A security review of Onaro

Short answer. Send the reviewer the Trust Center. It is the status of the controls. The Privacy Policy dated November 5, 2026 is the notice. Incident response is the Security Operations Plan, cited by name on the Trust Center. That plan is not a public page.

What to open

The Trust Center states where customer data lives, how sign-in works, how long each data class is kept, and which controls are implemented or planned. Read the status on the control. A control marked planned is not in place yet. The page shows its last reviewed date.

The Privacy Policy is the customer notice for what is collected and how long Customer Data is kept after termination. The Trust Center retention table is the product clocks. A retention policy someone creates under Governance is their own cleanup schedule. It does not replace the Trust Center clocks. See BigQuery, webhooks, retention, and compliance.

Sign-in

Meridian sign-in and the Microsoft tenant used for Teams are different connections. The Teams agent signs in through Microsoft Entra single sign-on, so the customer's own MFA and Conditional Access policies apply to that sign-in. Connecting a tenant is optional and is only needed for Meridian inside Teams or Copilot.

Single sign-on for the Meridian site is Settings → SSO. It asks for at least one allowed domain.

What a reviewer will not find on the site

The Security Operations Plan is internal. Trust Center controls that cite incident response cite it by name. There is no public copy. The old incident-response draft in the policy folder is retired and is not the plan.

Shadow AI discoveries are observations from Discovery event keys. They are not, by themselves, a record of dollars. See Shadow AI found.

Do not send a reviewer the Insights blog, a draft policy, or an internal playbook. The Trust Center and the Privacy Policy are the pages written for this review.