Meridian S.A. ("Meridian", "Company", "we", "our", or "us") provides custodial infrastructure designed to safeguard supported Digital Assets on behalf of Users.
This Digital Asset Custody Policy describes the principles, controls, and operational framework governing Meridian's custody services.
This Policy forms part of Meridian's legal framework and should be read together with the:
- Terms of Service
- Privacy Policy
- AML & Compliance Policy
- KYC Policy
- Risk Disclosure
2. Scope
This Policy applies to all Digital Assets held by Meridian in connection with supported Services.
The Policy applies regardless of whether the Services are accessed through:
- Website
- Telegram Bot
- mobile applications
- APIs
- merchant interfaces
- business accounts
- institutional products
Not every custody feature is available for every Digital Asset.
3. Custody Model
Meridian operates a custodial model for supported Digital Assets.
Under this model, Meridian is responsible for maintaining the technical infrastructure necessary to securely safeguard Digital Assets.
Custody Services may include:
- secure wallet management
- transaction authorization
- blockchain interaction
- withdrawal processing
- deposit processing
- key management
- operational security
Meridian does not guarantee uninterrupted availability of Custody Services.
4. Ownership of Digital Assets
Except where otherwise required by Applicable Law, Digital Assets credited to a User's Digital Asset Account remain the property of that User. Meridian acts solely as custodian.
Nothing contained in this Policy transfers ownership of Digital Assets to Meridian. Digital Assets held for Users are not intended to become operational assets of Meridian.
Meridian will not knowingly use User Digital Assets for proprietary trading, lending, rehypothecation, or investment purposes unless expressly authorized by the User or required by Applicable Law.
5. Segregation of Assets
Meridian seeks to maintain appropriate operational segregation between:
- Company assets
- User Digital Assets
- operational wallets
- treasury wallets
- security infrastructure
Segregation methods may vary depending upon the supported blockchain and operational requirements.
6. Wallet Infrastructure
Meridian may utilize multiple wallet environments, including:
- cold wallets
- hot wallets
- warm wallets
- operational wallets
- settlement wallets
- reserve wallets
Wallet architecture may change without notice where reasonably necessary to improve Platform security or operational resilience.
7. Supported Digital Assets
Meridian determines which Digital Assets are supported. Support depends upon factors including:
- blockchain stability
- operational security
- compliance
- technical compatibility
- liquidity
- business considerations
Support may be withdrawn at any time.
8. Deposits
Users may transfer supported Digital Assets into designated Meridian wallet addresses.
Deposits become available only after receiving the required blockchain confirmations.
Meridian may delay crediting deposits pending:
- compliance review
- blockchain verification
- security review
- fraud investigation
9. Withdrawals
Withdrawal requests are subject to:
- security verification
- compliance review
- blockchain availability
- operational controls
Meridian may temporarily delay or suspend withdrawals where reasonably necessary to protect Users or Platform security.
10. Private Key Management
Meridian maintains a comprehensive key management framework designed to protect cryptographic credentials used in connection with Custody Services.
Private keys are generated, stored, managed, rotated, archived, and retired using security procedures appropriate to the operational and security requirements of the Platform.
Private keys are never intentionally disclosed to Users or unauthorized third parties.
Access to key management systems is restricted to authorized personnel operating under documented internal controls.
Key management procedures are periodically reviewed and may be updated to reflect technological developments and evolving cybersecurity risks.
11. Security Controls
Meridian applies administrative, technical, and organizational safeguards designed to protect Digital Assets and supporting infrastructure.
Security measures may include:
- encryption of sensitive information
- Hardware Security Modules (HSM)
- Multi-Party Computation (MPC)
- role-based access controls
- multi-factor authentication
- privileged access management
- transaction monitoring
- network segmentation
- continuous security monitoring
- penetration testing
- vulnerability assessments
- audit logging
- disaster recovery planning
- business continuity planning
Security controls may evolve over time without prior notice where reasonably necessary to improve the protection of the Platform.
