merlon
Log In
Pricing
How it works

A dual-region architecture, engineered for isolation.

merlon is built so that a request from your browser to a signed, encrypted document follows one narrow, observable path — authenticated at the edge, authorized per vault, encrypted at rest, and logged end to end. Data lives in the region you choose (US or Switzerland ) and never silently leaves it.

See the data flow
TLS 1.2+ in transit AES-256 at rest Regional isolation
Request trace — doc.read
1 · ClientTLS 1.3 handshake
2 · API gatewaytoken verified
3 · IAMvault scope ok
4 · App servicesfetch object
5 · Vaultdecrypt (envelope)
audit.write event=document.read · hash=c4a1…
metrics.emit latency=41ms · region=CH-eu-1
System diagram

From client to encrypted vault

A single primary path (solid) carries every request; control-plane services (dashed) authenticate, authorize, log, and observe it. Nothing reaches a vault without passing IAM, and nothing happens without landing in the audit log.

Regional Data Centre · US-east-1 / CH-eu-1 Client Browser / API API Gateway TLS · WAF · rate limit App Services docs · workflows Encrypted Vaults AES-256 · per-key Auth / IAM SSO · RBAC · MFA Audit Log append-only · hashed Monitoring (Blue Team) SIEM · 24/7 telemetry

Animation pauses automatically for visitors who prefer reduced motion. Illustrative topology — not an exact deployment diagram.

Under the hood

The controls behind each hop

Every layer in the diagram enforces a specific guarantee. Explore how data flows, how it's encrypted, how keys are managed, and how tenants stay isolated.

Data flow

One narrow, observable path

A request enters at the API gateway over TLS, where a web application firewall and rate limiting screen it. The gateway verifies the caller's token with Auth/IAM before anything else runs. Application services then resolve the requested object, check the caller's vault-scoped permissions, and — only if authorized — ask the vault to decrypt. Every step emits an audit event and a metric, so the path is fully reconstructable after the fact.

Edge screening

WAF, TLS termination, and rate limiting at the gateway.

Authorize per vault

IAM checks scope before any object is read.

Log everything

Each hop writes to the append-only audit log.

Emit metrics

Latency and region telemetry stream to monitoring.

Request lifecycle
gateway.accept tls=1.3 · waf=pass
iam.verify sub=u_204 · scope=vlt_ch_8f21a4
app.resolve doc_4f21a8 · v4
vault.decrypt key=key_ch_hr · ok
audit.write document.read · hash=c4a1…
Encryption

Encrypted in transit and at rest

Traffic between your client and merlon is protected with TLS 1.2 or higher, using modern cipher suites and forward secrecy. At rest, objects are encrypted with AES-256. There is no point in the path where a sensitive document sits in plaintext on disk — decryption happens transiently, in memory, only for an authorized request.

In transit
TLS 1.2+ with forward secrecy; HSTS enforced; legacy protocols disabled.
At rest
AES-256 on all stored objects, metadata, and backups.
In use
Transient in-memory decryption, scoped to a single authorized request.
Backups
Encrypted with the same standard and kept within region.
TLS & cipher inspector
ProtocolTLS 1.3
CipherAES_256_GCM
Key exchangeX25519 (PFS)
HSTSmax-age=63072000
Object cipherAES-256-GCM
Plaintext on disknever
Key management

Envelope encryption, keys that rotate

Each vault has its own data-encryption key (DEK) that encrypts its objects. That DEK is itself encrypted — "wrapped" — by a key-encryption key (KEK) held in a managed key store. This envelope model means rotating a KEK re-wraps DEKs without re-encrypting terabytes of data, and compromise of one vault's material never exposes another. Keys are region-bound: a Swiss vault's keys never leave Switzerland.

Envelope model

Per-vault DEKs wrapped by a KEK in a managed store.

Scheduled rotation

KEK rotation re-wraps DEKs — no bulk re-encryption.

Region-bound

Key material stays inside its data-centre region.

Logged operations

Every key use and rotation is recorded in the audit log.

Key hierarchy — vlt_ch_8f21a4
KEKkek_ch_root_02
DEK (wrapped)dek_hr · by kek_ch_root_02
RegionCH-eu-1
Last rotated2026-06-01
Next scheduled2026-09-01
kek.rotate re-wrapped 1,204 DEKs · ok
Tenant isolation

Logical isolation, enforced at every layer

Each customer is a distinct tenant, and every request is scoped to a tenant and a vault before it touches data. Isolation isn't a single filter — it's enforced at the gateway, in application authorization, and cryptographically via per-vault keys. The result: even a bug in one layer is backstopped by the next.

