Commerce infrastructure that adapts to your operating model
Mercemur Enterprise supports dedicated environments, regional deployment requirements, custom capacity, enterprise integrations and deployment architectures aligned to your organization's security and infrastructure requirements. Work with our engineering team to define the right topology for your commerce workload rather than fitting your business into a fixed infrastructure model.
Built for enterprise review
Security
Encryption, penetration testing, vulnerability disclosure, access controls.
Identity
SSO through SAML 2.0 and OIDC, RBAC, MFA, scoped credentials.
Architecture
Dedicated environments, regional deployment, tenant isolation.
Reliability
Continuous health checks, backups, incident response, live status.
Data
DPA, sub-processors, residency, export and deletion.
Development
Versioned API, mandatory idempotency, signed webhooks, audit logs.
Procurement
Security questionnaire, architecture overview, DPA and pen-test summary under NDA.
Request Enterprise Documentation — DPA template, security questionnaire response and architecture overview, most under NDA.
Deployment flexibility
One commerce model, three ways to run it. The commerce APIs, data model and permission system are the same in every case.
Managed Mercemur
Standard managed deployment, optimized for the majority of merchants and fully operated by Mercemur. Infrastructure, updates and operations are ours to run.
Dedicated Mercemur
Single-tenant application and data infrastructure with dedicated resource allocation, for organizations requiring stronger workload isolation, predictable capacity or specific operational controls.
Enterprise architecture
For organizations with specific requirements around workload isolation, residency, capacity, network architecture, integrations or existing infrastructure standards, Mercemur can scope an appropriate deployment architecture during technical discovery.
Availability of a specific topology depends on workload, region, security requirements and commercial scope.
Logical architecture
Channels above can change. Infrastructure underneath can change. External systems around it can change. The commerce control plane stays stable.
Note what is not a layer here: there is no app marketplace between a merchant and the operation of their business.
Channels
Web, mobile, social, AI clients, internal tools
Mercemur commerce control plane
Catalog, pricing, customers, orders, inventory, promotions, checkout, content, identity, workflow
Control surfaces
Admin, REST, MCP, CLI, webhooks
Integrations
Payments, ERP, CRM, WMS, logistics, messaging, identity
Infrastructure
Managed, dedicated, or scoped to enterprise requirements
Tenant boundary
Every record, query and request is scoped to one tenant.
Regional boundary
Processing locations are fixed by the agreed deployment.
Enterprise integration boundary
Where your systems meet the commerce model.
Tenancy and isolation
The standard service is a managed multi-tenant architecture with isolation enforced at the application and data layers. Dedicated deployments are available where stronger workload isolation is required.
Storage layer scoping
Every record carries the tenant identifier
Query filtering
Every database query is scoped to the active tenant
Row-level security
Policies on every multi-tenant table, with tenant-stamping triggers
Application-layer checks
The application enforces tenant scope on every request
Per-tenant encryption keys
Sensitive data uses tenant-scoped encryption where applicable
Privileged cross-tenant operations are narrowly scoped, explicitly implemented and audited. The Trust Center documents where they occur.
Regions and data residency
Standard service
The standard processing locations and the sub-processors that support them are published. See the Trust Center and the sub-processor list.
Enterprise deployment
Enterprise deployments may have deployment-specific residency, infrastructure and sub-processor requirements. Applicable architecture and processing details are documented during technical review and reflected in the relevant contractual and data-processing documentation.
Identity and access
Identity is a system, not a scattering of settings. Human access, machine access and the record of what either did are governed together.
Built to be operated, not merely deployed
Service level commitments are set in the applicable agreement. View live platform status.
Integration with what you already run
Mercemur is designed to integrate with existing systems rather than require an all-at-once replacement. Enterprise deployments are designed around the systems you keep.
ERP
CRM
WMS
PIM
Payments
Tax engines
Identity providers
Internal systems
Native integrations where they make sense, REST and webhooks for everything else, and enterprise integration work for the unusual cases. See integrations.
Capacity
Standard limits protect platform stability. Enterprise deployments can be reviewed for workload-specific capacity requirements and negotiated throughput where appropriate.
Security
Encryption
Sensitive data encrypted at rest, with tenant-scoped keys where applicable. Transport encryption throughout.
Secrets and credentials
API credentials are hashed at rest and shown once. Provider credentials are encrypted and scoped per merchant.
Isolation
Row-level security, tenant-stamping triggers and application-layer checks on every request.
Access controls
Named accounts, role-based access, quarterly access reviews and comprehensive audit logging.
Encryption, key management, penetration testing, vulnerability disclosure and sub-processor practices are documented in the Trust Center.
