Clear information.
Accountable access.
Meridian is a public website with private freight workspaces for a fictional enterprise demonstration by BH Software Productions. Use fictional information only. This page describes the controls built for this application and their limits.
What we collect
Your verified Site user identifier and display name support access to your workspace. Shipment references, locations, commodities, weights, deadlines, carrier reviews, events, fictional receiver names, customer drafts and audit history are saved to Cloudflare D1. Generated fictional delivery receipts are kept in private R2 object storage. We do not request payment information, mailbox passwords or real driver location feeds.
Who can see records
The public website is open to visitors. Sites manages account sign-in; the application enforces private workspace authorization. The server checks workspace membership and shipment client ownership on records, search, exports and files. Managers approve awards and control automation; dispatchers manage execution; finance prepares billing; customers can submit intake and read their client’s records and approved updates. Role previews only reduce a verified owner’s permissions. No browser-provided role grants additional access.
Transport, storage and files
Hosted traffic uses HTTPS. Cloudflare documents automatic encryption at rest for D1 and R2 using provider-managed keys. These are documented hosting protections, not independently audited by this project. The backend can read records: this is not end-to-end encryption. Receipt files are generated as plain text, not executable uploads. There is no file upload or malware scanner. The production Worker supplies a content security policy, restrictive permissions, no-sniff protection and private/no-store responses for operations and APIs.
Contextual guide and voice
The Meridian guide uses deterministic rules and does not make paid AI calls. Its suggestions use the current page and an authorized summary of the selected record. Conversation text is kept in this browser tab; clear it with Clear conversation. Microphone dictation starts only when selected and requires supported browser speech recognition and permission. Browser speech services may process audio under their own policies. Stop retains a transcript for review; Cancel discards the active dictation result. Send is a separate action. No automatic recording or external audio storage is implemented.
AI and speech availability
Premium reasoning targets OpenAI gpt-6-astra, with a versioned logistics playbook and authorized saved record summaries. OpenAI gpt-transcribe is the selected transcription target. Premium reasoning is restricted to authorized private operators with a dedicated reservation covering two migration slots. One real request ended with an unknown provider outcome; no draft or usage receipt was confirmed. Its reservation remains held and reasoning is disabled pending reconciliation. It uses GPT-6 Astra, low reasoning effort, 1024 total output/reasoning tokens, a 20-second timeout and no retry. OpenAI transcription is configured as a disabled plan pending its capture and quota implementation. The previous cheaper-model route is disabled. The free guide uses deterministic rules. Eric — Smooth, Trustworthy is the authorized ElevenLabs voice. The existing catalog preview is distinct from live application synthesis. Protected speech transport is prepared with private audio caching, explicit playback, one lifetime slot capped at 80 characters, one concurrent request, bounded text/audio, retained unknown outcomes and no retries, with verified secure credentials, premade voice access and reserved cost. Its single live attempt failed with no playable audio; the slot remains consumed and synthesis is disabled. The exact upstream cause is unverified; no retry is attempted. No voice is cloned and no subscription is purchased.
Public fictional demonstration
The /demo experience needs no account. An explicit Start creates an isolated synthetic namespace with a server-verified HttpOnly session cookie. Its role selector applies only within that namespace and grants no private-workspace access. Sessions expire after 24 hours; each allows five shipments and 200 saved operations. At most 100 sessions are active; new sessions are bounded per connection/day. Expired demo namespaces are cleaned in bounded batches. Demo receipts remain synthetic D1-derived text. Paid AI, membership, provider execution and real-workspace queries are blocked.
Workflow checks and business readiness
Customer requests and appointment updates trigger deterministic follow-up checks as part of the saved record, unless the owner pauses automation. A manual check can reconcile the queue later. Stable task keys prevent duplicates. No timed background scheduler, external appointment booking or carrier notification runs. New carrier awards require a current owner-recorded synthetic authority, insurance and identity review. These fictional reviews are not real FMCSA or insurer lookups. Finance packets snapshot approved charges and delivery evidence; they are not statutory broker transaction records, issued invoices or reconciled payments.
Search and calendars
Search queries persisted records within your authorized workspace and client scope. Status and UTC deadline-date filters apply on the server. Calendar entries come from saved dispatch reviews and delivery deadlines; displayed times use America/Denver. They are internal operational proposals, not confirmed external calendar appointments.
Communications and integrations
Carrier offers, carrier events and customer delivery adapters are simulated. Customer portal publication is real within the authorized customer portal; no email or SMS is sent. Email, Google Calendar and Twilio adapters are disabled and unconnected. Deterministic fixture jobs exercise approval, failure, retry, acceptance and separate receipt states. Carrier fixture verification uses a documented Meridian-specific HMAC protocol; it does not establish live carrier or Twilio connectivity. External provider setup, official signature SDKs, OAuth scopes, account mappings and separate authorization are required before live use. Clerk account entry, server verification, explicit owner identity linking and reviewed nonowner enrollment are implemented for development acceptance. Existing Sites access remains available. Live sign-in, migration and revocation acceptance are not yet verified; production domain/DNS/OAuth prerequisites remain separate.
Owner controls, exports and recovery
The owner can pause/resume automation, correct deadlines and unpublished customer drafts, reconcile failed jobs, inspect shipment and control audit histories, and export workspace records as JSON. Records remain until an owner arranges removal through the hosting administrator; no self-service deletion or restore feature is connected. Exports omit runtime secrets and do not constitute a tested full database-and-file backup. No automatic retention purge, restore guarantee or verified disaster recovery exists.
Logs and reporting
Application error logs contain error classes rather than request bodies or secrets. Hosting may retain its own request metadata under its policies. Report an issue by saving an owner issue note in Owner controls, then contact the real project owner through your existing channel. The note remains in this workspace; it does not notify a fictional security team. No compliance certification, penetration test, MFA policy or independent security audit is claimed.
Hosting references: D1 data security · R2 data security