BigQuery export, webhooks, retention, and compliance

These four cards are on Governance. The Governance item in the top nav is there when the account includes governance. Back to Governance on each page returns to that hub.

/meridian/settings/retention only says "Redirecting to Governance..." and opens Data Retention. The card line "SOC 2-aligned program" is the label on Governance. It is not a certification statement.

BigQuery Export

The title is BigQuery Export. The line under it is "Export governance data to Google BigQuery". Create Export opens the setup dialog.

The note is "Export your organization's governance data to your own Google BigQuery project. Data stays in your GCP account. Requires governance (settings.manage) permission."

A load without that permission says "Governance permission required. You need audit.view or settings.manage to access BigQuery exports." Any other failed load says "Failed to load exports".

How to set up Google Cloud for BigQuery export

The panel starts closed. Open How to set up Google Cloud for BigQuery export. The steps are:

1. Create a Google Cloud project (or use an existing one). The link is console.cloud.google.com.
2. Create a BigQuery dataset in your project. "BigQuery → Create dataset → Choose a name (e.g. meridian_governance)".
3. Create a service account. "IAM & Admin → Service Accounts → Create Service Account → Name it (e.g. meridian-bigquery-export)".
4. Grant roles to the service account. "Add roles: BigQuery Data Editor, BigQuery Job User".
5. Create and download a JSON key. "Service account → Keys → Add Key → Create new key → JSON → Download".
6. Use the JSON file here when creating an export. "The key is encrypted and stored securely for your organization only."

Quick CSV Export

Quick CSV Export says "Download governance data as CSV (last 30 days by default). No cloud setup required."

Table starts on ai_requests. The choices are ai_requests, session_events, sso_audit_log, ip_access_log, department_spend, and compliance_reports.

Last N days is 7 days, 30 days, 60 days, or 90 days. It starts on 30 days.

Download CSV saves the file named in the response, or {table}_last{n}days.csv. Success says "Downloaded {filename}". A failure says the server message, "Export failed", or "CSV export failed".

Report Templates

Report Templates says "Predefined filtered reports. Curated queries—safe, no SQL required."

Report lists the templates the server returns, each with its description under the menu. While they load, the menu says "Loading templates...". Last N days is the same 7, 30, 60, and 90 day list, starting on 30 days. Download Report stays disabled until a report is selected. The file name comes from the response, or {template}_last{n}days.csv. Success says "Downloaded {filename}". A failure says "Template export failed", or the server message.

Saved exports

An empty list says No exports configured and "Create an export to start syncing governance data to BigQuery", with Create Export.

Each saved export shows its name, description, {project}.{dataset}, schedule, last run time, a status badge, and "{n} tables". Logs opens Export Logs: {name}. An empty log says "No logs yet". Run Now says "Export started (log: {id})", or "Failed to trigger export". Delete asks "Delete this export configuration?" Success says "Export deleted". A failure says "Failed to delete".

Create BigQuery Export

Create Export opens Create BigQuery Export. Five steps, with Next, Back, and Cancel.

Create is the button on the last step. Missing name, project, dataset, credentials, or tables says "Name, Project ID, Dataset ID, credentials, and at least one table required". Success says "Export created successfully". A failure says the server message, or "Failed to create export".

Webhooks

The title is Webhooks. The line under it is "Connect your apps to governance alerts". Create Webhook is at the top right.

The note is "Receive HTTP POST requests when governance events occur. Use HMAC-SHA256 (X-Webhook-Signature) to verify authenticity."

With no organization, the page says "Organization context required."

Active only hides inactive endpoints.

An empty list says "No webhooks configured" and Create your first webhook.

Each endpoint shows its name, an active or inactive badge, the last delivery status, the description, Endpoint URL, and Subscribed Events ({n}). The row actions are Pause or Activate, Send test, View logs, and Delete. When a delivery has already run, the row also shows "Last delivery: {time}" and View Logs →.

Pause says "Webhook paused". Activate says "Webhook activated". Send test says "Test webhook sent", or "Test failed". Delete asks "Delete this webhook endpoint?" Success says "Webhook deleted". A failure says "Failed to delete".

Create Webhook

The descriptions shown beside those events are:

Cancel closes the dialog. Create Webhook sends it. Success says "Webhook created successfully". A failure says the server message, or "Failed to create webhook".

