--- title: "Multi-tenant commerce platform with custom domains - Mercemur" description: "Run isolated stores on one platform. Custom domains, team roles, and Mercemur consumption billing with metered usage and overage invoices." canonical_url: "https://mercemur.com/platform" last_updated: "2026-09-15" --- # Built for multi-tenant commerce from the foundation up Real tenant isolation, custom domains, scoped team roles, and transparent metered billing. Run one store, run twenty. Multi-tenant is a feature most platforms claim but few actually deliver. They call it multi-tenant, but every store shares the same database tables and the application code decides whether to filter by tenant. One bug in a filter and your data is everyone's data. One slow query on one merchant's catalog and every merchant's storefront slows down. Mercemur is multi-tenant from the database row up. Tenant isolation is enforced at the storage layer, not just in application code that could be bypassed. Every store has its own data scope, its own custom domain, its own team configuration, and its own billing relationship with the platform. You run one store, you run twenty, the platform treats each as a real tenant with real boundaries. The platform behaves the same way whether you have one tenant or a thousand. The boundaries do not bend for convenience. ## The commerce core One model underneath everything else. Every surface reads and writes the same records, under the same permission system, so a change made in the admin, through the API, by an agent or from the CLI produces the same state. Catalog Pricing Customers Orders Inventory Promotions Checkout Content Identity Workflow ## Tenant isolation Stores cannot see each other's data. Tenant boundaries are enforced at the storage layer with multiple layers of defense: ### Storage layer scoping Every record carries the tenant identifier ### Query filtering Every database query is scoped to the active tenant ### Storage policies Row-level security policies on every multi-tenant table ### Application-layer checks The application enforces tenant scope on every request ### Per-tenant encryption keys Sensitive data uses tenant-scoped encryption where applicable Tenant isolation is enforced at the database layer through row-level security and application controls. Privileged cross-tenant operations are narrowly scoped, explicitly implemented and audited. Auditors get clear documentation. Compliance teams get clear evidence. ## Extensibility Extensions exist, and Mercemur connects to plenty of them. The difference is that Mercemur does not require an extension marketplace to make the core platform useful. Four routes out, all against the same commerce core: ### Native integrations Payments, shipping, email and analytics providers, maintained as part of the platform. ### REST and webhooks A versioned API over the same commerce core, with signed events for everything that happens. ### MCP Agent-driven workflows against the same model and the same permission scopes. ### Enterprise integration Scoped work for the requirements that do not fit any of the above. ## Custom domains Every store can map a custom domain. ### What you get: Map a domain you own (yourstore.com) to your Mercemur storefront Automatic SSL certificate provisioning Automatic SSL renewal Use a subdomain of your domain (shop.yourstore.com) Apex domain support (yourstore.com without the www) Multi-store, multi-domain (run several stores, each on its own domain, in one operation) ### How it works: 1 Add the domain in the admin 2 Mercemur provides DNS configuration 3 You add the DNS records at your registrar 4 SSL provisions automatically once DNS resolves 5 The storefront is live on the custom domain ## Platform reliability High availability infrastructure Automated backups Disaster recovery procedures Storefront caching that survives most upstream incidents Monitoring on every critical path ## Security as a feature Security is not an Enterprise upcharge. The baseline includes: Tenant isolation at the storage layer : enforced by the database, not just application code Encryption at rest : sensitive data is encrypted Encryption in transit : every connection uses HTTPS / TLS Strong webhook signing : merchant webhooks are signed and replay-protected SSRF protection on outbound : the platform blocks attempts to target internal networks Per-merchant credential isolation : payment provider keys, email provider domains, shipping accounts all isolate per tenant Audit logs : on every plan ### Enterprise plans add: Security review documentation Compliance attestation SSO (SAML, OIDC) Single-tenant deployment options Advanced audit log retention ## Team roles and permissions Invite teammates with scoped roles and permissions. Roles available out of the box: ### Owner Full access, including billing and team management ### Admin Full operational access, no billing or team management ### Staff Day-to-day store operations (orders, products, customers) ### Fulfillment Warehouse and shipping operations only ### Customer support Customer accounts, orders, and returns ### Marketing Campaigns, content, blog, analytics ### Custom roles On Enterprise, define your own permission scopes Each role has its own scoped permissions. A Staff member cannot delete the