Meridian Alpha

Regulatory Library

India United States European Union Global standards Controls across regulations

Regulations that apply to Meridian Alpha and the controls that meet them
As of 9 Oct 2026

All areas Banking & Financial Payments Corporate & Finance Cyber & Technology Privacy Tax

India · Central · Payments

RBI · Digital payment security controls

RBI Master Direction on Digital Payment Security Controls, 18 February 2021

Open in Studio

Legal entity

Meridian Alpha Pvt. Ltd.

Applicability

Applicable · Payment Gateway and customer portal

Locations

Mumbai Head Office (Bandra Kurla Complex), Bengaluru Technology Centre

Reporting cycle

Annual · board review

Requirement coverage · compliance position: gaps to close

requirements

Covered 120%
Partially covered 360%
Evidence unavailable 120%

Controls

2 failed testing

Evidence approved

47/57

current cycle

Open findings (gaps)

0 high

Open actions

0 overdue

Requirements and the controls that meet them

Ref	Requirement	Applicability	Control objective	Controls	Coverage
Para 7	Application security life cycle and change control	Applicable	Changes are approved, tested and traceable	CHG-01 CHG-02 CHG-03	Partially covered
Para 8	Authentication and access to payment systems	Applicable	Access is approved, reviewed and removed on exit or role change	ACC-01 ACC-02 ACC-04 JML-01 JML-02	Partially covered
Para 13	Vulnerability assessment and penetration testing	Applicable	Vulnerabilities are remediated on time	VUL-01	Evidence unavailable
Para 21	Logging and monitoring of payment transactions and systems	Applicable	Security events are logged, retained and monitored	LOG-01 LOG-02	Partially covered
Para 24	Network security and segregation	Applicable	Payment channels and data in transit are protected	PAY-01 ENC-01	Covered

Controls and current position

Control	What it checks	Systems	Test	Evidence	Open findings
CHG-01	Production code changes are peer-reviewed and approved	GitHub Enterprise Cloud, Meridian Customer Portal	Pass	9 / 9	0
CHG-02	Emergency changes are retrospectively approved	GitHub Enterprise Cloud, ServiceNow ITSM	Fail	2 / 5	0
CHG-03	Developers have no standing production access; deployments via pipeline only	Amazon Web Services (ap-south-1), GitHub Enterprise Cloud	Pass	2 / 3	0
ACC-01	MFA and SSO enforced for workforce access	Amazon Web Services (ap-south-1), Microsoft Entra ID, GitHub Enterprise Cloud	Pass	6 / 6	0
ACC-02	User access provisioning is approved before grant	Microsoft Entra ID, SAP S/4HANA, ServiceNow ITSM	Pass	6 / 6	0
ACC-04	Quarterly user access review of in-scope applications	Microsoft Entra ID, Salesforce (Sales + Financial Services Cloud), SAP S/4HANA	Not tested	0 / 5	0
JML-01	Leavers are de-provisioned within 24 hours	Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA	Pass	6 / 6	0
JML-02	Mover access is recertified on role change	Darwinbox HRMS, Microsoft Entra ID, SAP S/4HANA	Fail	9 / 9	1
VUL-01	Vulnerabilities are scanned and remediated within SLA	Amazon Web Services (ap-south-1), GitHub Enterprise Cloud	Not tested	0 / 0	0
LOG-01	Security events are centrally logged and monitored 24x7	Amazon Web Services (ap-south-1), Microsoft Entra ID, Meridian Customer Portal	Pass	3 / 4	0
LOG-02	Audit logs retained 180 days online and 5 years archived, tamper-protected	Amazon Web Services (ap-south-1), SAP S/4HANA	Not tested	0 / 0	0
PAY-01	Payment APIs secured with mTLS, signing and customer 2FA	PayGate Payment Gateway, Meridian Customer Portal	Pass	2 / 2	0
ENC-01	Customer and payment data encrypted at rest and in transit	Amazon Web Services (ap-south-1), Meridian Customer Portal	Pass	2 / 2	0

Open actions

Action	Issue	Owner	Due	Status
REM-F-SOC2-02	Mover access not removed timely (deviation in CC6.2 testing)	Neha Iyer	31 Oct 2026	Open

Regulatory reporting for management, audit and compliance review. Applicability is as assessed in Prismet. Statutory returns and regulator filings are not prepared or submitted from Prismet.