Enforced by

  • Tenant-scoped tokens
  • Per-vault authorization
  • Per-vault encryption keys

Guarantees

  • No cross-tenant reads
  • Defense in depth
  • Independent blast radius
Authorization check
Tenantacme_holdings
Requested vaultvlt_ch_8f21a4
Token scopeacme · vlt_ch_8f21a4
Tenant match
Vault scope
Key accessgranted
Resilience

Backups & disaster recovery

Data is backed up continuously within its region, encrypted with the same AES-256 standard. Recovery objectives are defined and tested so a regional incident is a measured event, not an open-ended outage.

≤ 15 min
RPO
recovery point objective
≤ 4 hrs
RTO
recovery time objective
99.9%
Uptime SLA
monitored 24/7
In-region
Backup residency
never leaves the region

Recovery is rehearsed, not assumed

DR procedures are exercised on a regular cadence, and backup restores are verified. See operational commitments in the SLA and current health on the status page.

Observability & audit

Everything is logged, monitored, and verifiable

The audit log and the monitoring pipeline are separate on purpose. The audit log is an append-only, hash-chained record of what happened to your data — designed for compliance and evidence. Monitoring is a real-time telemetry stream watched around the clock by our Blue Team for anomalies. Together they mean nothing goes unseen, and nothing goes unrecorded.

Hash-chainedSIEM24/7 SOC
Audit + telemetry stream
access.granted u_311 → vlt_us_4a · prev=8810…
key.rotate kek_us_root_01 · prev=9c02…
document.export evidence-pack · prev=e410…
Chain integrityverified ✓
Where your data lives

Pick a region — and stay in it

Every vault is pinned to a data-centre region at creation. Requests, keys, backups, and audit logs for that vault stay within it. Switch the region toggle in the header to see the specifics for each.

United States Default

Contracted through Wahlen Software Inc. Aligned with the US compliance set for regulated buyers.

Region ID
US-east-1
API base
https://api.us.merlon.ch/v1
Compliance
SOC 2 Type II, HIPAA-ready, CCPA/CPRA, US DPF
Transfers
Swiss–US & EU–US DPF, SCCs as fallback

Switzerland

Contracted through Wahlen Software GmbH in Zürich, with Swiss data residency and R&D.

Region ID
CH-eu-1
API base
https://api.eu.merlon.ch/v1
Compliance
nFADP, GDPR, ISO 27001 (aligned)
Residency
Data, keys & backups remain in Switzerland

Certifications reflect standards we align our controls with, not verified accreditations. See Compliance & Regions.

For developers

Choose your region in the base URL

Regional isolation is explicit in the API. Point your client at the region your data lives in — api.us.merlon.ch or api.eu.merlon.ch — and every call, key operation, and audit event stays there.

config · regional base URL
# Swiss residency
MERLON_API_BASE="https://api.eu.merlon.ch/v1"
MERLON_REGION="CH-eu-1"

# United States (default)
MERLON_API_BASE="https://api.us.merlon.ch/v1"
MERLON_REGION="US-east-1"

# request stays in-region end to end
curl "$MERLON_API_BASE/documents/doc_4f21a8" \
  -H "Authorization: Bearer $TOKEN"
Security controls

Defense in depth, layer by layer

No single control is trusted alone. The architecture stacks independent safeguards so a gap in one is caught by the next.

Edge & network

WAF, TLS, rate limiting, and private networking between services.

Identity & access

SSO, MFA, RBAC, and least-privilege scoping per vault.

Encryption

AES-256 at rest, TLS 1.2+ in transit, per-vault envelope keys.

Isolation

Tenant- and vault-level separation enforced at multiple layers.

Monitoring

24/7 SIEM telemetry watched by the in-house Blue Team.

Release assurance

Purple Team validation and release gating before production.

Questions

Architecture questions, answered

Can data ever move between regions?
Not silently. A vault's data, keys, backups, and audit log stay in its region. Any cross-region movement would be an explicit, contracted operation — never a default of the architecture.
How does envelope encryption help with rotation?
Because objects are encrypted by a per-vault DEK that is itself wrapped by a KEK, rotating a KEK only re-wraps the small DEKs — not the underlying data. Rotation is fast and doesn't require re-encrypting everything.
Is the audit log the same as monitoring?
No. The audit log is an append-only, hash-chained record of actions for compliance and evidence. Monitoring is a real-time telemetry stream watched by the Blue Team for anomalies. They serve different purposes and are stored separately.
Where can I see current operational status?
The status page shows live component health and incident history, and the SLA defines our uptime and recovery commitments.

Have your security team review the details

We're happy to walk your architects and reviewers through the data flow, encryption, and isolation model in depth.

Talk to Sales