Security Practice, Stated Plainly

How people sign in, who can open what, how data is encrypted and backed up, and how to report a problem.How people sign in, who can open what, how your data is encrypted and backed up, and how to tell us about a problem. Each practice here is one you can see working in the app.

Found a problem? Tell us See the status page

How We Keep Programme Data Secure

Sign-in that guards every account

Google or Microsoft sign-in, or your own domain on Enterprise. After too many wrong passwords, sign-in pauses and says when it opens again.People sign in with Google or Microsoft where your organisation allows it, and it only ever signs in someone you have already added. On Enterprise, owners can require staff to use your organisation's Google Workspace or Microsoft Entra domain, with a preview of who is affected first; applicants are never affected. After too many wrong passwords, sign-in pauses for a while and says when it opens again, and a password reset is the quick way back.

Two-step sign-in with an authenticator app, which owners can require for owners and admins
Devices, sessions and sign-in history for every person, with Sign out other devices
Passwords checked for strength and against known breached passwords, and stored only as hashes
At least one owner always keeps a way back in

The Meridian Research Park sign-in page explaining that the account is locked until 16:45 IST, in 14 minutes, and that resetting the password unlocks it immediately. — After too many wrong passwords, sign-in pauses for a while and says when it opens again, with a reset as the quick way back.

Roles that open exactly what they should

Built-in and custom roles, for the organisation or one programme. Private files open only for staff, assigned evaluators and the team; shared links expire.Owner, programme admin and evaluator are built in, and a custom role is a name and the permissions you tick, for the whole organisation or for one programme. A role sees the pages and programmes its permissions cover, and nothing more. Pitch decks, agreements and other uploads open only for programme staff, the assigned evaluators and the team itself, and links shared outside the app expire.

Each organisation's records live in their own database
When our support team views your account, it is read-only, for at most 60 minutes, and recorded in your audit log
Every document support opens in a support session is recorded in your audit log too
Support never reaches security settings, billing, people, API keys or exports

Meridian Research Park· Users

Roles

Owner
Built in
Every programme, people, branding, billing and data export
Programme admin
Built in
The programmes they are given, end to end
Evaluator
Built in
Only the teams assigned to them
Review lead
Ready-made
Give as it is, or copy and change
Viewer/Auditor
Ready-made
Give as it is, or copy and change
Grants officer
Custom
Seed Fund 2026 only · reports and decisions

Extra roles only ever add permissions.

Encrypted in transit, at rest and in every backup

HTTPS with HSTS, disks encrypted at rest, and a nightly backup encrypted with AES-256-GCM before it leaves the server.Every page and API call uses HTTPS, and browsers are told with HSTS never to fall back to an unencrypted connection. Our database and storage providers encrypt the disks that hold your data. Every night each organisation is backed up, encrypted with AES-256-GCM before it leaves the server, checked after it is written, and stored away from the servers that run the app.

We keep 30 daily and 12 monthly copies; older ones are removed automatically
There is no unencrypted backup, and the key is held apart from the backups
A restore goes to a separate place first, so nothing still correct is overwritten

Meridian Research Park· Backups

Nightly encrypted backups

Encrypted with AES-256-GCM before it leaves the server

Daily copies

last 30

Monthly copies

last 12

Checked after it is written
Stored away from the servers that run the app
Older copies removed automatically

Export everything, whenever you need it

The whole organisation as one ZIP at any time, and for 90 days after a plan ends. Secrets never leave in an export.Owners export the whole organisation as one ZIP at any time: programmes, applications, scores, decisions, people, the audit log and files, each record as JSON and as a spreadsheet-friendly CSV, with a README. After a plan ends you have 90 days to take it with you. Passwords, sessions, two-step secrets and API keys never leave in an export.

The download link works for 10 minutes; the file itself is deleted after 24 hours
Starting, finishing and every download are recorded in your audit log

The Data Export page with Start export and a list of what the export includes. — Your whole organisation as one ZIP, whenever you need it.

