How this website is protected
- All traffic is served over HTTPS with HTTP Strict Transport Security.
- A Content Security Policy and related headers restrict what the site can load and where it can be framed.
- Every form and AI request is validated on the server and rate-limited.
- API keys for AI and email providers are held server-side only and are never sent to the browser.
- The public AI assistant has no tools that can take actions on your behalf; it answers from approved public content.
- Voice mode is opt-in. The microphone is used only after you press “Start talking”, and audio is never recorded or stored by Merge.
How we build for clients
In client systems, every AI action that can affect a business workflow is permissioned, enforced in code rather than by prompt, and logged. High-impact actions require explicit human confirmation.
Reporting a vulnerability
If you believe you have found a security issue, please email hello@mergeleadingedge.com with “Security report” in the subject. Please give us reasonable time to investigate before any public disclosure, and do not access data that isn’t yours or degrade the service.