Tenant isolation
Business records are scoped to a workspace. Cross-workspace identifiers are treated as unavailable rather than trusted.
Security
Mercestack is designed around tenant boundaries, least-privilege access, encrypted credentials and traceable actions. This page describes the controls implemented in the product; it does not claim an external certification.
Roles and permissions
Workspace permissions guard API actions. Hiding a module in the browser is never treated as the security boundary.
Encrypted secrets
Provider credentials are encrypted at rest and are not returned after connection setup.
Verified payments
Payments are verified server-side or by a signed webhook before they count. Balances are an append-only ledger, and every payout is reviewed before money leaves.
Audit history
Business, administrative, agent and automation actions create attributable audit and event records.
File protection
Tenant-scoped files support storage limits, checksums, malware scanning and time-limited signed access when object storage is configured.
Report a security concern
Send a clear description and reproduction details. Do not include customer data unless requested through a secure channel.
Bring your team and customers together, sell and get paid, then automate the rest.
Create your workspace