Chidinma Eze
09:41Re: Order NS-2041 — can we add two units?
HighWe'd like to increase the order before it ships —
support@northstar.co · Ada Nwosu
Business operating system
One workspace.The whole company.
Mercestack is the operating system your business runs on — mailbox, customers, work, commerce, money and automation in a single workspace, sharing one customer record, one permission model and one audit trail. There is nothing to integrate, because nothing was ever separate.
Ivory & Oak
Customer · CRM
AN
Prospect
₦3.1m
12 open
Qualified
₦5.4m
8 open
Proposal
₦6.8m
5 open
Negotiation
₦3.1m
3 open
Customer
CE
Ivory & Oak
Chidinma Eze · chidinma@ivoryandoak.com
- Status
- Active
- Owner
- Ada Nwosu
- Customer since
- Mar 2026
- Lifetime value
- ₦6,900,000
Timeline
Everything linked to this record- MailboxRe: Order NS-2041 — can we add two units?Conversation · assigned to Ada Nwosu4m ago
- FinanceINV-0118 marked paid · ₦1,840,000Payment recorded via Paystack2m ago
- CommerceOrder NS-2041 · 12 × Alder side tableAwaiting fulfilment · Lagos warehouse3m ago
- SalesDeal won · Ivory & Oak — Q1 restockMoved from Proposal by Ada Nwosu1h ago
- WorkTask created · Confirm delivery windowCreated by Flow · due tomorrowjust now
A sample workspace. Every record, event name and action shown is one the product implements.
The argument
Nine tools that each know a ninth of your business.
Every integration you maintain exists to tell one system something another one already knew. Mercestack removes the question by keeping the business in one place to begin with.
- Chat app
- Shared inbox
- CRM
- Email marketing
- Online store
- Automation tool
- Payment provider
- Spreadsheets
- Internal tools
One workspace, one database, one set of rules.
Modules are surfaces onto the same business, not applications with their own copy of it.
One customer record
The person who emailed you, the deal they are in, the order they placed and the invoice they paid are one record — not four rows in four systems joined by an email address.
One permission model
Flat module.action permissions decide what a person may do. The same vocabulary constrains automations and AI agents, so delegating work never means widening access.
One audit trail
Business events, administrative changes, automation runs and agent actions land in one append-only history — attributable to whoever, or whatever, did them.
One session
The same window, all the way through.
Home
Northstar & Co.
AN
My open work
7
2 overdue
Open conversations
14
3 need an owner
Customers
268
4 marked at risk
Outstanding
₦4.2m
₦610k overdue
Focus queue
Open work- 01Approve the restock proposal for Ivory & OakPart of Q1 retail restockToday
- 02Fulfilment SLA — Warehouse handoverProcess owner: OperationsOverdue
- 03Read and acknowledge Returns & refundsStandard operating procedureSOP v4
- 043 open conversations have no ownerAssign them so customers know who is responsibleMailbox
Recent activity
Flow completed the automation Paid order handover
just nowAda Nwosu marked the invoice paid INV-0118
2m agoCheckout created the order NS-2041
3m agoAda Nwosu won Ivory & Oak — Q1 restock
1h ago
01 / 06 Workspace
It starts with the company, not the tool.
Departments, teams, processes with an owner and an SLA, and operating procedures people have actually acknowledged. Work hangs off that structure, so a task always has someone accountable and a process behind it.
- Structure, processes and SOPs
- Projects, tasks and personal queues
- A home page assembled from what your role can see
02 / 06 Customers
One record everything else points at.
A lead becomes a customer and keeps the link back. Deals move through a pipeline. The timeline is not a CRM note field — it is the conversations, orders, invoices and tasks that genuinely reference this record, gathered because they share it.
- Leads, contacts, deals and pipeline stages
- Every linked record on one timeline
- Ownership, status and history that survives handover
03 / 06 Mailbox
Email that already knows who is writing.
Shared addresses your team works from, on your own verified domain. An arriving message is matched to the customer it belongs to, assigned to a person, and answered with the order and invoice in the same view.
- Shared mailboxes with assignment and status
- Your domain, verified before a single send
- The customer, the deal and the invoice beside the thread
04 / 06 Operations
Order, payment, stock — one chain, not three exports.
A catalogue with variants and real stock levels. Checkout creates an order; the provider callback is verified server-side before anything is marked paid; fulfilment moves inventory in the same workspace the invoice was raised in.
- Catalogue, variants, warehouses and transfers
- Payment links, transactions, refunds and settlements
- Invoices held in exact minor units, never floats
05 / 06 Automation
The repeatable half, handled.