store. A Fulfillment member cannot edit product prices. A Customer Support member cannot run a campaign. The boundaries are real. ## Audit logs The admin logs who did what: Order changes Product edits Price updates Customer-facing changes (storefront publish, theme update) Role and permission changes Login attempts Audit logs are available on all plans, scoped to admin actions. Enterprise plans add extended retention and exportability. ## Mercemur consumption billing Three tiers (Free, Growth, Enterprise), metered on storage, email, and API usage rather than on orders. ### Metered event types: Email sends: Transactional and marketing, per recipient Storage uploads: Per byte stored API calls: Per request to the developer API ### Nothing taken at payment time Mercemur takes no transaction fee. Stripe, Razorpay, and Adyen settle through your own provider accounts; Dodo acts as merchant of record and remits according to its own terms. Mercemur never holds the funds, and your subscription is billed separately, monthly, so nothing is skimmed per order. ### Real-time usage tracking Usage events are recorded as they happen. The admin dashboard shows current period spend with a forecast of where you will land. Overage invoices generate automatically when usage exceeds plan inclusions. ## Multi-store under one billing relationship Multi-store operations get a unified billing relationship: One billing account Multiple stores, each with its own isolated data Usage rolled up across all stores Single invoice (or per-store invoicing on request) Volume discounts applied at the operation level ### Useful for: Multi-brand operators Agencies running stores for clients Holding companies with multiple ecommerce subsidiaries Operations with regional storefronts (US store + EU store + India store) ## How it works 1 Sign up. Free to start, multi-store unlocks on Enterprise. 2 Create your first store. Pick a name, a default region, a default currency. 3 Map a custom domain. SSL provisions automatically. 4 Invite teammates. Assign roles (Owner, Admin, Staff, Fulfillment, Customer Support, Marketing). 5 Configure billing. Real-time usage tracking is on by default. 6 Scale. Add more stores under the same billing relationship as needed. 7 Audit. Audit logs are on by default, viewable from the admin. ## Built for agencies Agencies running ecommerce for clients get: One agency account, many client stores : each client is a tenant Per-client roles : an agency operator can be admin on Client A and staff on Client B Clean client-facing branding : the storefront and admin can be white-labeled (on Enterprise) Unified billing or per-client billing : configure how you bill your clients vs how you pay Mercemur Migration tools : import a client's catalog from Shopify, or bring any other platform's data in through the admin API ## Built for multi-brand operators If you run several brands under one parent company: Each brand gets its own storefront, its own custom domain, its own theme, its own catalog, its own team All managed from one billing relationship Customers buying across brands have separate customer accounts (or SSO on Enterprise) Volume discounts apply at the operation level ### Common structures: Two brands, two storefronts. A premium brand and a value brand under the same parent. Regional brands. A US brand, an EU brand, an India brand, each with their own catalog and content. Vertical brands. Apparel brand, accessory brand, home brand under one operation. ## Use cases ### Multi-brand operator Three brands, three storefronts, three custom domains, one billing relationship. Each brand has its own team. Reports roll up at the operation level. ### Agency One agency account, ten client storefronts. Each client gets their own admin scope. The agency operator has access to all clients, the client gets scoped access to their own store. ### International expansion A single brand running three regional storefronts (US, EU, India). Each region has its own catalog, its own currency, its own tax rules, its own customer accounts. Customers in each region see only their local storefront. ### Holding company Multiple ecommerce subsidiaries under one billing umbrella. Each subsidiary is operated independently. Centralized usage reporting at the holding company level. ### B2B operator A wholesale storefront for trade partners (authenticated, customer-group-gated) and a public DTC storefront for retail. Two stores, one operation. ## Frequently asked questions Can stores see each other's data? No. Tenant isolation is enforced at the database layer through row-level security and tenant-stamping triggers, backed by application-layer checks on every request. Do I get a custom domain? Yes. Every store can map a custom domain with automatic SSL. How do team permissions work? Invite teammates with scoped roles. Each role has its own permissions. Custom roles available on Enterprise. What counts as a metered event? Email sends, storage, and API requests. The AI sales agent runs on your own model provider key (BYOK). Orders are never metered, so what you sell does not change what you pay. Can I run multiple stores under one account? Multi-store and multi-tenant features unlock on Enterprise. Do you support SSO? On Enterprise plans, yes. SAML and OIDC. Are audit logs