Specific claims you can check against how the product actually behaves. Where we don't yet publish something, we say so.
Merik is multi-tenant. Every company has its own workspace, and the boundary between workspaces is enforced by row-level security policies in Postgres, not only by application code. A signed-in user's queries can only return rows belonging to their own company. This is the check we would ask you to make of any HR tool, and it is the one we made first.
There are three roles. Superadmin is the Merik team, who create workspaces and manage the platform. Admin runs a company's workspace. Employee sees their own dashboard — their attendance, leave, tasks and payslips — and nothing else.
Monthly payroll is computed by a server-side function from the attendance, leave and salary structure already on record, and the computed result is saved. Nothing is calculated in the browser, so the register, the payslip and what an employee downloads are the same numbers.
All AI in Merik goes through one server-side function. It is off by default. Every request passes four gates — a master switch, a per-feature flag, a per-company grant, and a monthly call cap — and each gate fails closed: a company with no grant gets nothing. AI is used to draft performance summaries and quotes that a person edits before use; core features work with it off. Provider API keys entered in the dashboard are stored only as AES-GCM ciphertext, encrypted with a key that lives outside the database, and the dashboard only ever shows the last four characters.
When an employee checks in or out and grants location permission, the coordinates are recorded with that punch and converted to a readable place name. To do that conversion the coordinates are sent to a reverse-geocoding service (BigDataCloud, with OpenStreetMap Nominatim as fallback). Location is captured at the punch only; Merik has no background tracking between check-in and check-out. Your attendance policy should tell employees this — our policy template includes the clause.
merik.js is a one-line script for sites you monitor. It reports JavaScript errors, unhandled rejections and failed requests, grouped by fingerprint. By construction it never reads or sends form contents, input values, cookies, localStorage, request or response bodies, headers, or the query string of any URL, and it sets no cookie and assigns no user identity. Everything it does send is redacted again on arrival — tokens, keys, bearer headers, card-like numbers and credential-shaped strings are replaced before storage — because a privacy promise enforced only in the client is a promise anyone can edit.
Employees, attendance, leave, payroll history and the task log belong to your company. The task log exports to CSV from inside the product, and if you stop using Merik you can ask us to delete the workspace. We do not sell workforce data and we do not use one company's data to serve another.
We do not yet publish a backup and retention schedule, the hosting region, a penetration-test summary, or a formal sub-processor list beyond the services named on this page and in the privacy policy. If any of these matters for your decision, ask — a straight answer is better than a badge.
Email merik.msk@gmail.com with "Security" in the subject. Please give us a chance to respond before disclosing publicly.
Yes. Merik is multi-tenant and every company has one isolated workspace. Isolation is enforced in the Postgres database by row-level security policies, so a query from one company's user cannot return another company's rows even if the application code had a bug.
On the server, in a dedicated function, and the result is stored. It is never computed in the browser, so the payroll register and the payslip an employee downloads cannot disagree.
Only if it is switched on for your workspace. AI is off by default and gated four times — a master switch, a per-feature flag, a per-company grant and a monthly call cap — and every gate fails closed. It is used to draft performance summaries and quotes for a person to edit. Provider API keys are stored only as AES-GCM ciphertext.
JavaScript errors, unhandled promise rejections and failed requests, grouped by fingerprint. By construction it never reads form contents, input values, cookies, localStorage, request or response bodies, headers, or the query string of any URL, and it sets no cookie. Anything that looks like a token, key, card number or credential is redacted again on the server before storage.
When an employee checks in or out, the browser's location (latitude and longitude, if the employee grants permission) is recorded with the punch and converted to a readable place name. Location is captured at the punch only — Merik does not track employees between check-in and check-out.
Request a workspace and we set it up for you. No card, no setup fee, every module included.