For IT and security reviewers
Security and data handling: checklist answers
Last updated 13 October 2026
- Service
- Meishio (https://getmeishio.com, iPhone app)
- Operator
- Zovamo Ventures Private Limited (India)
- Contact
- support@getmeishio.com
Answers to the items company security checklists usually ask about cloud services, in the order Japanese reviewers expect (modelled on IPA and METI cloud-security guidance and typical business-card service sheets). Answers come from Meishio's code, its public pages (the privacy information, the terms and Your data) and, where marked, the providers' published documentation.
How to read the answers
“Yes”: implemented. “Never”: not done, and will not be. “Partly”: with conditions, or only in part. “No”: not offered today. “Not held”: the certification is not held. “Ask us”: please discuss with us. “N/A”: does not apply.
Anything not covered here, or your own checklist to fill in? Write to support@getmeishio.com or use the team request form, and we'll answer in writing.
1. Service and operator
| Item | Answer | Notes |
|---|---|---|
| Service name | AnswerMeishio (web service and iPhone app) | NotesURL: https://getmeishio.com |
| What it does | AnswerA cloud service (SaaS) that scans English and Japanese business cards, keeps your contacts, optionally syncs with Google Contacts, and checks public web pages for job changes when you start a check. | |
| Operator | AnswerZovamo Ventures Private Limited (an Indian company, CIN U55101DL2013PTC260253) | NotesAddress: L-49 Laxmi Nagar, East Delhi, Delhi 110092, India |
| Security contact | Answersupport@getmeishio.com (the same inbox as support and data requests) | NotesReplies within 2 working days (stated on the Contact page). There is no separate security inbox or phone line today. |
| Availability and price | AnswerFree while in early access. Teams, for using Meishio as a company, are offered in early access too. | NotesPaid team plans and invoicing are planned. |
| Terms and privacy policy | AnswerPartlyPublished. Privacy information: getmeishio.com/privacy; Terms: getmeishio.com/terms | NotesThe Terms of Service are a draft pending legal review and may change before they take effect. |
| Notice of policy changes | AnswerYesChanges that matter are announced in the app or by email before they take effect (Terms, section 13, draft). | |
| Role in handling personal data | AnswerMeishio handles the cards, contacts and notes you add on your behalf, only as needed to provide the service (Terms, section 4). Having a lawful basis to hold that information is the user's responsibility. | NotesGoverned by the laws of India; the courts of New Delhi have jurisdiction (Terms, section 12, draft). |
2. Where data is stored
| Item | Answer | Notes |
|---|---|---|
| Country | AnswerYesSingapore. Accounts, contacts, notes and card images are stored in Singapore. | |
| Database | AnswerSingapore: managed PostgreSQL in the AWS Asia Pacific (Singapore) region, ap-southeast-1. | |
| Application servers | AnswerSingapore (the region that corresponds to AWS ap-southeast-1). | NotesRequests reach the Singapore servers through the nearest point of presence of the delivery network (CDN). |
| Image files (card images, contact photos) | AnswerPrivate storage in Singapore, shown only through the signed-in owner's account. | NotesCard images are straightened, resized and saved without camera or location metadata. The original upload is not kept. |
| Storage in Japan | AnswerAsk usStorage in Japan is available on request for company customers (separate deployment). | NotesThe standard service stores data in Singapore. |
| Transfers outside Singapore (such as the United States) | AnswerTo provide some features, some data goes to outside services outside Singapore, such as in the United States (reading card images, searching public web pages). | NotesWhat is sent is in 8. AI and outside services; who receives it and where is in 9. Sub-processors. |
3. Encryption
| Item | Answer | Notes |
|---|---|---|
| In transit | AnswerYesEvery connection uses HTTPS (TLS). HSTS is set for two years, including subdomains. | |
| Server to database | AnswerYesTLS is required. The database provider also requires TLS 1.2/1.3 on every connection (per the provider's published documentation). | |
| At rest (database) | AnswerYesEncrypted with AES-256 by the database provider (per the provider's published documentation). | NotesKeys are managed by the provider in a cloud key management service (per the provider's published documentation). |