AI that can act, not AI with unrestricted access
Exposing commerce to an autonomous agent is only useful if the agent cannot do damage that is hard to undo. The controls below are the same ones that govern any other client.
- Observe
- Draft
- Validate
- Preview
- Approve
- Publish
- Audit
- Restore
Scoped authority
An agent holds the same granular permission scopes as any other API client. It can do what it was granted and nothing else.
Draft, not live
Storefront changes are authored as drafts. Published state is separate and unaffected until publish is called.
Preview before publish
The draft renders exactly what a shopper would see, so a change is reviewed as output rather than as code.
Diff before publish
A diff shows precisely what would change on the live storefront before anything is made visible.
Reversible
Revisions are retained and can be restored, so a bad change is undone rather than repaired.
No silent overwrites
Expected-version checks stop an agent publishing over an edit somebody else made in the meantime.
Safe retries
Every API write requires an idempotency key, so a network retry cannot duplicate state.
Designed for failure
Commerce integrations operate across unreliable networks. Mercemur makes idempotency mandatory on every API write, so clients can safely retry operations without creating duplicate state. Timeouts and replays are defined behaviour rather than an open question.
Reliable event-driven integration
Webhooks are HMAC-signed with a timestamp window so a replayed body is rejected. Delivery history is queryable, redelivery is idempotent, and a handler that was down can be replayed rather than reconciled by hand. These systems should all be able to consume commerce events reliably:
Migration
A large migration is a sequence with checkpoints, not an event. Each step is validated before the next begins, and the rollback window stays open after cutover.
Discovery
Architecture
Import and validation
Storefront parity
Integration validation
Controlled cutover
Monitoring
Rollback window
Deployment timelines depend on migration complexity, integration requirements, security review and deployment architecture.
Stable integration surface
REST APIs are explicitly versioned. Breaking removals require a major API version, while additive development continues within the current version. Integrations built against the current version keep working as the platform develops.
Audit logs
A real record of writes, on every plan rather than as an enterprise upcharge.
Who
The acting identity, whether a user, an API credential or a system process.
What changed
The resource involved and the write that was applied to it.
When
Timestamped against the record, not reconstructed afterwards.
Immutable history
Append-only tables, with object versioning for audit data.
Retention
On every plan, with extended retention on Enterprise and 7 years under legal hold.
Exportable
Queryable and exportable, and retained through account termination where a regulatory hold applies.
Your commerce data remains portable
Entering a platform is easy to promise. Leaving one is the part worth documenting. Export tooling in the admin and the Export API cover the same ground, in machine-readable JSON.
On termination there is a 90-day window to export all data, and we provide assistance for portability migrations to alternate providers. Retention and deletion behaviour is documented in the Trust Center.
Your commerce stack should remain yours
Each of these is a relationship a platform can take from you. None of them is taken here. That is a structural distinction rather than a pricing one.
Your payment relationship
Supported providers settle funds directly to you. Mercemur never holds the money and charges no platform transaction fee.
Your storefront code
Storefront files live in version control, edited locally and published on your schedule.
Your commerce data
Export tooling and the Export API cover catalog, customers, orders and configuration in machine-readable JSON.
Your integrations
Credentials are per-merchant and yours. Anything not built in is reachable through the public API.
Your infrastructure requirements
At enterprise scale the deployment is scoped around your requirements rather than a fixed model.
Shared responsibility
Responsibilities shift with the deployment model. This is the standard division; the applicable split for a dedicated or scoped deployment is confirmed during technical review.
| Responsibility | Owner |
|---|---|
| Commerce application security | Mercemur |
| Infrastructure patching | Mercemur, varying by deployment model |
| Staff access configuration | Merchant |
| API credential management | Shared: platform controls, merchant operation |
| Customer account policies | Shared: platform controls, merchant configuration |
| Cardholder data | Payment provider |
| Integration security | Shared: platform controls, merchant implementation |
| Store content and data legality | Merchant |
| Backups | Mercemur, with merchant exports available |
| Custom enterprise integration | Shared |
What Mercemur does not do
Constraints make an architecture easier to reason about than claims do.
Mercemur is the commerce system that coordinates these systems through APIs, events and integrations.
Direct engineering support
Enterprise engagements are scoped with the engineers who operate the platform, not handed to a script. Architecture review, integration design and migration planning happen with the team that builds the commerce core.
Security questionnaires, a DPA template, a CAIQ response and an architecture overview are available on request, most under NDA. Start that from the Trust Center.
Frequently asked questions
Review your commerce architecture
Bring your existing commerce stack, infrastructure requirements and integration map. We will evaluate how Mercemur would fit, what can remain unchanged and what a migration would require.