Meridian Alpha

Regulatory Library

India United States European Union Global standards Controls across regulations

Regulations that apply to Meridian Alpha and the controls that meet them
As of 9 Oct 2026

All areas Payments Cyber & Technology

Global standards · Industry standards · Payments

PCI DSS · Payment card data security

PCI DSS v4.0.1 · cardholder data environment (Payment Gateway)

Open in Studio

Legal entity

Meridian Alpha

Applicability

Applicable · Card payments

Locations

Mumbai Head Office (Bandra Kurla Complex), Bengaluru Technology Centre

Reporting cycle

Annual · report on compliance

Requirement coverage · compliance position: gaps to close

requirements

Covered 117%
Partially covered 467%
Evidence unavailable 117%

Controls

4 failed testing

Evidence approved

51/65

current cycle

Open findings (gaps)

1 high

Open actions

0 overdue

Requirements and the controls that meet them

Ref	Requirement	Applicability	Control objective	Controls	Coverage
Req. 1	Network security controls	Applicable	Payment channels and data in transit are protected	PAY-01 ENC-01	Covered
Req. 6	Secure systems and change control	Applicable	Changes are approved, tested and traceable	CHG-01 CHG-02 CHG-03	Partially covered
Req. 6.3	Vulnerabilities identified and addressed	Applicable	Vulnerabilities are remediated on time	VUL-01	Evidence unavailable
Req. 7–8	Restrict and authenticate access	Applicable	Access is approved, reviewed and removed on exit or role change	ACC-01 ACC-02 ACC-04 JML-01 JML-02	Partially covered
Req. 10	Log and monitor all access	Applicable	Security events are logged, retained and monitored	LOG-01 LOG-02	Partially covered
Req. 12.8	Manage third-party service providers	Applicable	Third parties are assessed, contracted and monitored	VEN-01 VEN-02 VEN-03	Partially covered

Controls and current position

Control	What it checks	Systems	Test	Evidence	Open findings
PAY-01	Payment APIs secured with mTLS, signing and customer 2FA	PayGate Payment Gateway, Meridian Customer Portal	Pass	2 / 2	0
ENC-01	Customer and payment data encrypted at rest and in transit	Amazon Web Services (ap-south-1), Meridian Customer Portal	Pass	2 / 2	0
CHG-01	Production code changes are peer-reviewed and approved	GitHub Enterprise Cloud, Meridian Customer Portal	Pass	9 / 9	0
CHG-02	Emergency changes are retrospectively approved	GitHub Enterprise Cloud, ServiceNow ITSM	Fail	2 / 5	0
CHG-03	Developers have no standing production access; deployments via pipeline only	Amazon Web Services (ap-south-1), GitHub Enterprise Cloud	Pass	2 / 3	0
VUL-01	Vulnerabilities are scanned and remediated within SLA	Amazon Web Services (ap-south-1), GitHub Enterprise Cloud	Not tested	0 / 0	0
ACC-01	MFA and SSO enforced for workforce access	Amazon Web Services (ap-south-1), Microsoft Entra ID, GitHub Enterprise Cloud	Pass	6 / 6	0
ACC-02	User access provisioning is approved before grant	Microsoft Entra ID, SAP S/4HANA, ServiceNow ITSM	Pass	6 / 6	0
ACC-04	Quarterly user access review of in-scope applications	Microsoft Entra ID, Salesforce (Sales + Financial Services Cloud), SAP S/4HANA	Not tested	0 / 5	0
JML-01	Leavers are de-provisioned within 24 hours	Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA	Pass	6 / 6	0
JML-02	Mover access is recertified on role change	Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA	Fail	9 / 9	1
LOG-01	Security events are centrally logged and monitored 24x7	Amazon Web Services (ap-south-1), Microsoft Entra ID, Meridian Customer Portal	Pass	3 / 4	0
LOG-02	Audit logs retained 180 days online and 5 years archived, tamper-protected	Amazon Web Services (ap-south-1), SAP S/4HANA	Not tested	0 / 0	0
VEN-01	Critical third parties are risk-assessed before onboarding and annually	PayGate Payment Gateway, Salesforce (Sales + Financial Services Cloud)	Fail	2 / 3	1
VEN-02	Provider contracts include data protection and RBI audit clauses	Salesforce (Sales + Financial Services Cloud)	Not tested	0 / 1	1
VEN-03	Supplier security incidents are assessed for impact and tracked	PayGate Payment Gateway, Meridian Customer Portal	Fail	2 / 4	1

Open actions

Action	Issue	Owner	Due	Status
REM-F-SOC2-02	Mover access not removed timely (deviation in CC6.2 testing)	Neha Iyer	31 Oct 2026	Open
REM-F-RBI-02	Material outsourcing: lapsed assurance and overdue reassessment (Outsourcing of IT Services 2023 §6/§9)	Sanjay Kulkarni	20 Oct 2026	Open
REM-F-ISO-02	Supplier agreement lacks information security clauses (A.5.20)	Sanjay Kulkarni	31 Oct 2026	In Progress
REM-F-RBI-03	Payment provider incident — incomplete credential rotation	Deepa Menon	10 Oct 2026	In Progress

Regulatory reporting for management, audit and compliance review. Applicability is as assessed in Prismet. Statutory returns and regulator filings are not prepared or submitted from Prismet.