Meridian Alpha
Third-Party Intelligence
Entered in Prismet
Detected 3 Oct 2026
Detected 3 Oct 2026
External signal
1
Security incident PG-SEC-2026-014
Dependent applications
3
use the vendor
Controls in scope
4
4 in assurance records
Actions
4
2 done · 2 open
Validated
2 of 4
response validation
Who is affected
Pulses follow recorded relationships from the event to the people who must act.
Dependent applications
| Application | Dependency |
|---|---|
| PayGate Payment Gateway | Merchant collection, payouts and settlement reporting |
| Meridian Customer Portal | Drawdowns and settlements initiated by customers |
| SAP S/4HANA | Payment release and settlement reconciliation |
Controls in scope
| Control | Statement | Required |
|---|---|---|
| VEN-03 | Supplier security incidents are assessed for impact and tracked | Exception · F-RBI-03 (critical) |
| PAY-01 | Payment APIs secured with mTLS, signing and customer 2FA | Key rotation in progress |
| VEN-01 | Critical third parties are risk-assessed before onboarding and annually | Penetration test report expired · F-RBI-02 |
| PAY-02 | Payment release requires maker-checker | Operating |
Response actions
| Action | Owner | Status | Validation |
|---|---|---|---|
| T-009 PayGate incident impact assessment (services, apps, controls) | Ananya Rao | Done | Validated |
| T-011 File RBI / CERT-In incident notification and update | Sanjay Kulkarni | Done | Validated |
| T-010 Rotate remaining PayGate settlement-report API key | Deepa Menon | In Progress | Pending |
| T-013 Obtain PayGate 2026 penetration test summary | Meera Joshi | Open | Pending |
Vendor tiering and exposure
Tiering
3 Critical
1 High
0 Medium
0 Low
4 vendors · criticality as recorded
Criticality × exposure
Bubble size = mapped controls · red = vendor with an active signal. Hover for the vendor.
Vendor register
| Vendor | Criticality | Service area | Mapped controls | Open findings | Open actions | Signals | Assessment due |
|---|---|---|---|---|---|---|---|
| Amazon Web Services (AWS India) | Critical | Cloud service provider | OPS-01, ENC-01, VEN-01 | 1 | 1 | — | ○ No data available |
| Northstar BPO Services Ltd. | High | Business process outsourcer | ACC-04, VEN-01, KYC-01 | 2 | 2 | — | ○ No data available |
| PayGate Payments Pvt. Ltd. | Critical | Payment aggregator / gateway | VEN-01, VEN-03, PAY-01, PAY-02 | 2 | 2 | TPS-2026-014 | ○ No data available |
| VeriKYC Solutions Pvt. Ltd. | Critical | KYC / identity verification vendor | VEN-02, KYC-01, KYC-02 | 2 | 2 | — | ○ No data available |