⚡ PlausityOS · Due Diligence Report
Meridian Cloud Services, Inc.
Project Meridian — Buy-Side Due Diligence
Overall Risk
6.8
Executive Summary
Deal is executable with appropriate risk mitigation
PlausityOS analyzed 247 documents across 7 workstreams in 4.2 hours. Overall risk scores 6.8/10 (Elevated), driven primarily by critical cybersecurity findings and elevated financial quality-of-earnings concerns. The deal is broadly executable at the proposed $195M enterprise value, but value protection mechanisms are warranted before close.
The most material risks are concentrated in two workstreams: Cybersecurity (8.1) — an expired SOC 2 Type II certification with unresolved API vulnerabilities creates active enterprise customer retention risk — and Financial (7.4) — management's adjusted EBITDA includes $2.3M in addbacks that do not meet standard QoE criteria. These issues are remediable but require deal structuring to allocate risk appropriately.
Commercial fundamentals are solid: ARR of $29.1M growing 22% YoY with strong logo retention, though net revenue retention has compressed from 112% to 104% over 24 months and warrants monitoring. The technology stack carries meaningful modernization debt ($3–5M), which is manageable within a 24-month post-close roadmap.
☑ Recommended Deal Mechanics
- →$15M escrow holdback for 18 months to cover FalconTech IP litigation ($15M claim; no insurance confirmed).
- →Condition close on completion of SOC 2 Type II renewal audit OR $8M price reduction with 90-day post-close milestone.
- →Retention packages for top 5 engineers (est. $2.1M total) tied to 24-month vesting; 3 are unprotected today.
- →Working capital peg at $6.4M (company currently pegs at $4.8M); adjust purchase price accordingly.
- →Enhanced reps & warranties insurance covering cybersecurity and IP representations for 3-year tail.
🗂 Docs reviewed: 38 / 38
Findings: 4
1 Critical
1 High
2 Med
Customer Concentration — Top 3 Logos = 47% of ARR
Critical
AWS (19% of ARR), NovaTech Corp (16%), and Praxis Financial (12%) represent 47% of total ARR. The AWS contract — the largest single relationship — expires March 2027 with no automatic renewal clause and includes a change-of-control notification right. A churn event on any two of these logos would reduce revenue by ~$13.8M.
NRR Compression: 112% → 104% Over 24 Months
High
Net Revenue Retention has declined consistently from 112% (Q1 2024) to 104% (Q4 2025), indicating a slowdown in expansion revenue relative to churn. Expansion revenue from upsells declined $1.2M YoY while gross churn remained flat at 8%. The downgrade trend is driven by SMB customers reducing seats post-COVID headcount normalization.
TAM Saturation in Core SMB Segment; Enterprise Push Requires GTM Investment
Medium
Third-party market data indicates Meridian has achieved ~14% penetration in its primary SMB segment (companies 50–500 employees using AWS). The enterprise segment (>500 employees) represents 3× the TAM but requires a dedicated enterprise sales motion, customer success expansion, and SOC 2 / compliance certification — none of which are currently in place.
Competitive Pressure from AWS-Native Tooling
Medium
AWS launched a competing cloud cost optimization suite (AWS Cost Hub) in November 2025 with overlapping functionality. Initial market feedback suggests AWS Cost Hub will be included in existing AWS contracts at no additional cost, which could commoditize part of Meridian's core value proposition for AWS-centric customers.
🗂 Docs reviewed: 61 / 61
Findings: 4
1 Critical
2 High
1 Med
$2.3M EBITDA Addback Dispute — Management Adjusted EBITDA Overstated
Critical
Management presents Adjusted EBITDA of $23.8M (9.3× EV/EBITDA at proposed price). Our quality-of-earnings analysis identifies $2.3M in addbacks that do not meet standard QoE criteria: (1) $1.1M in "one-time" recruiting costs that have recurred for 3 consecutive years; (2) $0.8M in capitalized software development costs that should be expensed under ASC 350-40; (3) $0.4M in accelerated vendor payments reclassified as non-recurring. Adjusted EBITDA on a QoE basis is $21.5M, implying a purchase price multiple of 9.1×.
Deferred Revenue Haircut Risk — $8.2M at Risk on Change of Control
High
Meridian carries $14.7M in deferred revenue on the balance sheet, representing prepaid annual and multi-year contracts. Review of 23 customer contracts identified that $8.2M relates to agreements containing change-of-control provisions that allow customers to request pro-rata refunds within 90 days of a qualifying transaction. Historical churn on such events at comparable companies is 15–30%.
Working Capital Requirements 30% Above Industry Norms; $4.1M Seasonal Swing
High
Meridian's working capital cycle is longer than peers due to quarterly invoicing on annual contracts. NWC averaged $6.4M over the trailing 12 months but swings from a low of $4.3M (Q3) to $8.4M (Q1) due to enterprise renewal timing. Management's proposed working capital peg of $4.8M is below the normalized average and would result in a $1.6M true-up to buyer at close.
