR consent expiry timestamps (as required by statutory ACCC/OAIC rules; recorded only when you connect an Open Banking feed).

2.2 Client-Side Financial Data (100% Stored on Your Machine)

The following information never leaves your personal device:

  • Bank account numbers, BSBs, balances, and transaction history.
  • Categorization rules, merchant overrides, and expense tags.
  • Household profiles, family member details, and salary figures.
  • Superannuation fund balances, employer SG contributions, and Division 293 estimates.
  • Property valuations and mortgage amortization schedules.

3. Open Banking & Consumer Data Right (CDR)

Meridian supports automated bank data synchronisation through the Australian Consumer Data Right (CDR) framework. The following statutory policies and operational standards apply to all Open Banking connections:

  • CDR Representative Model: Meridian operates as an authorised CDR Representative of our Accredited Data Recipient partner (Fiskil), regulated by the ACCC.
  • What Fiskil Receives: To set up your bank connection, we give Fiskil a synthetic identifier (an address ending in @cdr.meridian-labs.finance) to create your Fiskil end-user record. We do not share your real email address with Fiskil. Fiskil collects your bank data from your bank under your consent and passes it to your device through our proxy.
  • Strict Purpose Limitation: CDR data is retrieved solely to sync your personal accounts within your local desktop application. We do not sell, rent, monetize, or share CDR data with third parties.
  • 12-Month Expiry & Immediate Revocation: Under statutory CDR rules, bank consents expire after 12 months. You may revoke consent at any time via the in-app Consent Dashboard or your bank's portal.
  • Zero Server Storage: CDR transactions flow through an encrypted, stateless proxy and are written directly into your local database. No bank transactions are stored on our servers. The proxy runs in Sydney (ap-southeast-2), so CDR data in transit stays in Australia.

4. Security Standards & Optional Analytics

  1. Local Encryption: Database encrypted with ChaCha20-Poly1305 (256-bit key) via SQLite3MultipleCiphers. The database key is wrapped with AES-256-GCM under a password-derived key (scrypt, N=2^17, r=8, p=1).
  2. Transit Security: All API communications with cloud authentication services use TLS 1.2 or higher (TLS 1.3 where both sides support it).
  3. Zero Third-Party Trackers: No third-party analytics trackers, no session replay tools, and no advertising pixels are bundled into the desktop app.
  4. Optional First-Party Usage Analytics: Anonymized lifecycle and feature adoption events may be collected strictly on an opt-in basis (unchecked by default). Financial data, dollar figures, account balances, and bank names never leave your device. All telemetry events are stored on first-party servers with a strict 400-day rolling retention and can be disabled at any time in Account Settings.

5. Data Deletion Rights

Under the Australian Privacy Principles (APPs 12 & 13):

  • Instant Local Wipe: The in-app "Delete All Data" utility securely wipes your local database from your device.
  • Account Deletion: You may request complete erasure of your cloud authentication profile by emailing privacy@meridian-labs.finance. We complete deletion within 30 days and confirm by email.

6. Contact Details & Privacy Officer

Privacy Officer, Meridian Finance Labs
Email: privacy@meridian-labs.finance