Trust Security is built in, not bolted on

Security at Merko

Protecting your data is core to everything we build. Here's how we keep your account, your audiences, and your campaigns safe.

Last updated: June 5, 2026

Encryption

In transit & at rest

All data is encrypted in transit with TLS 1.2+ and at rest with AES-256.

Compliance

SOC 2 & GDPR

Aligned with SOC 2 Type II controls and GDPR data-protection requirements.

Monitoring

24/7 detection

Continuous monitoring, logging, and automated alerting across our infrastructure.

1Infrastructure

Merko runs on enterprise-grade cloud infrastructure with physical and network security managed by leading providers. Our environments are isolated, hardened, and deployed across multiple availability zones for high availability.

2Data encryption

  • In transit: all connections are secured with TLS 1.2 or higher.
  • At rest: data is encrypted using AES-256.
  • Secrets: credentials and keys are stored in a managed secrets vault with strict rotation policies.

3Access control

We follow the principle of least privilege. Access to production systems is restricted, logged, and reviewed regularly. Internal access requires multi-factor authentication and is granted only to personnel who need it to perform their roles.

4Authentication

Customer authentication is backed by industry-standard protocols. Our MCP server uses OAuth 2.0 with PKCE, and we support secure token handling so AI clients can connect without sharing long-lived credentials. See the documentation for details.

5Compliance

  • SOC 2 Type II aligned controls across security, availability, and confidentiality.
  • GDPR and CCPA support, including data processing agreements on request.
  • Regular third-party penetration testing and vulnerability scanning.

Need a copy of our security documentation or a DPA? Email security@merko.ai and our team will help.

6Backups & resilience

We perform automated, encrypted backups and routinely test our recovery procedures. Our architecture is designed for redundancy so a single point of failure does not interrupt your service.

7Responsible disclosure

We welcome reports from security researchers. If you believe you've found a vulnerability, please report it to security@merko.ai. We ask that you give us reasonable time to investigate and remediate before any public disclosure.

8Contact us

For any security-related questions, reach our team at security@merko.ai or via our contact page.