Enterprise Architecture & Setup

Overview

Meridian Canvas Studio is one codebase delivered in editions. The enterprise edition is selected by configuration, not a separate product, so security fixes and features arrive for every customer at the same time.

Deployment options

• Dedicated hosted instance — an isolated copy run by Meridian Canvas on your own address, with your single sign-on.
• Private cloud / self-hosted — the application runs in your environment against your own database, identity provider and AI endpoint.

Components

• Web application — a server-rendered React application. Server logic runs as small stateless functions; no data is held in application memory.
• Database — PostgreSQL. Every table enforces row-level security, so each query only returns rows the signed-in person owns or is granted.
• Accounts — a standards-based identity service handling email sign-in, password reset and single sign-on sessions.
• File storage — profile photos and map images in private object storage.
• AI service — an OpenAI-compatible chat endpoint called only from the server. Keys and prompts never reach the browser.

Configuration

Settings are environment variables read at start-up:

• VITE_EDITION — cloud or enterprise. Enterprise hides consumer sign-in buttons.
• VITE_SSO_DOMAIN — your company email domain; shows the single sign-on button.
• VITE_SSO_LABEL — optional button text, e.g. "Sign in with Acme SSO".
• AI_BASE_URL, AI_API_KEY, AI_MODEL — point AI features at your own model service.

Single sign-on

SAML 2.0 and OpenID Connect are supported, including Microsoft Entra ID, Okta, Ping, OneLogin, Google Workspace and Keycloak.

• Provide your IdP metadata URL (SAML) or issuer, client ID and secret (OIDC).
• Register the service-provider details supplied during onboarding in your IdP.
• Restrict sign-in to your email domain. Removing a person in your IdP ends their access at next sign-in.

Private AI

Set AI_BASE_URL to any OpenAI-compatible endpoint (Azure OpenAI, vLLM, Ollama or an internal gateway). When set, no map content leaves your network for AI features. Leaving it empty uses the managed AI service. Super admins can also set the AI address, model and key per instance from the admin console, and saved settings take precedence over environment variables.

Usage limits

AI requests are limited on the server before any model is called: visitors get 3 free tries in total (keyed per browser, with a shared monthly cap per network) and members get 30 requests a month, while admins are unlimited. Every request is logged, and the admin console shows usage by person, by feature and by model.

Security posture

• TLS for all traffic; data encrypted at rest by the database and storage provider.
• Row-level security on every table; privileged operations run only on the server after role checks.
• Roles live in a dedicated table and are never read from editable profile data.
• Cross-site request protection on all server calls.

Accessibility & compliance

Self-assessed against WCAG 2.2 AA, EN 301 549 (clause 9), Section 508 and AODA. See the accessibility statement for details and known gaps.

Getting help

Contact your Meridian Canvas account team for onboarding, IdP configuration sessions and security questionnaires.