| At rest (image files) | AnswerYesEncrypted with AES-256 by the storage provider (per the provider's published documentation). | |
| Credentials for connected services | AnswerYesThe Google Contacts refresh token is encrypted with AES-256-GCM before it is stored, and the plaintext is not written to logs. Access tokens are not stored. | NotesThe Sign in with Apple token is also stored encrypted, and used only to revoke access when an account is deleted. |
| Sign-in codes and IP addresses | AnswerYesEmail sign-in codes, and the values that tie a code to the browser that asked for it, are stored as keyed hashes, never in plain text. The IP address used for sending limits is stored as a keyed hash too. | |
| Field-level encryption | AnswerNoContact fields are not encrypted one by one in the application. | NotesEncryption at rest covers the whole database and storage (above). |
4. Access control and permissions
| Item | Answer | Notes |
|---|---|---|
| Separation between users | AnswerYesEvery read of your contacts is limited to your account. Other users cannot view them through their accounts. | NotesThe exceptions are the fields you choose to share with a team, and the operator's operational access (both below). One shared database, logically separated per account. |
| Team roles (early access) | AnswerYesAdmin: read, edit, manage members, export. Editor: read and edit. Viewer: read only. | NotesInvitations are bound to one email address and work only for it. The last admin cannot be removed or demoted. |
| What a team receives | AnswerOnly the contacts a member chooses to share, and only their name, title, company, who in the team knows them, and, if the member switches each on, the current work email and office phone numbers (saved as work or landline and confirmed as fixed lines). | NotesPrivate notes, numbers saved as mobile or personal, and where you met are never shared. |
| Sharing links | AnswerA public card and a subscribable vCard link exist only if the user creates them. | NotesAnyone holding a vCard link can download those contacts (never notes or photos). It can be turned off at any time. |
| Access by the operator | AnswerPartlyAdministrators can manage accounts, credit balances and access, and the service operator has operational access to stored data to run and repair the service. | NotesThe admin panel shows accounts, counts and aggregates, never what is in anyone's contacts, notes or cards. Admin actions are recorded in an audit log. |
| Re-authentication for sensitive actions | AnswerYesAccount changes, the full data download and disconnecting Google need a sign-in within the last 12 hours (or a Face ID confirmation). | |
| Web application protection | AnswerYesFraming by other sites is blocked (clickjacking), MIME sniffing is off, API writes must come from Meishio's own origin, and sign-in and some public endpoints are rate-limited. | NotesPart of the Content Security Policy is enforced; the rest runs in report-only mode. |
5. Sign-in
| Item | Answer | Notes |
|---|---|---|
| Sign-in methods | AnswerGoogle, Microsoft, LinkedIn or Apple accounts, a one-time code sent to your email, or Face ID (passkey). | NotesMeishio has no passwords of its own. |
| Password policy | AnswerN/ANot applicable: there is no password sign-in. | NotesExcept the App Store review demo account, active only when configured. Passwords for Google and other accounts follow those accounts' settings. |
| Multi-factor authentication | AnswerNoMeishio has no second factor of its own. | NotesWhen you sign in with Google or Microsoft, that account's 2-step verification applies. Face ID (passkey) checks you on the device; Meishio never receives biometric data. |
| Single sign-on (SAML etc.) | AnswerNoNot supported: no SAML, and no sign-in restricted to one organisation's Microsoft Entra ID tenant. | NotesMicrosoft accounts, including work and school accounts, can sign in, but cannot be limited to one organisation. |
| IP address restriction | AnswerNoNot supported. | |
| Session lifetime | AnswerWeb: up to 7 days. iPhone app: 15-minute access token, refresh token expires after 90 days unused, and the session ends after 365 days at most. | NotesSigning out on the web also signs that app session out. App sessions can be signed out from Settings. |
| Email sign-in codes | AnswerYesCodes expire after ten minutes and work only in the browser that asked for them. Attempts and sends are limited. | |
