A dual-region architecture, engineered for isolation.
merlon is built so that a request from your browser to a signed, encrypted document follows one narrow, observable path — authenticated at the edge, authorized per vault, encrypted at rest, and logged end to end. Data lives in the region you choose (US or Switzerland ) and never silently leaves it.
metrics.emit latency=41ms · region=CH-eu-1
From client to encrypted vault
A single primary path (solid) carries every request; control-plane services (dashed) authenticate, authorize, log, and observe it. Nothing reaches a vault without passing IAM, and nothing happens without landing in the audit log.
Animation pauses automatically for visitors who prefer reduced motion. Illustrative topology — not an exact deployment diagram.
The controls behind each hop
Every layer in the diagram enforces a specific guarantee. Explore how data flows, how it's encrypted, how keys are managed, and how tenants stay isolated.
One narrow, observable path
A request enters at the API gateway over TLS, where a web application firewall and rate limiting screen it. The gateway verifies the caller's token with Auth/IAM before anything else runs. Application services then resolve the requested object, check the caller's vault-scoped permissions, and — only if authorized — ask the vault to decrypt. Every step emits an audit event and a metric, so the path is fully reconstructable after the fact.
Edge screening
WAF, TLS termination, and rate limiting at the gateway.
Authorize per vault
IAM checks scope before any object is read.
Log everything
Each hop writes to the append-only audit log.
Emit metrics
Latency and region telemetry stream to monitoring.
iam.verify sub=u_204 · scope=vlt_ch_8f21a4
app.resolve doc_4f21a8 · v4
vault.decrypt key=key_ch_hr · ok
audit.write document.read · hash=c4a1…
Encrypted in transit and at rest
Traffic between your client and merlon is protected with TLS 1.2 or higher, using modern cipher suites and forward secrecy. At rest, objects are encrypted with AES-256. There is no point in the path where a sensitive document sits in plaintext on disk — decryption happens transiently, in memory, only for an authorized request.
- In transit
- TLS 1.2+ with forward secrecy; HSTS enforced; legacy protocols disabled.
- At rest
- AES-256 on all stored objects, metadata, and backups.
- In use
- Transient in-memory decryption, scoped to a single authorized request.
- Backups
- Encrypted with the same standard and kept within region.
Envelope encryption, keys that rotate
Each vault has its own data-encryption key (DEK) that encrypts its objects. That DEK is itself encrypted — "wrapped" — by a key-encryption key (KEK) held in a managed key store. This envelope model means rotating a KEK re-wraps DEKs without re-encrypting terabytes of data, and compromise of one vault's material never exposes another. Keys are region-bound: a Swiss vault's keys never leave Switzerland.
Envelope model
Per-vault DEKs wrapped by a KEK in a managed store.
Scheduled rotation
KEK rotation re-wraps DEKs — no bulk re-encryption.
Region-bound
Key material stays inside its data-centre region.
Logged operations
Every key use and rotation is recorded in the audit log.
Logical isolation, enforced at every layer
Each customer is a distinct tenant, and every request is scoped to a tenant and a vault before it touches data. Isolation isn't a single filter — it's enforced at the gateway, in application authorization, and cryptographically via per-vault keys. The result: even a bug in one layer is backstopped by the next.
Enforced by
- Tenant-scoped tokens
- Per-vault authorization
- Per-vault encryption keys
Guarantees
- No cross-tenant reads
- Defense in depth
- Independent blast radius
Backups & disaster recovery
Data is backed up continuously within its region, encrypted with the same AES-256 standard. Recovery objectives are defined and tested so a regional incident is a measured event, not an open-ended outage.
Everything is logged, monitored, and verifiable
The audit log and the monitoring pipeline are separate on purpose. The audit log is an append-only, hash-chained record of what happened to your data — designed for compliance and evidence. Monitoring is a real-time telemetry stream watched around the clock by our Blue Team for anomalies. Together they mean nothing goes unseen, and nothing goes unrecorded.
key.rotate kek_us_root_01 · prev=9c02…
document.export evidence-pack · prev=e410…
Pick a region — and stay in it
Every vault is pinned to a data-centre region at creation. Requests, keys, backups, and audit logs for that vault stay within it. Switch the region toggle in the header to see the specifics for each.
United States Default
Contracted through Wahlen Software Inc. Aligned with the US compliance set for regulated buyers.
- Region ID
US-east-1- API base
https://api.us.merlon.ch/v1- Compliance
- SOC 2 Type II, HIPAA-ready, CCPA/CPRA, US DPF
- Transfers
- Swiss–US & EU–US DPF, SCCs as fallback
Switzerland
Contracted through Wahlen Software GmbH in Zürich, with Swiss data residency and R&D.
- Region ID
CH-eu-1- API base
https://api.eu.merlon.ch/v1- Compliance
- nFADP, GDPR, ISO 27001 (aligned)
- Residency
- Data, keys & backups remain in Switzerland
Certifications reflect standards we align our controls with, not verified accreditations. See Compliance & Regions.
Choose your region in the base URL
Regional isolation is explicit in the API. Point your client at the region your data lives in — api.us.merlon.ch or api.eu.merlon.ch — and every call, key operation, and audit event stays there.
# Swiss residency MERLON_API_BASE="https://api.eu.merlon.ch/v1" MERLON_REGION="CH-eu-1" # United States (default) MERLON_API_BASE="https://api.us.merlon.ch/v1" MERLON_REGION="US-east-1" # request stays in-region end to end curl "$MERLON_API_BASE/documents/doc_4f21a8" \ -H "Authorization: Bearer $TOKEN"
Defense in depth, layer by layer
No single control is trusted alone. The architecture stacks independent safeguards so a gap in one is caught by the next.
Edge & network
WAF, TLS, rate limiting, and private networking between services.
Identity & access
SSO, MFA, RBAC, and least-privilege scoping per vault.
Encryption
AES-256 at rest, TLS 1.2+ in transit, per-vault envelope keys.
Isolation
Tenant- and vault-level separation enforced at multiple layers.
Monitoring
24/7 SIEM telemetry watched by the in-house Blue Team.
Release assurance
Purple Team validation and release gating before production.