12. Multi-Party Computation (MPC)
Where appropriate, Meridian may utilize Multi-Party Computation ("MPC") technology to enhance the security of Digital Asset custody.
MPC enables cryptographic operations to be performed without reconstructing a complete private key within a single environment.
Meridian may implement MPC for:
- transaction authorization
- key generation
- key storage
- operational resilience
- enhanced security
Meridian reserves the right to modify the custody architecture as technology evolves.
13. Hardware Security Modules (HSM)
Meridian may utilize Hardware Security Modules ("HSMs") or comparable secure cryptographic hardware to protect sensitive cryptographic material.
HSMs may be used for:
- key generation
- cryptographic signing
- secure storage
- access control
- cryptographic operations
Use of HSM technology is determined by operational requirements and supported infrastructure.
14. Cold Storage and Hot Wallets
Meridian may maintain multiple custody environments, including cold storage and operational hot wallet infrastructure.
Cold storage is generally intended for long-term safeguarding of Digital Assets with limited network exposure.
Hot wallets may be used to facilitate routine Platform operations, including deposits, withdrawals, and settlement activities.
The allocation of Digital Assets between custody environments is determined by Meridian based on operational, liquidity, security, and risk management considerations.
Meridian does not publicly disclose the proportion of assets maintained within any specific custody environment.
15. Key Lifecycle Management
Meridian maintains procedures governing the lifecycle of cryptographic credentials.
Such procedures may include:
- secure key generation
- controlled activation
- encrypted storage
- periodic key rotation
- backup procedures
- recovery procedures
- secure archival
- secure destruction
Key lifecycle procedures are designed to reduce operational and cybersecurity risks.
17. Operational Security
Meridian maintains operational controls intended to reduce the risk of unauthorized access, internal misuse, or operational failure.
Such controls may include:
- segregation of duties
- least-privilege access
- dual authorization
- privileged access monitoring
- employee background screening where appropriate
- change management procedures
- security incident reporting
- periodic internal reviews
Operational security measures are reviewed on an ongoing basis.
18. Incident Response
Meridian maintains internal procedures for responding to operational, cybersecurity, and custody-related incidents.
Incident response procedures may include:
- investigation of security events
- temporary suspension of withdrawals
- wallet isolation
- key replacement
- forensic analysis
- internal escalation
- engagement of external security specialists where appropriate
- notification of competent authorities where required by Applicable Law
Meridian will use commercially reasonable efforts to restore normal operations as soon as practicable following a security incident.
19. Business Continuity and Disaster Recovery
Meridian maintains business continuity and disaster recovery procedures intended to support the resilience of Custody Services.
Such procedures may include:
- geographically distributed infrastructure
- encrypted backups
- disaster recovery testing
- redundant systems
- operational failover procedures
- emergency response planning
Meridian periodically reviews and updates continuity planning to address evolving operational risks.
20. Insurance Disclaimer
Meridian may from time to time obtain insurance or other forms of risk protection relating to certain aspects of its operations.
Unless expressly stated otherwise in writing, Users should not assume that any Digital Assets are insured against loss.
The existence of insurance, if any, does not create contractual rights in favor of Users and does not alter Meridian's liability under the Terms of Service.
Nothing in this Policy shall be interpreted as a guarantee that losses resulting from cybersecurity incidents, blockchain failures, force majeure events, or other circumstances will be fully recoverable.
21. Blockchain Network Events
Digital Asset networks may undergo technical or governance-related changes that affect the operation of the Platform.
Such events may include:
- hard forks
- soft forks
- chain splits
- protocol upgrades
- validator changes
- consensus changes
- token migrations
- redenominations
- blockchain reorganizations
Meridian reserves the sole discretion to determine whether and how such events will be supported.
Operational decisions will consider:
- technical feasibility
- security
- operational stability
- legal and regulatory considerations
- user protection
- business continuity
Meridian is under no obligation to support every blockchain network event.