| Account suspension | AnswerYesThe operator can suspend an account that breaks the terms or puts others at risk. A suspended account cannot sign in. | |
| Company control over users | AnswerPartlyTeam admins can invite members, change their roles and remove them. | NotesA company cannot manage or suspend a member's personal Meishio account (their own contacts). |
6. Logs and audit
| Item | Answer | Notes |
|---|---|---|
| User activity log | AnswerYesRecords contact creation, edits, archiving and merges, changes sent to Google Contacts, and sign-ins (with the method). Users can review it in the app's Activity and undo changes. | NotesKept for 12 months. |
| Team audit log | AnswerYesRecords team creation, sharing, member invitations, joins, role changes, removals and departures, collection changes, shared-record edits, team notes, merges, renames and archiving, with who and when. | NotesMembers see the latest 50 in the team's Activity. No fixed retention: kept until the team is deleted. |
| Operator admin log | AnswerYesRecords actions by the operator's administrators (suspending accounts, plan changes, recording payments and similar). | NotesKept after account deletion with the account replaced by an anonymous id. |
| Signed-in devices | AnswerThe iPhone app saves its device name and model with the session, so signed-in devices can be recognised. | |
| Providing logs | AnswerPartlyYour own activity is included in the “Download my data” ZIP file. | NotesOther logs: please ask us. |
7. Backup and availability
| Item | Answer | Notes |
|---|---|---|
| Database backup | AnswerPartlyThe database provider's short-term recovery history can restore earlier states. | |
| Image file durability | Answer99.999999999% durability and 99.99% availability (per the provider's published documentation). | |
| Uptime guarantee (SLA) | AnswerNoNo SLA. During early access the service is provided “as is” and is not promised to be uninterrupted (Terms, section 11, draft). | |
| Redundancy and disaster recovery | AnswerThe application and database run in one region, Singapore. |
8. AI and outside services
The companies that receive data are named in 9. Sub-processors. This section says what is sent and why.
| Item | Answer | Notes |
|---|---|---|
| Reading a card | AnswerThe card image goes to an AI reading service (or a fallback service if the main one is unavailable). The details read may go to the checking service or an AI service to check their accuracy. | NotesFinding cards in the photo happens on the device and sends nothing. Nothing is saved from a photo that is not a business card. Images on the try page are not stored. |
| Meishio Search (job-change checks) | AnswerFor contacts you choose to check, the name, company, title, city and work-email domain go to web search services to find public pages. The checking service or an AI service compares the results with the contact. | NotesFull email addresses and personal email domains (such as gmail.com) are not sent. Nothing changes until you approve it. Contacts imported from Google are compared by the checking service only. |
| Company news | AnswerNews is found by company name only. An article's public text goes to an AI service to write a short summary. Contacts' names and details are never sent. | NotesOnly the summary and the link are kept. Company news can be turned off in Settings. |
| Research (when you ask for it) | AnswerPerson and company search terms go to web search services, and the sources are saved. The sources and what you saved in your profile go to an AI service to write a brief. | NotesContacts imported from Google get no brief, and nothing about them goes to an AI service. |
| Sorting an import | AnswerOnly each entry's organisation, title and work email domain go to the checking service or an AI service, to tell business contacts from personal ones. Names, phone numbers and full email addresses are never sent, nor a free-mail domain such as gmail.com or a domain that contains the person's name. | NotesEntries from Google Contacts go to the checking service only, and Meishio's own rules sort the rest. |
| Tidy-up suggestions on import | AnswerOnly when you choose to get tidy-up suggestions, each row's name (with phone numbers taken out), company, title, email domain, and phone and email labels go to an AI service to suggest cleaner names, companies and labels. | NotesPhone numbers, full email addresses, postal addresses and notes are not sent, and nothing changes until you apply a suggestion. Entries imported from Google Contacts are never sent. |
