--- title: "Trust Center, Mercemur" description: "Mercemur's security and compliance posture: certifications, encryption, access control, monitoring, backup, and our sub-processor program." canonical_url: "https://mercemur.com/trust" last_updated: "2026-09-15" --- Trust Center # Security and compliance How Mercemur protects merchant and customer data. GDPR and India DPDP-compliant processing. Transparent sub-processor and incident program. 1. [Home](https://mercemur.com/) 3. Trust Center Last updated: August 27, 2026 On this page 1. [Compliance and certifications](https://mercemur.com/trust#compliance) 2. [Data residency](https://mercemur.com/trust#residency) 3. [Encryption](https://mercemur.com/trust#encryption) 4. [Access control](https://mercemur.com/trust#access) 5. [Logging and monitoring](https://mercemur.com/trust#monitoring) 6. [Backup and disaster recovery](https://mercemur.com/trust#backup) 7. [Sub-processors](https://mercemur.com/trust#subprocessors) 8. [Penetration testing](https://mercemur.com/trust#pentest) 9. [Vulnerability disclosure](https://mercemur.com/trust#vdp) 10. [Privacy commitments](https://mercemur.com/trust#privacy) 11. [Request documentation](https://mercemur.com/trust#docs) 12. [Security FAQ](https://mercemur.com/trust#faq) 13. [Security contact](https://mercemur.com/trust#contact) ## Compliance and certifications - **GDPR:** processor commitments under our Data Processing Addendum, EU SCCs in place for non-EEA transfers. - **India DPDP Act:** processor commitments, 14-day internal response target for data principal requests. - **ISO 27001:** planned for 2027. - **Penetration test summary letter:** available under NDA on request. ## Data residency - Primary processing in the EEA: Wasabi Frankfurt, OVH France. - US replication is for disaster recovery only (Wasabi us-east-1). - Full list at [mercemur.com/legal/subprocessors](https://mercemur.com/legal/subprocessors). ## Encryption - TLS 1.2 and higher in transit. - AES-256 at rest. - Application-level AES-256-GCM for license keys and per-tenant payment credentials. - Wasabi server-side encryption for object storage. - Postgres plus LUKS disk encryption at the host layer. ## Access control - MFA enforced on all admin accounts. WebAuthn primary, TOTP fallback, SMS prohibited. - Per-tenant Row-Level Security enforced at the database layer. - Role-based access control with a documented access matrix. ## Logging and monitoring - 24/7 alerting via PagerDuty. - SIEM detection rules covering cross-tenant access patterns, credential anomalies, and exfiltration heuristics. - Public status page at [status.mercemur.com](https://status.mercemur.com/). ## Backup and disaster recovery - Postgres backups every 5 minutes (WAL streaming) plus daily snapshots. - Append-only audit log tables. Wasabi object versioning for audit data. ## Sub-processors The full list, with locations and transfer bases, is published at [mercemur.com/legal/subprocessors](https://mercemur.com/legal/subprocessors). You can subscribe to 30-day-advance email notifications for additions or replacements from that page. ## Penetration testing - External penetration testing against OWASP ASVS, plus focused tests on the payment and cryptography subsystems. - Additional testing on major changes. - Summary letter available on request under NDA. ## Vulnerability disclosure Coordinated disclosure program at [mercemur.com/security/policy](https://mercemur.com/security/policy). Our security.txt is published per RFC 9116 at [/.well-known/security.txt](https://mercemur.com/.well-known/security.txt). PGP-encrypted [support@mercemur.com](mailto:support@mercemur.com) preferred. Response SLAs are published on the policy page. ## Privacy commitments - [Privacy Policy](https://mercemur.com/legal/privacy) - [Cookie Policy](https://mercemur.com/legal/cookies) - DSAR submissions via [support@mercemur.com](mailto:support@mercemur.com) or the in-app Privacy form. - 30-day GDPR response target, 14-day DPDP internal target. ## Request documentation The following documents are available on request, most under NDA: DPA template, security questionnaire response (CAIQ), and architecture overview. NameCompanyWork emailWhich documents do you need? Compose request This opens your email client with the request filled in. If nothing happens, email [support@mercemur.com](mailto:support@mercemur.com?subject=Trust%20document%20request). ## Security FAQ Where is my data stored? Your account data and your store's operational data are stored primarily in our EEA region (OVH France for compute, Wasabi Frankfurt for object storage). A disaster-recovery replica exists in Wasabi US East. All transfers between regions are governed by EU Standard Contractual Clauses. See mercemur.com/legal/subprocessors for the full list. Who can access my data? Only a small group of named Mercemur personnel with documented business need. Production access is restricted to Engineering Lead, Senior Engineers, CTO, and Security Lead. Every access event is logged. Quarterly access reviews verify ongoing necessity. We do not contract out admin access to third parties. What happens to my data if I leave? On account termination you receive a 90-day window to export all data via our Export API. After 90 days, your data is anonymized (PII replaced with hashes) except where legal retention applies (tax