Two Quarters of Net Cash Burn Masked by Delayed Vendor Payments
Medium
Q2 and Q3 2024 showed negative operating cash flow of $0.9M and $1.2M respectively, obscured on the cash flow statement by $3.1M in deferred vendor payments (AP days stretched from 38 to 71). This pattern normalized in Q4 2024 when delayed payments were made, resulting in a one-time $3.1M cash outflow. No evidence this behavior will recur, but it indicates prior cash management pressure.
🗂 Docs reviewed: 44 / 44
Findings: 4
1 Critical
1 High
1 Med
1 Low
Active IP Litigation — FalconTech Systems $15M Patent Infringement Claim
Critical
FalconTech Systems filed suit in the Western District of Texas (Case No. 6:24-cv-01847) in November 2024 alleging infringement of US Patent 11,842,901 related to cloud resource allocation algorithms. The $15M damages claim covers alleged infringement from January 2022–present. Meridian's outside counsel (Perkins Coie) rates the case as "moderate risk." No D&O or general liability insurance policy covers this claim.
Change-of-Control Consent Required for 3 Customers Representing $28M ARR
High
Three enterprise customer agreements — representing $28M (96% of enterprise ARR) — contain explicit change-of-control provisions requiring customer consent to assignment. Two agreements give customers the right to terminate without penalty if consent is not granted within 60 days of transaction closing. Consent campaigns have not been initiated by management.
4 Employee RSA Agreements Lack IP Assignment Clauses
Medium
Four engineering employees hired between 2018–2020 have employment agreements that predate Meridian's 2021 IP assignment policy update. Their RSA agreements do not include explicit assignment of inventions to the company. Two of these employees are listed as co-inventors on Meridian's core patent portfolio (3 of 7 patents).
GDPR Compliance Gaps in EU Data Processing Addenda
Low
Six EU customer DPAs reference outdated Standard Contractual Clauses (pre-June 2021 SCCs). While not an immediate violation, EU regulators have flagged companies with non-updated SCCs in recent enforcement actions. EU revenue represents approximately $2.1M ARR (7% of total).
🗂 Docs reviewed: 31 / 31
Findings: 5
2 High
2 Med
1 Low
Legacy Monolith Architecture — $3–5M Re-Architecture Investment Required
High
Approximately 40% of the core codebase was written before 2020 and operates as a monolithic Rails application. The architecture creates horizontal scaling bottlenecks above 500 concurrent enterprise users and limits feature development velocity (average sprint velocity is 60% of what comparable teams achieve on modern microservices architectures). External engineering assessment estimates $3–5M and 18–24 months to complete migration.
3 of 5 Senior Engineers at Post-Close Flight Risk — No LTIPs in Place
High
Five engineers are classified as "senior" by Meridian. Three of them — responsible for the core data ingestion pipeline and API layer — have no long-term incentive agreements (LTIPs, equity refresh, or retention bonuses) that would create post-close retention incentives. Reference checks indicate at least two have received recruiter outreach from AWS and Snowflake in the past 6 months.
No Tested Disaster Recovery Plan in 18+ Months
Medium
Meridian's DR plan was last tested in August 2024. The documented RTO/RPO targets (4 hours / 1 hour) have not been validated against current production architecture. The most recent AWS architecture change (addition of RDS Aurora in April 2025) was not incorporated into the DR runbook.
AWS Single-Region Architecture Creates 99.7% SLA Exposure
Medium
All production infrastructure runs in a single AWS region (us-east-1). Two enterprise contracts include 99.9% uptime SLAs with financial penalties for breaches. A single-region deployment cannot reliably meet 99.9% SLA commitments, particularly given three AWS us-east-1 partial outages in 2024 that each caused 45–90 minute Meridian service degradation.
Dependency on 2 Deprecated Open-Source Libraries
Low
Two production dependencies (node-aws-sdk v2.x, deprecated Nov 2023; and redis-py v3.x, deprecated Dec 2024) are past end-of-life and no longer receive security patches. Both have known CVEs with low exploitability scores (<5.0 CVSS). Migration to current versions is straightforward but has not been prioritized.
🗂 Docs reviewed: 29 / 29
Findings: 4
2 Critical
2 High
SOC 2 Type II Certification Expired June 2025 — 3 Enterprise Customers Have Audit Rights
Critical
Meridian's SOC 2 Type II report expired June 30, 2025. The renewal audit, originally scheduled for Q3 2025, has been delayed by 9 months due to internal control deficiencies identified by the auditor (Deloitte) in a pre-audit assessment. Three enterprise customers — representing $14.2M ARR — have audit rights in their agreements that allow them to request evidence of SOC 2 compliance within 30 days of request. One customer (ProximaSoft) has already invoked this right and is awaiting a response.
