Merome legal information
Security
Merome takes reasonable measures to protect customer accounts/data. This page distinguishes verified infrastructure/application controls from deployment checks still in progress; no system guarantees absolute security.
1. Implemented foundations
Separate projects/environments; least-privilege IAM/keyless workload identities; Secret Manager; managed encryption at rest; private objects; Cloud SQL automated backups/PITR. OAuth credentials use KMS ciphertext in deployments. Passwords remain with Google Identity Platform; app sessions are host-only, Secure/HttpOnly in deployments, with CSRF and individual revocation.
2. Public edge and authentication
Production Identity, Google-managed HTTPS and independent website/app backends are deployed. Cloud Armor Standard enforces allowed hosts and basic client-IP rate limits; managed WAF signatures remain in preview while their matches are evaluated. Public Cloud Run services accept external browser traffic through the load balancer, with direct external run.app access restricted. App cookies are host-only, Secure and HttpOnly, with CSRF checks; the public website has no app session or private-data access.
3. Reporting a security issue
Email security@merome.io with enough information to reproduce/investigate. Good-faith research must not access others' information beyond strictly necessary demonstration, degrade service, conduct destructive tests/social engineering, retain discovered personal data or disclose unresolved vulnerabilities without reasonable investigation/remediation opportunity. Privacy incidents may also go to privacy@merome.io.
PO Box 263, Pyrmont NSW 2009, Australia
support@merome.io · privacy@merome.io · legal@merome.io · security@merome.io