merlon
Log In
PlatformSolutions IntegrationsArchitecture Pricing
Security & ComplianceBlue Team Purple TeamTrust Center Compliance & RegionsResponsible Disclosure
DevelopersAPI Reference ChangelogStatus
Help CenterResources SupportFAQ
About UsCareers ContactLog In
Pricing
Founded in Zürich · 2019

A company built around data protection.

merlon is developed and operated by Wahlen Software — a US-headquartered company with a Swiss engineering, research, and security subsidiary in Zürich. We started in 2019 with a simple conviction: small and mid-sized businesses handle documents every bit as sensitive as the largest enterprise, yet almost never have the security budget to match. We exist to close that gap.

Read our story
US & Swiss entities Security-led by design Follow-the-sun SOC
Wahlen Software — group
Legal entities
US Wahlen Software Inc.Global HQ
CH Wahlen Software GmbHR&D · Security
Operating model
Data residencyUS-east-1 · CH-eu-1
Security teamsBlue + Purple, in-house
SOC coverage24/7 · follow-the-sun
FoundedZürich · 2019
Our story

Swiss-engineered, built for two markets

What began as a Zürich engineering project became a two-entity company serving customers on both sides of the Atlantic — without ever loosening the standard we set on day one.

Why we exist

Enterprise-grade security, priced for the businesses that need it

Small and mid-sized businesses handle contracts, personnel files, and financial records every bit as sensitive as those of a multinational — but rarely have a dedicated security team, a compliance officer, or the budget for enterprise document tooling. So the most sensitive material ends up in email threads and shared drives that were never built for control.

merlon closes that gap. We give SMBs enterprise-grade document security and Swiss-grade data protection, delivered on demand and priced to fit — one governed workspace with role-based access, enforced approvals, and a defensible audit trail behind every action. The engineering, research, and security work happens in Zürich; the global business is headquartered in the United States so North American customers contract, host, and get supported locally.

SMB-focusedSwiss R&DUS HQSecurity-led
The gap we close
Typical SMB today
Contractsemail + drives
Access controlall-or-nothing
Audit trailnone
On merlon
Contractsgoverned vaults
Access controlRBAC · least-privilege
Audit trailtamper-evident
Our mission

"Give small and mid-sized businesses enterprise-grade document security and Swiss-grade data protection — delivered on demand, and priced to fit. Serious protection, without the enterprise overhead."

Every product decision, every hire, and every control we build is measured against that sentence. If it doesn't make sensitive documents safer to handle for a team without a security department, it doesn't ship.

Principles

Four commitments that shape every decision

These aren't values on a wall. They are the tie-breakers we reach for when a trade-off is genuinely hard.

Security-first

Every decision starts with "is this safe?" — not "is this fast?". We would rather ship a smaller feature that we can defend than a larger one we can't.

Swiss precision

Data residency, compliance, and reliability are not add-ons; they're the foundation. Predictability is a feature, and we treat it like one.

SMB-focused

Serious protection, without the enterprise overhead. If a control needs a consultant to configure, we consider it broken and design it out.

Transparency

Clear terms, clear data handling, clear answers. Our sub-processors, controls, and compliance posture live in a public Trust Center — not behind an NDA.

Company structure

One company, two operating entities

merlon is run by two legal entities under the Wahlen Software group. Which one you deal with depends on where you are — and it's designed that way so contracting, hosting, and support all stay local to your region.

Wahlen Software Inc.

Delaware C-Corporation and the group's global headquarters, with operations in New York. It is the primary operating entity and the contracting party for customers in the Americas, and it anchors the US data region.

Role
Global HQ · US operations
Type
Delaware C-Corporation
Operations
New York, NY
Contracts
Americas customers
Data region
US-east-1

Wahlen Software GmbH

The Swiss subsidiary at Germaniastrasse 1 in Zürich — European HQ, and home to R&D, Security, and Swiss data residency. It is the contracting party for EU/EFTA, Switzerland, and the rest of the world, and where the platform is engineered.

Role
European HQ · R&D · Security
Type
GmbH
Address
Germaniastrasse 1, 8006 Zürich
Contracts
EU/EFTA · CH · Rest of World
Data region
CH-eu-1

Contracting entity is determined by your region: Americas → Inc.; EU/EFTA/CH/RoW → GmbH. See the Imprint and Compliance & Regions.