available? Yes on all plans, scoped to admin actions. Enterprise adds extended retention. Can I white-label the admin for clients? On Enterprise plans, yes. How does multi-region work? Each region has its own currency, its own tax rules, its own shipping zones. Customers see prices in their region's currency. Can each brand have its own custom domain? Yes. Every store has its own custom domain. Are usage metrics visible per store? Yes. The admin breaks usage down per store on multi-store operations. Can I invite teammates with different roles per store? Yes. An agency operator can be Admin on Client A and Staff on Client B. What happens if a teammate leaves? Revoke access from the admin. Audit logs show who did what before they left. Can I export audit logs? Yes through the admin API. Is data backed up? Yes. Automated backups with disaster recovery procedures. What is the platform uptime? Service level commitments are set in the applicable agreement. Enterprise agreements can carry a negotiated availability commitment. Live status is published at status.mercemur.com. Can I get a single-tenant deployment? On Enterprise plans, yes. Do you offer regional data residency? Available on Enterprise plans for specific regions. Is there a platform fee on each order? No. Mercemur takes no transaction fee. Stripe, Razorpay, and Adyen settle through your own provider accounts; Dodo acts as merchant of record and remits according to its own terms. The plan is billed as a monthly subscription plus metered storage, email, and API usage, none of which is tied to order value. ## Best practices for multi-store operations ### Plan tenant structure before launch A "tenant" is a real boundary. Customers, orders, products, and data are all tenant-scoped. Decide at the start: one tenant per brand, one tenant per region, one tenant per client. Migration between tenants is supported but harder than getting it right at the start. ### Use the same admin operators across tenants when possible Multi-store operators can grant the same operator access to multiple stores. The operator switches between stores in the admin without separate logins. ### Configure per-tenant branding consistently Each tenant has its own colors, logo, sender domain, payment provider connections. Document the per-tenant configuration so onboarding new operators is fast. ### Set up audit logs and review them Audit logs exist on every plan. Reviewing them periodically catches issues before they become incidents. ### Plan for the second tenant before you need it Even if you launch with one store, design your workflows so adding a second store is easy. Reuse-friendly content templates, shared catalog templates, consistent role definitions. ## Multi-store scenarios ### Two brands, two stores A premium brand and a value brand under one parent. Each has its own storefront, its own customer base, its own marketing voice. Customers in each brand do not see the other. ### Three regional stores A US storefront, an EU storefront, an India storefront. Each in the right currency, with the right payment methods, with the right tax handling. Customers shop their local store. ### Agency with ten clients The agency runs ten client storefronts. Each client has isolated data. Agency operators access all ten through the admin. Each client has staff-level access to their own store only. ### B2B operator with two storefronts A public DTC store and an authenticated wholesale store. Different storefronts, different price lists, different shipping options. Customers in each segment see their own catalog. ## Quick reference Multi-tenant isolation at the storage layer. Custom domain with automatic SSL on every store. Team roles: Owner, Admin, Staff, Fulfillment, Customer Support, Marketing, custom roles on Enterprise. Three billing tiers: Free, Growth, Enterprise. Three metered dimensions: storage, email sends, API requests. Orders are never metered. Real-time usage tracking with bill forecast. Overage invoices generated automatically. Audit logs on every plan. ## Get started Step 1: Sign up for Mercemur (Free or Growth). Step 2: Create your first store. Step 3: Map a custom domain. Step 4: Invite teammates with scoped roles. Step 5: Configure billing preferences. Step 6: Set up audit logging review. Step 7: Add additional stores as the operation grows. ## Related ### [Commerce](https://mercemur.com/commerce) Catalog, cart, checkout, and order management. ### [Integrations](https://mercemur.com/integrations) Connect the tools you already run on. ### [Storefront builder](https://mercemur.com/storefront-builder) Build and theme the shop your customers see. Run your store on multi-tenant infrastructure ## Start with one store, scale to twenty. Start fast, compare plans, or talk through the details with us. [Talk to sales](https://mercemur.com/contact) [See pricing](https://mercemur.com/pricing) [Start free](https://mercemur.com/signup) ## Sitemap - [Site index (llms.txt)](https://mercemur.com/llms.txt): every public page, described - [Sitemap (sitemap.md)](https://mercemur.com/sitemap.md): every public URL with its last-modified date - [AGENTS.md](https://mercemur.com/AGENTS.md): how to build against the platform - [Developer documentation](https://docs.mercemur.com/llms.txt): API reference, CLI, MCP