Security Posture answers your IT team from your own settings

Two-step sign-in, single sign-on, backups and sign-ins, answered from your own settings. Copy for your IT team gives you a plain-text summary.Security Posture, first under Settings, answers what a buyer's IT team asks first: two-step sign-in, single sign-on, backups and sign-ins, one tile each, with how many are in place at the top. Choose a tile for the answer, its evidence and the setting to change. Copy for your IT team copies a plain-text summary for an email or a security questionnaire.

Owners see who has two-step sign-in on; admins see the counts
Beside it, the Data and Privacy card answers your legal team

The Data and Privacy card, on the Trust Centre

Meridian Research Park· Security

Security Posture

3 of 4 in place

In place

Two-step sign-in

Required for owners and admins

Not yet

Single sign-on

Not set up · Enterprise

In place

Backups

Nightly, encrypted · 30 daily, 12 monthly

In place

Sign-ins

Account guard on · history kept

Choose a tile for its evidence, then Go to the setting.

Safeguards That Run Quietly

Rate limits
On sign-in, two-step codes, password resets, applicant sign-in links, trial requests, imports and the API.
Checked on the server
Every form and upload is validated on the server, within size limits, not only in the browser.
Secrets kept out of the code
Secrets live in the hosting environment, never in the database or the source code. API keys and recovery codes are stored only as hashes.
An audit log in plain sentences
Sign-ins, changes, exports and downloads, with sign-in details masked. Export any range as CSV or Excel.
Signed webhooks
Every webhook we send is signed so your systems can verify it, with protection against replay.
Your own infrastructure, if you need it
Self-hosting on your own infrastructure, on request, as an Enterprise option.

If something goes wrong. If a breach affects customer personal data, we tell the affected customer without undue delay, and within 48 hours, with what we know and what we are doing, and we report to the authorities where the law requires.

Found a Problem? Tell Us

We welcome reports from security researchers, and we answer every one.

security@ideascore.online

Write to us
Describe the issue, the steps to reproduce it, the address or feature affected and its likely impact.
We acknowledge it
Within 3 working days, then we keep you informed and tell you when it is fixed.
Give us time
Normally 90 days before you disclose it publicly. With your permission, we thank you publicly.

Please test only against your own account, stop as soon as you reach data that is not yours, and never degrade the service for others. Research in good faith under our policy is treated as authorised. There is no paid bug bounty.

Read the full policy security.txt for this site

Built to Keep Your Data Safe

14laws and standards we work to

5: data and IT laws
9: security and access standards
3: regions: India, EU, US

Open the Trust Centre

Privacy, IdeaScore AI and the Standards We Work To

Where data is held, retention, data requests, Deleted items, what IdeaScore AI never sees, the Decision Trail and every badge's evidence are on the Trust Centre page.

Go to the Trust Centre

What IT Teams Ask First

Yes, on Enterprise. Owners can require staff to sign in with your Google Workspace or Microsoft Entra domain, preview who is affected, add up to 10 exemptions and confirm. Applicants are never affected, and at least one owner keeps password sign-in so you can always get back in.

Only to help with a problem, and only as you would see it: read-only, for at most 60 minutes, with a banner showing throughout. It cannot reach security settings, billing, people, API keys or exports, and every page viewed and every document opened is recorded in your audit log.

Customer data is stored in Mumbai, India (database) and the Asia-Pacific region (files), and processed in Singapore (application) and Tokyo (email). IdeaScore AI processes the text sent to it outside India. Every connection is encrypted, disks are encrypted at rest, and nightly backups are encrypted before they leave the server.

A session lasts 7 days, and at most 30 with activity. Two minutes before it ends, IdeaScore asks whether to stay signed in, and anyone can sign out every other device from Devices and Sign-Ins.

Self-hosting on your own infrastructure is an Enterprise option, on request: our team installs it on your own servers, applies updates and provides support. It is priced by quote.

Questions Your IT Team Wants Answered?

A product specialist can walk your IT team through sign-in, roles, backups and Security Posture, with your questionnaire beside you.

Book a demo Start a 7-day trial