Our journey

From a Zürich startup to a two-region company

The milestones that took merlon from a single Swiss entity to a follow-the-sun operation serving the US and Europe.

2019 · Founded

Wahlen Software GmbH is founded in Zürich to bring enterprise-grade document security to small and mid-sized businesses.

2021 · Compliance

We reach nFADP-readiness and stand up ISO 27001-aligned controls, formalising the security program that had been informal since day one.

2022 · US entity

Wahlen Software Inc. is established in Delaware and the US data region launches, opening merlon to North American customers.

2023 · SOC 2

We begin a SOC 2 Type II program and open operations in New York to support the growing US customer base.

2024 · DPF

We align with the Swiss–US and EU–US Data Privacy Frameworks, formalising lawful transatlantic data transfers.

2026 · SOC

A follow-the-sun SOC goes live, with in-house Blue and Purple Teams handing off shifts between Zürich and the US for 24/7 coverage.

Security-led organisation

Security isn't a vendor we hire. It's a department we run.

Unusually for a company our size, we staff two permanent in-house security teams — a Blue Team for continuous monitoring and detection, and a Purple Team for adversarial validation and release assurance. Together they run a round-the-clock SOC that hands off between Zürich and the US.

2
In-house security teams
Blue + Purple, not outsourced
24/7
SOC coverage
follow-the-sun, both regions
< 5 min
Target detection time
mean time to detect
100%
Releases gated
no unverified deploys
Meet the Blue Team Meet the Purple Team
Leadership by function

How the group is led

merlon is led as one team across both entities. We describe our leadership by function rather than by name — the mandate matters more than the org chart.

Chief Executive Officer

Owns company strategy, the two-region operating model, and the balance between Swiss engineering roots and US commercial growth.

Chief Technology Officer

Leads engineering and platform architecture out of Zürich, accountable for reliability, data residency, and the pace of product delivery.

Chief Information Security Officer

Runs the in-house Blue and Purple Teams and the follow-the-sun SOC, and owns the group security program end to end.

Head of Compliance

Maps controls to nFADP, GDPR, SOC 2, and the Data Privacy Frameworks, and keeps the Trust Center and DPA current across both regions.

Roles are described by function; named appointments are shared with prospects under NDA on request.

Legal entities

Company facts & registration

The canonical details for both entities.

Wahlen Software Inc.

Contracting entity for customers in the Americas.

Type
Delaware C-Corporation
Registered
1209 Orange Street, Wilmington, DE 19801
Operations
New York, NY
EIN
88-3921047
Delaware File No.
7841902
Governing law
Delaware · United States
SOC 2 Type IIHIPAA-readyUS DPF

Wahlen Software GmbH

Contracting entity for EU/EFTA, Switzerland, and the rest of the world.

Type
GmbH
Address
Germaniastrasse 1, 8006 Zürich, Switzerland
UID
CHE-139.189.280
Brand / domain
merlon.ch
Governing law
Switzerland · Jurisdiction: Zürich
nFADPGDPRISO 27001
Values in practice

What "security-first" actually changes

Principles are easy to write and hard to live. Here is how ours show up in the day-to-day, versus how most vendors operate.

How most vendors work

  • Security is a checkbox added late, owned by no one
  • Monitoring and testing are outsourced to a third party
  • Sub-processors and controls are hidden behind an NDA
  • Data residency is "somewhere in the cloud"

How merlon works

  • Security leads the roadmap, owned by an in-house CISO
  • Blue and Purple Teams are our own employees
  • Sub-processors and controls are public in the Trust Center
  • Residency is an explicit choice: US or Switzerland

We're hiring across Zürich and the US

If you want to build document security that a team without a security department can actually run, we'd like to talk. Engineering and Security roles are on-site in Zürich; commercial and support roles are US-remote or New York.

See open roles

Where to next

Security

How our two in-house teams protect your documents.

Learn more

Compliance & Regions

CH/EU and US frameworks, side by side.

Learn more

Careers

Join the team building it, in Zürich or the US.

Learn more

See what a security-led company builds

Thirty minutes is enough to show you how merlon puts your most sensitive documents under control — with residency in the US or Switzerland.

Talk to Sales