Security and data handling

What we store, for how long, and where. Written to describe what the service actually does.

Your inputs	Inputs to the spectral and configuration checks are processed in the request and not stored. Inputs to queued runs and uploads are stored with the job so you can retrieve the result; deleting a job removes its inputs and outputs.
Retention	Job records are kept for up to ninety days after completion, unless an engagement agreement says otherwise.
Ownership	You own your inputs and the outputs computed from them.
API keys	Keys are stored as hashes and cannot be recovered by us. Tell us if a key is exposed and we revoke and reissue it.
Payments	Card details are collected by the Merlin Digital store and its payment providers and never reach the service.
Where it runs	UAE data residency is available, and for engagements the heavy computation can run inside your own network.
Certifications	We do not yet hold a third-party security certification, and we do not claim one. We will publish the exact status here when that changes.

Report a security issue to sharad.bachani@merlin-me.com. Full detail is in the Privacy Policy and the Terms of Service.