| Follow-up drafts | AnswerWhen you open a draft, the event name and each person's company, title and draft language (English or Japanese) go to an AI service. Names, email addresses, phone numbers and your notes are not sent; Meishio adds the name to the draft afterwards. | NotesPeople imported from Google get a draft Meishio writes itself from a template. |
| Contacts imported from Google | AnswerYesContacts imported from Google, including people you add from “People you've emailed”, are not sent to the AI services that read cards and write text. | NotesGoogle user data is not used to train a generalized AI or machine-learning model, and Meishio does not train or fine-tune any model on it. Use follows the Google API Services User Data Policy, including the Limited Use requirements. |
| Use for AI training | AnswerPartlyResponse storage is turned off on every request to the main AI service. Google user data is not used for training (above). | NotesOutside providers handle data under their own API data policies. |
| Translations | AnswerOnly titles, company names and departments go to an AI service. Names, emails, phone numbers and notes are not sent. Names are never machine-translated. | |
| Search in plain words | AnswerYour search words and lists with no personal details (countries, event names, contact types, industries) go to an AI service to become filters. Contacts' names and emails are not sent. | |
| Location (“Scanning at”) | AnswerOnly when you open that label and your browser allows it, a position rounded to about 1 km goes to a place-name service. | NotesOnly the place name and a position rounded to about 100 m are kept. |
| Profile photo suggestions | AnswerFor a contact with no photo, only a one-way SHA-256 hash of the email address goes to a photo service, never the address itself. | |
| Company names from email domains | AnswerMeishio looks up the public website of a work email's domain. Only the domain is used, never a name or an email address. | NotesPersonal domains such as gmail.com are never looked up. |
| Shared public results | AnswerPublic web results found by Meishio Search may be reused for 30 days by other users looking up the same public page. | NotesOnly public web results are shared, never contacts, notes, phone numbers or emails. |
| Sale of data and advertising | AnswerNeverMeishio does not sell your data or contacts. Google user data is never used for advertising. |
9. Sub-processors (services that receive personal data)
Outside services that receive personal data, as listed in the privacy information. Each handles data under its own policies. Services that receive only company-level or map data are listed below the table.
| Processor | Purpose | Data sent or stored | Location / region |
|---|---|---|---|
| Neon | PurposeDatabase | Data sent or storedEverything stored: accounts, contacts, notes, history | Location / regionSingapore (AWS ap-southeast-1) |
| Vercel | PurposeRunning the application, storing image files, web analytics and speed measurements | Data sent or storedAll traffic; card images and contact photos. Analytics: page paths, referrers, approximate location, browser and device information (no contact details) | Location / regionSingapore (sin1) |
| OpenAI | PurposeAI service (card reading, accuracy checks, matching, sorting, tidy-up suggestions, summaries, drafts, translations, search filters) | Data sent or storedCard images, and the fields listed for each feature in 8. | Location / regionUnited States |
| Google (Gemini API) | PurposeFallback for the above when OpenAI is unavailable | Data sent or storedAs above | Location / regionGoogle's servers, not limited to one country |
| TypeSafe | PurposeChecking service (accuracy checks, import sorting, Meishio Search matching) | Data sent or storedName, organisation, title, email domain; excerpts of search results | Location / regionAsk us |
| Serper | PurposeWeb search (Google web results) | Data sent or storedName, company, title, city, work-email domain | Location / regionAsk us |
| Exa | PurposeWeb search (public pages, research, company news, email formats) | Data sent or storedName, company, title, city, work-email domain; company names; a LinkedIn URL you provide | Location / regionUnited States |
