Jurisdiction is not a detail. It is architecture.
Digital sovereignty means control over your data, infrastructure, AI and deployment. Our European engineering serves that control — wherever your organisation operates.
European roots. Customer control.
Meridian Technologies is a Belgian company, developed and governed from Europe. Our commitment to European technological sovereignty remains. The architecture is designed around customer choices: where the platform runs, who has access, which AI is used and how deployment is governed. Applicable requirements are assessed for each implementation.
Connectivity is a vulnerability.
For critical infrastructure and military command, every outbound connection is a dependency. Meridian runs without telemetry or phone-home — in a sovereign cloud, on-premise or on air-gapped networks.
- 01
Sovereign public cloud
In your own tenancy, on cloud infrastructure selected for your data-residency, access and governance requirements. Hosting choices and applicable obligations are assessed per project.
- 02
On-premise data centre
Inside your own enterprise or government data centre, run by your own operations team.
- 03
Air-gapped networks
Fully disconnected networks and classified enclaves, with no telemetry and no phone-home — built on our team’s experience with disconnected environments.
Three models. One decision.
Legal jurisdiction
Subject to extraterritorial legislation (incl. US CLOUD Act, FISA 702).
Local entity, with varying supply-chain dependencies.
Belgian company under European jurisdiction; customer-deployment requirements are defined per project.
Data model
Central copy of your data in a closed vault.
Custom point-to-point links on legacy systems.
Its own data layer inside your environment; your sources stay where they are.
Air-gapped deployment
Limited; often dependent on telemetry synchronization.
Manual custom builds, redone per project.
Runs disconnected, without external telemetry; air-gapped deployment is available today.
Compliance framework
Built to foreign standards; European frameworks as an afterthought.
To be demonstrated anew for every tender.
Built for GDPR, NIS2 and DORA obligations; certification roadmap starting with ISO/IEC 27001.
What we design for
European ownership, transparent governance
Meridian Technologies is a Belgian company under European jurisdiction. Access policy, hosting choices and obligations for a customer deployment are explicitly defined per project.
Customer-controlled encryption keys
You hold the keys, not us. Data can only be decrypted inside your own perimeter.
Verifiable audit logs
Queries and changes recorded in a verifiable log — auditable by your own oversight bodies.
No outbound telemetry
In air-gapped configuration nothing leaves your perimeter: no call-home, no usage data, no silent updates.
Built in today. Certified step by step.
We would rather show you where we stand than display badges we do not hold. This is what the architecture is designed for — and what we certify next.
- Today · designed for
These are obligations on you or limits set by courts — no certificate exists for them. Meridian’s architecture is built to help you meet them.
EU regulationGDPR
Data protection by design: data stays in your environment, access is bound to a purpose and queries are logged.
EU directiveNIS2
Cybersecurity and supply-chain obligations for essential and important entities. Meridian removes a foreign supply-chain dependency and produces incident timelines for your reporting.
EU regulationDORA
ICT third-party risk rules for the financial sector. Meridian supports exit strategies without lock-in and keeps complete audit trails.
Federal Constitutional Court · GermanyBVerfG
In 2023 the court set constitutional limits on automated police data analysis. Meridian is designed for exactly those safeguards: purpose binding, role-based access and traceable query logs.
- Next · first certification
Our first formal certification: the foundation every further attestation builds on.
International standardISO/IEC 27001
Certification of our information security management system by an accredited certification body.
- Then · with our deployments
Market-specific qualifications we pursue as customer deployments require them. Until then, Meridian can run inside your own accredited environment.
BSI · GermanyBSI C5
Attestation against the BSI cloud security criteria — relevant once Meridian operates a cloud service for German customers.
ANSSI · FranceSecNumCloud 3.2
ANSSI’s qualification for cloud service providers. Meridian first runs inside environments that already hold it; its own qualification follows if it operates a managed cloud service in France.
Germany · public procurementEVB-IT Cloud
Germany’s standard contract terms for public IT procurement — applied to our contracts as we bid for German public-sector tenders.
What procurement teams ask.
Is Meridian subject to the US CLOUD Act or FISA Section 702?
- Meridian Technologies is a Belgian company under European jurisdiction. The platform is designed for your own environment, with customer control over data, access, AI and hosting. This is not a blanket exemption from legal obligations: applicable requirements and responsibilities are assessed for each implementation.
Can Meridian run fully air-gapped?
- Yes. Meridian runs in a sovereign cloud, on your own servers or fully air-gapped — no internet connection, no telemetry, nothing phoning home. Our team has experience with disconnected networks, and the AI models run locally.
Does Meridian copy our data into its platform?
- Not into ours. The data layer of Meridian Platform reads from your source systems and structures what the picture needs, inside your own environment. Your source systems remain the system of record and are never written to; nothing is copied to Meridian or to a vendor cloud.
Who holds the encryption keys and the audit trail?
- You do — that is how Meridian is designed. Access is governed in your own environment, with customer-controlled encryption keys and a tamper-evident log of every query, so you can show who looked at what, and when — the traceability the German Constitutional Court’s 2023 ruling on automated data analysis calls for.
Is Meridian certified for SecNumCloud, BSI C5 or ISO 27001?
- Not yet, and we say so plainly. The architecture is designed for the obligations in GDPR, NIS2 and DORA. ISO/IEC 27001 is our first certification target; market-specific qualifications such as BSI C5 and SecNumCloud follow as deployments require them.
How does Meridian help with NIS2 and the CER Directive?
- Both require operators of essential services to manage risk, detect incidents early and report them fast. Meridian puts physical, cyber and field events on one timeline, which shortens detection and gives you the incident record for your report. Compliance itself remains your organisation’s process — Meridian supports it, it does not replace it.