22. Forks and Token Migrations
Where a supported blockchain experiences a hard fork, token migration, or similar protocol event, Meridian may determine, at its sole discretion, whether:
- the event will be supported
- new assets will be credited
- deposits will remain available
- withdrawals will remain available
- trading or transfers will be temporarily suspended
- additional verification procedures are required
Meridian is not obligated to distribute assets created through blockchain forks or protocol changes unless expressly announced.
23. Airdrops
Meridian may, but is not obligated to, support airdrops associated with supported Digital Assets.
When evaluating whether to support an airdrop, Meridian may consider:
- technical feasibility
- operational complexity
- blockchain security
- regulatory considerations
- legal restrictions
- liquidity
- customer demand
Users should not assume that every airdrop will be supported. Meridian shall not be liable for any loss arising from unsupported airdrops.
24. Staking and Protocol Participation
Certain Digital Assets may support staking, governance participation, validator delegation, or similar blockchain functionality.
Unless expressly offered as a Meridian Service, Users should not assume that:
- staking is supported
- governance participation is available
- validator rewards will be distributed
- protocol incentives will be credited
Where staking or similar services are offered, additional terms may apply.
25. Emergency Security Measures
Where Meridian reasonably believes that Digital Assets, Accounts, or the Platform may be exposed to material security risks, Meridian may implement emergency protective measures.
Such measures may include:
- temporary suspension of withdrawals
- suspension of deposits
- temporary suspension of specific blockchain networks
- wallet migration
- replacement of cryptographic infrastructure
- enhanced authentication
- emergency compliance reviews
- transaction delays
- temporary Account restrictions
Emergency measures are implemented solely for the purpose of protecting Users, Digital Assets, and the integrity of the Platform.
26. Audit and Operational Reviews
Meridian periodically reviews its custody framework to evaluate the effectiveness of operational controls, security procedures, and risk management processes.
Reviews may include:
- internal security assessments
- operational audits
- infrastructure testing
- penetration testing
- disaster recovery testing
- access reviews
- compliance assessments
- third-party security assessments where appropriate
Meridian may improve or modify custody procedures following such reviews.
27. Records
Meridian maintains operational records relating to Custody Services, including:
- deposits
- withdrawals
- blockchain transactions
- wallet operations
- authorization records
- security events
- audit logs
- compliance reviews
Records are retained in accordance with Applicable Law and Meridian's internal record retention procedures.
28. Limitation of Custody Liability
Meridian applies commercially reasonable security measures designed to safeguard Digital Assets.
However, Digital Asset custody involves technological, operational, and blockchain-related risks that cannot be entirely eliminated.
To the fullest extent permitted by Applicable Law, Meridian shall not be liable for losses arising from:
- blockchain protocol failures
- validator failures
- network congestion
- software vulnerabilities
- smart contract failures
- cryptographic weaknesses not reasonably foreseeable
- force majeure events
- governmental actions
- telecommunications failures
- internet outages
- cyberattacks beyond Meridian's reasonable control
- User negligence
- compromised User devices
- phishing attacks
- incorrect withdrawal instructions submitted by the User
Nothing contained in this Policy limits liability that cannot lawfully be excluded.
30. Policy Updates
Meridian may amend this Digital Asset Custody Policy from time to time to reflect:
- technological developments
- changes in security practices
- operational improvements
- regulatory developments
- new custody solutions
- supported blockchain networks
- business developments
Updated versions become effective upon publication unless a later effective date is specified.
Continued use of Custody Services after publication constitutes acceptance of the updated Policy.
31. Contact Information
Questions regarding this Digital Asset Custody Policy or Meridian's Custody Services may be submitted through the official communication channels published on the Platform.
Custody-related legal inquiries, operational questions, or security concerns should be directed to the designated contact details published by Meridian.
32. Effective Date
This Digital Asset Custody Policy is effective from the date stated above and remains in force until amended or replaced by Meridian S.A.
© Meridian S.A. All Rights Reserved.