Encryption
How Meridian encrypts your data end-to-end
Meridian uses strong, modern encryption to ensure that your data remains private at every stage – on your device, in transit, and on the server.
End-to-End Encryption
All user data is encrypted on your device before being sent to the server using ChaCha20-Poly1305, a modern authenticated encryption algorithm. The server only stores encrypted blobs it cannot read. This means that even Meridian’s own infrastructure has no ability to access your information.
Key Management
Your encryption key is derived from your account and stored securely in macOS Keychain. It never leaves your device in plain form.
When you add a new device, keys are transferred securely via X25519 key exchange with QR code pairing. This ensures that your encryption keys move between your devices without ever passing through the server in a readable format.
What’s Encrypted
Meridian encrypts all of your personal data, including:
- Synced emails, calendar events, contacts, tasks, and activities
- Portable OAuth tokens and app-specific provider credentials
AI embeddings and semantic search indexes are kept locally per device and are not synced.
What the Server Can See
A small amount of metadata is necessary for the service to function. The server can see:
- Your login email
- Entity identifiers, types, and timestamps needed for routing and ordering
- Device tokens for push notifications
The server cannot see any message content, contact details, calendar event details, or OAuth tokens.
In Transit
All communication between your device and Meridian’s servers uses TLS encryption. Combined with end-to-end encryption, your data has double encryption while in transit – TLS protects the connection, and ChaCha20-Poly1305 protects the payload.
At Rest
Meridian stores encryption keys in macOS Keychain and runs inside the macOS app sandbox. We strongly recommend enabling FileVault so the device’s local storage is also encrypted at rest.
Data on the server is stored as encrypted blobs that the server cannot decrypt. Even in the event of a server breach, your data remains unreadable.
Key Rotation
Changing your login password rotates the account credential and invalidates older refresh sessions; it does not rotate the account master key. Full master-key rotation and coordinated re-encryption across every device is planned work, not a feature Meridian currently claims to perform.