Evidence - Proven on systems like yours.

Our team's previous work: AI platforms, multi-tenant SaaS, compliance programs and incidents. Client names stay private. Every number below comes from the engagement record.

Our team's previous work

Multi-tenant voice and chat AI SaaS

Security and compliance auditOctober 2026

A full audit of a multi-tenant voice and chat AI platform

A production platform where businesses run AI phone and chat agents for their own customers, with telephony, payments and thirteen CRM integrations.

We tested tenant isolation live across every table, attacked the AI agents and their tools, and produced the documents a SOC 2 Type I needs.

Read case study

Result

Two externally exploitable high findings were fixed the same night.

Multi-tenant B2B SaaS, 340 business customers

Grey-box penetration testPrevious engagement

Two critical cross-customer bugs in a B2B SaaS

A B2B platform used by 340 business customers, tested with partial access (grey box).

We replayed every endpoint as another customer and found two ways across the tenant boundary.

Read case study

Result

Both critical findings were fixed within five days and passed retest.

22 person SaaS company

SOC 2 readiness and security leadPrevious engagement

SOC 2 Type I in month three for a 22 person SaaS

A 180 question buyer security questionnaire, then a SOC 2 Type I.

We answered the questionnaire in four days and led the company to a Type I report.

Read case study

Result

Type I report in month three, then monthly security lead support through Type II.

E-commerce group with three brands

External attack surface reviewPrevious engagement

61,000 customer records found on a forgotten staging store

We mapped 187 DNS records and 63 live hosts across three brands.

One staging store held real customer data with no password.

Read case study

Result

The store was taken offline within 40 minutes of the report.

60 person law firm

Email and workspace securityPrevious engagement

Phishing credential entry cut from 19% to 4%

Phishing simulations, DMARC to reject and enforced MFA for a 60 person firm.

Read case study

Result

Reporting rose from 5% to 48% and no legitimate mail was lost.

Cloud incident response

Incident responsePrevious engagement

A cryptominer traced in eight hours

An admin key had been in a public repository for eight months.

Read case study

Result

Three persistence mechanisms removed and rebuilt from clean images in 48 hours with no downtime.

We publish what the engagement record proves and nothing else. If a client name cannot be shared, the numbers still can.

How we write case studies

Send us the questionnaire your customer sent.

We will tell you which lines a test answers, in writing, within one business day.

Get a quote

Who we are

CompanyMeridal Group LLCWyoming, United States
TestingPerformed from the EUFor clients in the US and Europe