Flow listens to the same events the activity feed and the audit trail record. Build a workflow visually, version it immutably, test it before it is live, and read every execution — including the failed attempts and the retries.
- Triggers from real business events, or a schedule
- Conditions, variables and fourteen action types
- Immutable versions, retries, logs and test mode
06 / 06 Intelligence
Agents that work inside your permissions.
Connect your own provider key. Give an agent a role, a budget and a list of tools — and every tool it may call is mapped to a workspace permission with a risk level. Anything risky stops and waits for a person.
- Bring your own OpenAI, Anthropic or Google key
- Tools mapped to permissions, graded by risk
- Approvals, budgets, run history and evaluations
Mercestack Mailbox
A mailbox that belongs to the business.
Shared addresses, not personal ones. A thread has an owner, a status and a customer, and the person who picks it up second starts where the first left off.
Mailbox
A message arrives
Chidinma Eze writes to support@northstar.co about order NS-2041.
CRM
The sender is already a customer
Matched to Ivory & Oak — owner, status and history attached to the thread.
Commerce
Their order is right there
12 × Alder side table, ₦1,840,000, awaiting fulfilment.
Finance
So is the money
INV-0118 for ₦1,840,000, paid and reconciled against the order.
Flow
The reply is not the end of it
Sending writes to the timeline, and the invoice being paid starts the handover automation.
northstar.co
VerifiedThree records, published once. Until every one of them resolves the domain stays pending and Mercestack refuses to send from it.
TXTOwnershipnorthstar.coTXTSPFnorthstar.coTXTDKIMms1._domainkey
Not ready for that yet? Claim an available @mercestack.com address first, with no DNS setup, and move to your own domain whenever you are ready.
Transactional
Receipts, notifications and password mail sent by the platform through your configured delivery provider.
Marketing
Audience segments computed from live CRM records, reusable templates, campaigns, sequences, consent and suppression.
Mercestack Flow
The repeatable half of the job, written down once.
A workflow is a trigger, some conditions and a list of typed actions. Because the actions operate on the same records your team does, an automation is a colleague following the process — not a script pushing data between two systems that disagree.
Paid order handover
version 4 · active
- TRInvoice paidAfter payment is confirmed
invoice.paidINV-0118 · ₦1,840,000
- IFAmount over ₦500,000Compare numeric values
greater_than1,840,000 > 500,000 — continue
- 01Create taskConfirm delivery window · Operations
task.createConfirm delivery window · due tomorrow
- 02Send messageReceipt from billing@northstar.co
message.sendReceipt sent to chidinma@ivoryandoak.com
- 03Adjust inventory−12 Alder side table · Lagos
inventory.adjustALD-ST-01 · 48 → 36 · Lagos
- 04Run AI agentAccount summary for the owner
agent.runAccount summary written to the record
flow.execution.completed· 6 nodes · 1 attempt · order NS-2041
Triggered by the business, not by a poller
Flow subscribes to the same event vocabulary the activity feed renders and the audit trail records. A trigger and the history of what happened cannot disagree, because they read one list.
Versions are immutable
Editing a live workflow publishes a new version. Executions stay pinned to the version that ran them, so a log from last month still describes the workflow that produced it.
Failure is a state, not a silence
Attempts, the next retry time and the error are all recorded. Test mode runs the whole thing without touching anything real.
Mercestack AI Workforce
Agents that work inside the same rules as everyone else.
An agent gets a role, a budget and a list of named tools. Each tool requires the workspace permission a person would need to do the same thing, and each carries a risk level that decides whether it runs or waits.
Account analyst
Approval required for risky actions
crm.searchlowSearch CRM · requires
customer.readsales.pipelinelowRead sales pipeline · requires
deal.readfinance.summarylowRead finance summary · requires
invoice.readtask.createmediumCreate task · requires
task.createdeal.createmediumCreate deal · requires
deal.updateinvoice.createhighCreate invoice · requires
invoice.create
| Tool | Requires | Risk |
|---|---|---|
crm.searchSearch CRM | customer.read | low |
sales.pipelineRead sales pipeline | deal.read | low |
finance.summaryRead finance summary | invoice.read | low |
task.createCreate task | task.create | medium |
deal.createCreate deal | deal.update | medium |
invoice.createCreate invoice | invoice.create | high |
High risk · waiting
invoice.createDraft a ₦460,000 invoice for the two added units on NS-2041
The agent has stopped. Nothing is drafted, sent or charged until somebody with the permission approves it — and the decision is recorded against both of them.