| Resend | PurposeEmail delivery (sign-in codes, notices) | Data sent or storedEmail address and the email's content | Location / regionAsk us |
| BigDataCloud | PurposePlace names for “Scanning at” | Data sent or storedPosition rounded to about 1 km, sent from the browser | Location / regionAsk us |
| Gravatar | PurposeProfile photo suggestions | Data sent or storedSHA-256 hash of an email address | Location / regionAsk us |
| PurposeSign in with Google, Google Contacts sync (when you connect it) | Data sent or storedGoogle account id, verified email and name; the contacts you choose | Location / regionGoogle's services | |
| Microsoft / LinkedIn / Apple | PurposeSign-in, when you choose that button | Data sent or storedAccount id, verified email, name | Location / regionEach company's services |
| Razorpay / Stripe | PurposePayments (not in use today; for paid plans later) | Data sent or storedCard and UPI details are entered on the provider's checkout and never reach Meishio. Meishio records amount, date and payment reference | Location / region— (not in use) |
| Item | Answer | Notes |
|---|---|---|
| Services that receive only company-level or map data | Answerlogo.dev, Brandfetch, Wikimedia Commons and DuckDuckGo (company logos and official websites); Wikidata (company names from a domain); GDELT and Google News (public news, searched by company name); Google Translate (an article's public URL, when you open a translated article); Apple MapKit and OpenFreeMap (showing the map). | NotesOnly company names, domains, article URLs and the map area are sent, never a contact's personal data. |
10. Deletion and return of data
| Item | Answer | Notes |
|---|---|---|
| Export | AnswerYesContacts export as CSV or vCard. CSV column names can match Outlook, HubSpot, Zoho CRM, Salesforce, Pipedrive or kintone. | NotesPrivate notes are included only if you tick “Include my notes in the CSV”. |
| Full data download | AnswerYesSettings → Account → “Download my data” gives one ZIP with everything for the account: contacts, companies, notes and activity, events, card images, photos, research, settings, and the log of changes made in Google Contacts. | NotesUp to 3 times a day. Needs a sign-in within the last 12 hours. |
| Deleting a contact | AnswerRemoving a contact archives it in Meishio; it can be restored from Archived. It is permanently deleted with the account. | NotesThe original in Google Contacts is never deleted or changed. |
| Deleting the account | AnswerYesSettings → Account → “Delete my account” deletes everything in the account. For 7 days, signing in again cancels it. After that the deletion worker removes the data permanently and revokes Meishio's Google Contacts and Apple sign-in access. | NotesA confirmation email with the deletion date is sent when deletion is requested. How to ask without the app: getmeishio.com/delete-account |
| What is kept after deletion | AnswerPartlyPayment records (amounts and dates, with the account replaced by an anonymous id), the admin audit log (anonymous id, admin notes about you removed), the database provider's recovery history until it rolls over, and anonymous counts with no personal data. | |
| At cancellation or end of service | AnswerUsers can export and delete their data at any time, as above. If the service as a whole ends, reasonable notice will be given. | NotesBefore suspending an account, where reasonable, the user gets a chance to download their data first (Terms, section 8, draft). |
| Team data | AnswerWhen a member leaves or is removed, the company records they shared stay in the team. |
11. Incident response
| Item | Answer | Notes |
|---|---|---|
| Where to report | Answersupport@getmeishio.com (reply within 2 working days) |
12. Certifications
| Item | Answer | Notes |
|---|---|---|
| ISMS (ISO/IEC 27001) | AnswerNot heldNot held. | |
| PrivacyMark (Japan) | AnswerNot heldNot held. | |
| SOC 2 | AnswerNot heldNot held (no report). | |
| ISO/IEC 27017 and 27018 (cloud security) | AnswerNot heldNot held. | |
| Sub-processors' certifications | AnswerSee each provider's own published information. They do not certify Meishio itself. |
These answers are current as of 13 October 2026 and are updated when features change. The latest version is at getmeishio.com/security/checklist (Japanese: getmeishio.com/ja/security). Related: Your data getmeishio.com/security, privacy information getmeishio.com/privacy, terms getmeishio.com/terms. Questions: support@getmeishio.com.