Answers, without the runaround.

merlon is a secure workspace for the documents a business can't afford to lose control of — contracts, personnel files, financial records, board materials. It brings them into one governed place with role-based access, enforced approval workflows, e-signature, and a tamper-evident audit trail, hosted in the US or Switzerland. It's built for SMBs that have enterprise-grade sensitivity but not an enterprise compliance team.

A folder organises documents; a Secure Vault is a security boundary. Each vault has its own encryption scope, its own access list independent of the organisation default, and its own data-residency setting. Even an Organisation Admin can't see a vault's contents unless they're on its access list. Use vaults for your most sensitive collections and folders for everyday structure inside them.

Yes. merlon supports compliant e-signatures with identity verification and an immutable audit trail designed to hold up to legal and regulatory scrutiny in both the US and Switzerland/EU. Every signature captures who signed, when, and from where, and locks the signed version against later change.

Yes — merlon connects to identity providers (Okta, Azure AD, Google Workspace), storage (SharePoint, Google Drive, Dropbox), ERP/finance systems (SAP, Abacus, Bexio), and chat (Slack, Teams), plus automation via Zapier and Make. See the full integrations catalog, or build your own with the API.

Yes. You can build approval chains that route conditionally — by amount, vendor, or entity — enforce segregation of duties so no single person can push something through, and set deadlines with automatic reminders and escalation. Every step is captured in the audit trail, so you can produce evidence for any transaction in one click.

merlon is fully accessible in the browser on any device, and offers a REST API at api.merlon.ch/v1 (with regional US and EU endpoints) plus webhooks for events like vault.created and signature.completed. Developers can start in the Developers hub and the API Reference.

Documents are encrypted at rest with AES-256 using envelope encryption — per-document data keys wrapped by key-encryption keys under an HSM-backed root, scoped to your vault's region. All data in transit is protected with TLS 1.2 or higher. Keys for a Swiss vault are managed within the Swiss key boundary and never leave it.

Yes. merlon supports SAML/OIDC single sign-on with providers like Okta, Azure AD and Google Workspace, and multi-factor authentication that admins can enforce organisation-wide. Access is role-based and least-privilege by default, scoped down to individual vaults and document types.

Every view, edit, share, approval and signature is written to a tamper-evident, hash-chained event log. Because each entry is chained to the previous one, any attempt to alter history is detectable. You can export a complete, defensible trail for any document or vault in a couple of clicks — the kind of evidence you'd put in front of an auditor or regulator.

We run an in-house Security Operations Center on a follow-the-sun model between Zürich and the US, staffed by a Blue Team for 24/7 detection and telemetry and a Purple Team for continuous validation and release assurance. Monitoring is round-the-clock and detection coverage is checked before every release.

We follow a defined incident-response process with containment, investigation and customer notification consistent with nFADP and GDPR breach-notification obligations. Affected customers are informed without undue delay, and after any Sev-1 you receive a written post-incident review with root cause and corrective actions. Recent uptime and incidents are on the status page.

We welcome responsible disclosure. Send details to security@merlon.ch or use the process on our Responsible Disclosure page. We acknowledge reports promptly and work with researchers in good faith. Our security.txt lists the current contact.

We design and operate our controls to be aligned with SOC 2 Type II and ISO 27001, and map them to those frameworks. We describe these as controls we align with and are designed to comply with, rather than as verified accreditations. The current status, scope, and supporting documentation live in the Trust Center, and the frameworks are compared side by side on Compliance & Regions.

merlon is designed to comply with the revised Swiss Federal Act on Data Protection (nFADP) and the EU GDPR. That includes records of processing, data-minimisation and retention controls, breach-notification workflows, and support for data-subject rights. Swiss data residency is available so EU/CH data can stay in Switzerland.

In the region you choose — the United States (US-east-1) or Switzerland (CH-eu-1). Residency is set per vault, so your HR files can live in Switzerland while a US team's documents stay in the US, within the same organisation. Enterprise customers can request a specific region. Residency is fixed at vault creation and can't be changed afterwards.

Where data moves between regions, we rely on the Swiss–US and EU–US Data Privacy Frameworks (DPF), with Standard Contractual Clauses (SCCs) as a fallback mechanism. If you keep a vault in Switzerland, its documents stay in Switzerland and no transfer arises. The full picture is in Compliance & Regions.

Yes. We offer a Data Processing Agreement covering our role as processor, sub-processors, security measures, and transfer mechanisms. You can review our template DPA and the current sub-processor list in the Trust Center. For signed copies or negotiated terms, contact us at privacy@merlon.ch.

For US healthcare customers, merlon offers HIPAA-ready controls — encrypted vaults, access logging on every record, and support for a Business Associate Agreement (BAA). "HIPAA-ready" means our controls are designed to support your compliance; you'll still need a signed BAA in place before storing PHI. Talk to Sales to arrange one.

merlon is sold in plans that scale with your team size and compliance needs, billed per seat with annual and monthly options. Higher plans add capabilities like additional regions, advanced workflows, and Enterprise support. See current plans on the Pricing page, or talk to Sales for a quote tailored to your organisation.

It depends on your contracting entity. Customers in the Americas contract with Wahlen Software Inc. and are typically billed in USD; customers in the EU/EFTA, Switzerland and the rest of the world contract with Wahlen Software GmbH and are typically billed in CHF or EUR. Your invoice and agreement state the currency and entity.

Yes. You can add seats at any time — they're prorated to your billing period — and change plans at renewal. Admins manage seats and plan details in Billing settings. For mid-term downgrades or larger changes, reach out and we'll help you work through it.

We start most customers with a guided demo and a scoped evaluation rather than a self-serve trial, because sensitive-document setups benefit from getting residency, access, and workflows right from the start. Request a demo and we'll set up an evaluation environment with you.

Cancellation and refund terms are set out in your agreement and our Terms of Service. Annual plans run to the end of the paid term; you can choose not to renew from Billing settings. If something's gone wrong, contact us before cancelling — we'd rather fix it.

Your data is yours. Before your term ends you can export all documents and their audit trails. After termination, we retain data for a short defined window so you can retrieve it, then securely delete it in line with our DPA and retention commitments. We'll never hold your documents hostage.

Start with the Help Center for how-to articles. If you need a person, open a ticket from the Support page — email support@merlon.ch, or use chat on Priority and above. Enterprise customers also get a 24/7 emergency hotline for critical incidents.

Business-hours coverage spans both regions: 08:00–18:00 CET for Swiss/EU customers and 09:00–18:00 ET for US customers, Monday to Friday. Enterprise customers get 24/7/365 follow-the-sun coverage that hands off between Zürich and the US so a critical issue is always in front of an on-call engineer.

Response-time targets depend on your plan and the severity you set. For a critical Sev-1, targets range from 4 business hours on Standard to 1 hour on Priority and 30 minutes on Enterprise 24/7. The full matrix — Sev-1 through Sev-4 across all three tiers — is published on the Support page.

Use Sev-1 for a critical outage with no workaround, Sev-2 for major degradation, Sev-3 for a minor issue with a workaround, and Sev-4 for questions and requests. If you're unsure, pick the higher level — we'll triage and adjust, and tell you why. Full definitions are on the Support page.

Enterprise customers get a named Customer Success Manager who knows your setup and coordinates escalations. Priority customers get a quarterly check-in and priority routing. If a CSM matters to you, talk to Sales about the Enterprise plan.

Check the status page for live system status and incident history before reporting an outage — you can subscribe there for updates. If you're seeing something the status page doesn't reflect, open a Sev-1 or Sev-2 ticket (or use the Enterprise hotline) so we can investigate.