Delivery Logs

Delivery Logs — {name} columns are Time, Event, Attempt, Status, Response, and Actions. An empty log says "No deliveries yet". Time is the delivery time, "Retry: {time}" when a retry is waiting, or an em dash. Attempt is "#{n}". Status includes the HTTP code when there is one. Response shows milliseconds and, in red, any error text. A failed row has Retry. Success says "Retry scheduled".

Data Retention

The title is Data Retention. The line under it is "Manage data retention policies and automated cleanup".

The four figures, when a log summary is available, are Active Policies, Total Deleted (30d), Executions (30d), and Success Rate. Success rate is successful executions divided by total executions over 30 days, rounded. With no executions it shows 100%.

When there are no policies, the banner is No retention policies configured and "Create default policies to start automated cleanup".

Initialize Defaults asks "Create default retention policies for all data types?" Enable GDPR Mode asks "Enable GDPR compliance mode? This will set minimal retention periods (30-365 days)." Each button then shows the server message.

The tabs are Policies ({n}), Cleanup Logs ({n}), and Statistics.

Policies

Add Policy opens Create Retention Policy.

Data Type starts on "Select data type...". Each choice is "{name} (Recommended: {n} days)". Choosing one fills Retention Period (days) with that recommended number. The period accepts 1 to 7300. Under the box: "{years} years, {remainder} days".

Cleanup Schedule is Daily (2:00 AM), Weekly (Monday 2:00 AM), or Monthly (1st day, 2:00 AM).

Create Policy stays disabled until a data type is chosen. Success says "Policy created successfully". Cancel closes the form.

Active Policies is empty with "No retention policies configured". Each policy shows its name, category, Active or Disabled, "Retention: {n} days", "Schedule: {schedule}", Last run, and Next run.

Edit opens Edit Retention Policy with the policy name, Retention Period (days), and Cleanup Schedule (the same three schedules). Save says "Policy updated successfully". Cancel closes it.

Run Now asks "Execute cleanup for {name} now? This will delete old data immediately." Success says "Cleanup executed: {log id}". Disable says "Policy disabled". Enable says "Policy enabled".

Cleanup Logs

The heading is Cleanup Execution Logs. Empty logs say "No cleanup executions yet". Each row is the data type, "Deleted {n} records in {seconds}s", the start time, and the status (completed, failed, or the status text returned).

Statistics

Each data type is a card with Total Records, Oldest Record (or N/A), and Storage Size.

Compliance Reporting

The title is Compliance Reporting. The line under it is "Generate audit-ready reports of your Meridian governance controls".

With no organization, the title is Organization Required and the line is "You need to be part of an organization to manage compliance reports."

Compliance Score

Compliance Score is "{score}/100" and Grade {letter}. How is this calculated? opens this list. The score starts at 100:

• −20 if SSO is disabled
• −15 if IP allowlist is disabled
• −10 if session timeout is over 480 minutes
• −10 if session limits are not enforced
• −5 per open high or critical finding

"Grade: A (90+), B (80+), C (70+), D (60+), F (<60)".

Quick Stats are Users, Departments, and SSO (Enabled or Disabled).

This score is the control checklist on this page. It is not an outside attestation.

Generate Report

The tabs are Generate Report, Report History ({n}), and Findings ({n}).

Select Report Type lists each template the server returns: the template name, its description, and "{n} sections". Pick one. The selected card shows a check.

Report Settings are Period Start Date and Period End Date. Generate Report stays disabled until a type and both dates are set. While it runs, the button says Generating.... Success says "Report generated successfully (ID: {id})".

Report History

The heading is Generated Reports. Empty history says "No reports generated yet" and Generate Your First Report.

Each row is the report title, "Period: {start} - {end}", "Generated: {time} • {milliseconds}ms", and, when the summary has them, "Score: {n}/100" and "{n} findings". View opens the report. PDF downloads it. The open report repeats the title and period and has Download PDF.

Findings

The heading is Compliance Findings. With none open, the page says "No open findings" and "Your governance controls are compliant".

Each open finding shows its severity, title, Get notified when similar findings occur, the control area, the description, and "Found: {date}".