How we protect your account
Meridian implements practical security measures that are actually part of the platform — no unverified marketing claims.
Secure account access
Authenticated sessions are used after login. Sessions are protected with secure cookie settings and regeneration on login.
Password protection
Passwords are hashed with PHP’s password_hash (bcrypt) and never stored in plain text. Minimum length and composition rules apply at registration and reset.
Email verification
New accounts receive a time-limited verification link. Unverified accounts cannot access the authenticated application until verification succeeds.
Password recovery by email
Forgot-password flows send a secure, expiring token to your registered email. Only a valid token allows a password change.
Account activity awareness
Last login time and IP are recorded so you can stay aware of recent access to your account.
Input and data protection
Prepared statements protect against SQL injection. Output is escaped to reduce XSS risk. CSRF tokens protect form submissions where applicable.
Meridian does not currently advertise biometric login, SMS OTP, or multi-factor authentication beyond email verification and password-based access. Security features will be documented honestly as they are added.