records, audit logs under regulatory hold). Wasabi-stored files are deleted. How do you handle a breach? Our Incident Response Plan defines a 4-phase process: Detect, Contain, Eradicate, Recover. Sev0 customer-data exposure triggers customer notification within 24 hours. GDPR 72-hour regulator notification clock starts at confirmation. Post-mortem within 5 business days for Sev0 and Sev1. Do you sell my data? No. We never sell merchant or customer data. We never share it with third parties for marketing or advertising purposes. The only sharing is with sub-processors strictly necessary to deliver the service, and only under contractual DPA and SCC terms. Are you HIPAA-compliant? Not directly. Mercemur is not designed for PHI processing. If a merchant's use case involves health data, we can act as a Business Associate under a separate BAA on request; HIPAA processing requires explicit advance written agreement. Are you PCI compliant? Mercemur does not store, process, or transmit primary account numbers, CVV, or expiry dates. Card details are entered into payment fields controlled by the connected provider and go directly from your end-customer to Stripe, Razorpay, Dodo Payments, or Adyen, each of which maintains its own PCI DSS compliance. Mercemur keeps only the non-sensitive transaction metadata needed to display orders and issue refunds. The PCI scope and self-assessment questionnaire that apply to a given store depend on how its provider is connected; our current PCI position is available on request. How do you train staff? Security awareness training at onboarding for every employee and contractor, plus a Mercemur-specific session. Engineering staff receive role-specific training on row-level security, payment integration, cryptography, and SSRF. Do you do background checks? Yes for any role with production access. Pre-employment. Results restricted to HR Lead and Security Lead. How is multi-tenancy enforced? At the database layer via PostgreSQL Row-Level Security (RLS). Three layers of enforcement: RLS policies on every multi-tenant table, automatic tenant-stamping triggers, and 'triple-guard' hardening on tables exposed to webhook ingress. Cross-tenant queries occur in only three documented places (license validation, billing metering, support admin) and are audited. Can I export my data? Yes. The admin dashboard provides export tooling for product catalog, customer list, order history, and store configuration. Machine-readable JSON. Includes assistance for portability migrations to alternate providers. How often do you rotate encryption keys? Keys are rotated on a schedule and on demand. TLS certificates renew automatically. The license key encryption key is rotated as a planned migration, and rotation requires two key holders. Who has access to encryption keys? Production keys held by CTO and Security Lead only. The license key encryption key requires both for rotation. The sealed-secrets backup key requires two-officer presence (CTO and CEO). Hardware-backed where possible. How do you protect against insider threats? Named accounts only (no shared credentials), comprehensive audit logging, segregation of duties where team size allows plus compensating controls where not, quarterly access reviews, mandatory training, anonymous whistleblower channel, and a Code of Conduct with consequences scaling to termination and legal action. How can I report a vulnerability? Email support@mercemur.com with PGP-encrypted message preferred. Public reporting policy at mercemur.com/security/policy. We commit to 24-hour acknowledgment, coordinated disclosure timeline (90 days default, negotiable), and safe harbor for good-faith research. What is your uptime commitment? Service level commitments are set in the applicable agreement, and service credits follow the SLA schedule for missed targets. Enterprise agreements can carry a negotiated availability commitment. Live status is at status.mercemur.com. How do you handle data subject access requests? Email support@mercemur.com or submit via the in-app Privacy form. 30-day GDPR response target, 14-day DPDP internal target. Identity verification required. Are your sub-processors vetted? Yes. Six-axis risk scoring (attestations, financial stability, data location, breach history, support SLA, exit plan) at onboarding and annual review. Active sub-processors listed at mercemur.com/legal/subprocessors. We collect annual SOC 2 reports from all critical sub-processors. How long do you retain my data? Account and operational data are kept for the life of the relationship plus a 90-day export window, then anonymized except where legal retention applies. Backups roll on a fixed window. Exact periods are in the DPA. ## Security contact Email [support@mercemur.com](mailto:support@mercemur.com). PGP key at [/.well-known/pgp-key.txt](https://mercemur.com/.well-known/pgp-key.txt). Response SLAs in our [Vulnerability Disclosure Policy](https://mercemur.com/security/policy). ## Sitemap - [Site index (llms.txt)](https://mercemur.com/llms.txt): every public page, described - [Sitemap (sitemap.md)](https://mercemur.com/sitemap.md): every public URL with its last-modified date - [AGENTS.md](https://mercemur.com/AGENTS.md): how to build against the platform - [Developer documentation](https://docs.mercemur.com/llms.txt): API reference, CLI, MCP