Secure documents.
Serious about compliance.
merlon is the B2B platform for digital documents and on-demand secure cloud vaults — built so small and mid-sized businesses can run legally binding processes without compromising on data protection.
Compliance workspace
Overview
- 2m
- 14m
- 1h
Built for businesses in regulated industries — across the US and Switzerland
You've lost track of your most important documents
Contracts, personnel files, and financial records sit in email threads and half a dozen cloud drives — with no access control, no version history, and no way to prove who did what. merlon gives you that control back.
Documents everywhere
- Sensitive files scattered across inboxes and personal drives
- No idea which version is final — or who has a copy
- Approvals over email with no audit trail
- An audit or data-subject request means days of searching
Documents under control
- One governed workspace with least-privilege access
- Defensible version history on every document
- Enforced approvals with compliant e-signatures
- A tamper-evident trail you can export in seconds
Enterprise-grade protection, without the enterprise overhead
You handle documents every bit as sensitive as a large enterprise — merlon gives you the security and compliance to match.
Secure by design
Encryption at rest and in transit, granular access control, and round-the-clock monitoring from our in-house security teams.
Legally binding
Compliant e-signatures and immutable audit trails that hold up to legal and regulatory scrutiny on both sides of the Atlantic.
Built for SMB
Enterprise-grade protection without enterprise complexity — deployed on demand, priced to scale with your business.
One platform, four building blocks
Everything you need to create, store, route, and prove your most sensitive documents.
Live in weeks, not quarters
merlon is deployed on demand — no lengthy rollout, no dedicated infrastructure team required.
Bring your documents in
Import existing files or start fresh, and organize them into isolated vaults with the residency you choose — US or Switzerland.
Set access & workflows
Define least-privilege roles, wire up SSO, and turn on approval workflows that match how your teams actually operate.
Prove it, continuously
Every action lands in a tamper-evident audit trail — so answering an auditor or a data-subject request takes minutes.
Two teams. Zero compromises.
We don't outsource trust. Our in-house Blue Team watches every endpoint, log, and packet in real time, while our Purple Team simulates attacks and validates every defensive control before it reaches production.
Blue Team · Detection & Telemetry
Continuous, systematic telemetry across endpoints, logs, and the network — turning raw signals into early, actionable detection.
Meet the Blue TeamPurple Team · Validation & Assurance
Controlled attack simulation and a hard release gate — protection is proven, not assumed, before any change ships to production.
Meet the Purple TeamConnect the tools you already use
merlon plugs into your identity provider, storage, ERP, and collaboration tools — or build your own with the API.
Identity & SSO
Okta, Azure AD, and Google Workspace with SCIM provisioning.
Storage
SharePoint, Google Drive, and Dropbox for import and sync.
ERP & Finance
SAP, Abacus, and Bexio keep financial records in sync.
Collaboration
Slack and Teams notifications where your teams already work.
e-Signature
Built-in compliant e-signature with identity verification.
Automation & API
Zapier, Make, webhooks, and a REST API at api.merlon.ch/v1.
From draft to signature, on the record
Route documents through the exact approval chain your compliance team requires — with every step logged, timestamped, and reversible.
- Legally binding e-signatures with identity checks
- Version history you can defend in an audit
- Conditional routing & multi-party approvals
Isolated, encrypted environments — on demand
Spin up a dedicated, tenant-isolated vault in your chosen region and store your most sensitive documents behind envelope encryption and least-privilege access.
- AES-256 at rest, TLS 1.2+ in transit
- Choose US or Swiss data residency per vault
- Envelope encryption with automated key rotation
Trusted on both sides of the Atlantic
Available in the United States and Switzerland. Your data stays in your region — with the compliance program to match.
United States
Data hosted in a US region for American customers. Operated by Wahlen Software Inc. from New York.
Switzerland
Data hosted exclusively in Switzerland for Swiss & EU customers. Our European HQ, R&D and security in Zürich.
Standards we align our controls with. See Compliance & Regions and the Trust Center.
Built for the people accountable for compliance
"We replaced three tools and a shared inbox with merlon. For the first time our audit trail is something I'd actually put in front of a regulator."
"Data residency was a hard requirement for us. merlon let us keep everything in Switzerland without slowing the business down."
"The security posture sold it. Having an in-house Blue and Purple Team is not something we expected from a vendor our size."