Mercur

Security behind Mercur

Open code, your infrastructure, zero GMV fees.
A standard, auditable stack you can read, run, and host yourself.

Contact UsRead the code on GitHub
mercur · terminal

git clone github.com/mercurjs/mercur

Cloning into 'mercur'...

cat SECURITY.md

Report privately · safe harbor · coordinated disclosure

secret-scanning ✓ Dependabot ✓ CodeQL ✓

bun run dev# your infra

api :9000 · admin /dashboard · vendor /seller

A standard stack you can audit

Mercur is a set of composable modules and plugins on a runtime your team already knows: Node.js, PostgreSQL, Redis. No proprietary platform, no black box, no niche specialists.

API-first

A REST API across admin, vendor, and storefront scopes, with a typed client.

Event-driven

Workflows with compensation and rollback, links between modules, subscribers for events.

Headless and modular

Mercur installs over Medusa v2 as a plugin, not a fork – your storefront stays yours.

Open

Any web developer can read it, run it, and extend it.

Clients
StorefrontAdminVendor3rd-party
API · 3 scopes
/admin/vendor/store
Mercur modules
VendorCommissionPayoutBuyBox
Medusa v2
runtime · workflows · modules
Data
PostgreSQLRedis

Everything a security review asks for

Nothing hidden. Read it in order, or jump to what you need – each topic shows what is open today and what Enterprise adds.

Deployment & Ownership

Open source

  • Self-host on any cloud or on-premise
  • Full code ownership, MIT-licensed – no lock-in
  • An exit door in the offer – keep the version you paid for
  • Data residency is your decision, not a negotiation

Enterprise — everything in Open Source, plus:

  • On-prem or Kubernetes reference architecture, set up with your team
  • Managed deployment and environment setup, from staging to production
  • Guided upgrades with a security-patch commitment
  • A deployment runbook and handover, so it runs with or without us

Data & Residency

Open source

  • Your database stays on your infrastructure
  • EU residency when you run it there

Enterprise — everything in Open Source, plus:

  • GDPR tooling – DSAR, right-to-be-forgotten, consent, and retention
  • Personal data kept architecturally separate from immutable records

Access & Encryption

Open source

  • Authentication with HTTP-only sessions
  • Per-vendor data isolation – each vendor sees only their own data
  • TLS in transit at your deployment layer
  • Security controls you can audit in the public repo

Enterprise — everything in Open Source, plus:

  • SSO over OIDC (Azure AD, Okta, Keycloak), with MFA
  • Granular role-based access, business scopes, and a read-only auditor role
  • Field-level encryption for sensitive columns
  • An immutable audit trail with login history – and a log of every data export

Compliance

Open source

  • GDPR and a data processing agreement
  • ISO 27001 controls by design
  • Controls live in a public repo you can read before you sign

Enterprise — everything in Open Source, plus:

  • Omnibus price history and period-correct tax, where EU law requires it
  • GPSR and energy-label fields for regulated catalogs
  • DAC7 marketplace reporting, with VAT, OSS, and IOSS
  • GDPR retention, DSAR, and right-to-be-forgotten tooling
  • ISO 27001 controls, evidenced for your audit

Continuity

Open source

  • Open source means the engine outlives any one vendor
  • Any web team can run it
  • Keep the code and everything built on it – no exit fees

Enterprise — everything in Open Source, plus:

  • A patch commitment for security issues
  • Uptime and disaster-recovery targets as contractual commitments, backed by a high-availability architecture

Integration

Open source

  • A typed API across three scopes, with events and webhooks
  • Provider-agnostic sockets – payouts, search, notifications – swap by configuration

Enterprise — everything in Open Source, plus:

  • Connectors to ERP, PIM, OMS, and storefront platforms, fitted per deployment

Inspect it yourself

Because the code is open, you can check our security yourself.

A documented disclosure policy

Safe harbor and a private reporting channel, published in the repo.

Automated scanning

Dependency, secret, and code scanning run on the repository.

SECURITY.md

# Security Policy

Report privately to security@mercurjs.com.

Safe harbor for good-faith research.

Coordinated disclosure – no public report before a fix ships.

Secret scanningDependabotCodeQL
GitHub

An MCP server and a typed API let your coding tools work against the real code
on your data and your infrastructure, not a vendor's cloud

Verify it yourself

Read the code, run the stack, then talk to us about putting it in production.

Contact UsRead the code on GitHub