2 Unresolved High-Severity Vulnerabilities in API Authentication Layer (2023 Pen Test)
Critical
The 2023 penetration test (conducted by Bishop Fox) identified 2 high-severity vulnerabilities in the API authentication layer: (1) JWT token validation bypass allowing privilege escalation under specific timing conditions (CVSS 8.1); (2) Inadequate rate limiting on the authentication endpoint enabling credential stuffing attacks. Both were marked as "accepted risk" in the remediation tracker with no completion date. No follow-up pen test has been conducted.
No MFA Enforced for 12 Privileged Admin Accounts
High
Twelve accounts with administrative access to production systems (AWS console, database admin, CI/CD pipelines) do not have mandatory MFA enforcement. The MFA policy was updated in January 2025 but grandfathered existing admin accounts pending a "migration sprint" that has not been scheduled. This represents a significant credential compromise risk, particularly given the 2024 industry-wide uptick in cloud admin credential attacks.
8 Third-Party Vendors with Persistent Production Access — Undocumented
High
Eight third-party vendor accounts have persistent (non-time-limited) access to production systems, including two vendors whose contracts expired in 2024. None of these access grants are documented in the vendor risk register. This creates supply chain attack exposure and potential compliance issues under Meridian's own security policy and customer contractual obligations.
🗂 Docs reviewed: 22 / 22
Findings: 4
2 Med
2 Low
Sales Tax Nexus Exposure — 5 Unregistered States, Est. $280K–$420K Liability
Medium
Meridian has operations (employees or significant customer revenue) in 14 states but is registered for sales tax in only 9. Post-Wayfair economic nexus thresholds have been exceeded in California, New York, Illinois, Washington, and Massachusetts without corresponding sales tax registration. Estimated exposure based on SaaS tax applicability and state statute of limitations is $280K–$420K.
R&D Tax Credit Documentation Incomplete — $1.1M Potential Recapture Risk
Medium
Meridian claimed $1.1M in R&D tax credits for FY2022–2023. Documentation supporting the qualified research expense (QRE) calculations (contemporaneous employee time records, project tracking) is incomplete for 35% of claimed expenses. An IRS examination could result in partial or full recapture of these credits plus interest and penalties (~$220K–$440K additional exposure).
Transfer Pricing Documentation for Canadian Subsidiary Requires Update
Low
Meridian's Canadian subsidiary (Meridian Cloud Canada, Inc.) has intercompany service agreements that have not been updated since 2021. The current documentation may not support the intercompany pricing under 2025 OECD guidelines, particularly given the subsidiary's expansion of engineering headcount from 4 to 11 employees. CRA audit risk is low given the subsidiary's relatively small size (~$2.1M in intercompany transactions).
Delaware Franchise Tax — Gross Assets Method May Reduce Tax Liability
Low
Meridian currently uses the authorized shares method for Delaware franchise tax, resulting in annual taxes of ~$200K. Under the gross assets alternative calculation method, estimated taxes would be approximately $45K–$65K annually — a $135K–$155K annual savings. This is a tax optimization opportunity, not a risk.
🗂 Docs reviewed: 22 / 22
Findings: 4
2 Med
2 Low
No Formal Emissions Tracking — 4 Enterprise Customers Have Scope 3 Reporting Requirements
Medium
Meridian has no formal GHG emissions tracking program. Four enterprise customers — part of SEC-registered companies or EU-domiciled entities subject to CSRD — have contractual requirements for vendor Scope 3 emissions data (Meridian would be a Scope 3 Category 1 supplier). Inability to provide emissions data within 12 months could trigger contract review rights under two of these agreements.
Board Lacks Gender Diversity — 1 Woman of 7 Board Members
Medium
Meridian's board consists of 6 men and 1 woman (14% female). California AB 979 requires at least 2 women on boards of public companies headquartered in California; while Meridian is private, LP-level ESG reporting requirements at two of the firm's LPs require portfolio companies to demonstrate gender diversity progress. No board diversity targets or recruiting pipeline is documented.
No Documented Supplier Code of Conduct
Low
Meridian does not have a formal supplier code of conduct. Given that 3 enterprise customers include supplier ESG requirements in their procurement policies, this absence could become a contract renewal issue in the next procurement cycle. The company has 34 active vendor relationships.
Carbon Offset Program Referenced in Marketing Not Yet Formalized
Low
Meridian's website and sales materials state the company is "committed to carbon neutrality by 2028." No formal carbon offset program, verified carbon credits, or roadmap exists to support this claim. Two enterprise customers in regulated industries have flagged this discrepancy as a potential greenwashing concern.
⚡ This is what PlausityOS delivers
Run your own DD in hours, not weeks.
Upload your data room. PlausityOS reads every document, runs all 7 workstreams simultaneously, and delivers a report like this — with zero analyst hours.
Early access pricing. Lock in $499/mo before we go to market pricing. Cancel anytime.