Your provider, your key
Connect OpenAI, Anthropic, Google or any OpenAI-compatible endpoint. Keys are encrypted at rest and never returned after setup — not to the console, not to an agent, not to you.
Budgets before requests
Spend limits and usage are tracked per workspace. A model registry decides which models an agent may actually reach.
Runs you can read afterwards
Every run records what was asked, which tool was called, what came back and what it cost. Evaluations let you check an agent before trusting it with more.
The platform
One vocabulary the whole system speaks.
Around a hundred named events, defined in one place. Flow's triggers subscribe to them, the activity feed renders them, and the audit trail records them. A workflow listening for deal.won and a CRM that publishes something else is the worst failure a product like this can have — so there is only one list.
one paid order, as the platform emitted it
customer.createdIvory & OakCRMdeal.wonQ1 restockSalesorder.createdNS-2041Commercepayment.transaction.succeeded₦1,840,000Paymentsinvoice.paidINV-0118Financeflow.execution.startedPaid order handoverFlowtask.createdConfirm delivery windowWorkmessage.sentChidinma EzeMailboxinventory.adjustedALD-ST-01 −12Commerceagent.run.completedAccount analystAIflow.execution.completedPaid order handoverFlow
Same list, three consumers. Nothing here is a copy of anything else.
Call anything, from inside a workflow
Flow ships an http.request action: a public HTTPS endpoint, called as a step, with the workflow's variables available to it and the response usable by the steps after it.
One encrypted place for credentials
The Apps registry holds a connection per service — encrypted at rest, never returned after setup, and usable by automations without a key being pasted into a workflow.
- Slack
- Google Calendar
- QuickBooks
- Paystack
- Custom webhook
Inbound callbacks, verified
Payment state changes follow server-side verification or a valid signature from the provider. A request that fails the check changes nothing.
A public REST API, workspace API keys and outbound webhooks are planned and are not in the product today. What is above is what ships.
Explore
Eight modules, one workspace, one company's data.
Home
Northstar & Co.
AN
My open work
7
2 overdue
Open conversations
14
3 need an owner
Customers
268
4 marked at risk
Outstanding
₦4.2m
₦610k overdue
Focus queue
Open work- 01Approve the restock proposal for Ivory & OakPart of Q1 retail restockToday
- 02Fulfilment SLA — Warehouse handoverProcess owner: OperationsOverdue
- 03Read and acknowledge Returns & refundsStandard operating procedureSOP v4
- 043 open conversations have no ownerAssign them so customers know who is responsibleMailbox
Recent activity
Flow completed the automation Paid order handover
just nowAda Nwosu marked the invoice paid INV-0118
2m agoCheckout created the order NS-2041
3m agoAda Nwosu won Ivory & Oak — Q1 restock
1h ago
Boundaries
One workspace must never be able to read another.
Not “should not”. The isolation is enforced in three places — the guard, the repository and the schema — so a single forgetful query cannot open it.
- 01The workspace comes from the session, never the URL
- A request carries a workspace header, and the server will only accept it if an active membership joins that user to that workspace. An identifier someone can edit is never trusted.
- 02Queries cannot forget the boundary
- Tenant-scoped reads and writes go through a repository with no overload that omits the workspace, and the caller cannot override it. A record in another workspace answers 404, not 403 — the API is not an oracle for which identifiers are real.
- 03Roles, and a limit on granting them
- Flat module.action permissions, four roles seeded with the workspace, and a rule that nobody may grant a role stronger than their own. Hiding a module in the browser is never the boundary.
- 04The API is not on the internet
- One container publishes a port. The browser talks to the web server, which holds the session and adds the workspace header; the API and the database are reachable only from inside the private network.
- 05Credentials are encrypted and never handed back
- Provider keys — AI, payments, delivery, connected apps — are encrypted at rest and are not returned after setup, to any surface.
- 06An append-only history of who did what
- Business events, administrative changes, automation runs and agent actions all land in the audit trail, attributed to the person, workflow or agent responsible.
- 07Files are scoped, checked and time-limited
- Uploads are tenant-scoped with checksums and streaming malware scans, and object-storage access is granted through short-lived signed URLs rather than public links.
- 08Money changes state on evidence
- A payment is marked succeeded after server-side verification or a valid provider signature. A request that fails the check changes nothing.
These are the controls the product implements. Mercestack does not hold an external certification such as SOC 2 or ISO 27001, and this page does not imply one. Read the security page, or write to security@mercestack.com.
Put the company on one system.
Bring your team, your customers, your mailbox, your operations and your money into one workspace — and let the automation between them finally have something to work with.