A standard stack you can audit
Mercur is a set of composable modules and plugins on a runtime your team already knows: Node.js, PostgreSQL, Redis. No proprietary platform, no black box, no niche specialists.
- API-first — A REST API across admin, vendor, and storefront scopes, with a typed client.
- Event-driven — Workflows with compensation and rollback, links between modules, subscribers for events.
- Headless and modular — Mercur installs over Medusa v2 as a plugin, not a fork – your storefront stays yours.
- Open — Any web developer can read it, run it, and extend it.
Everything a security review asks for
Nothing hidden. Read it in order, or jump to what you need – each topic shows what is open today and what Enterprise adds.
- Deployment & ownership — Self-hosting on any cloud, on-premise or air-gapped, MIT licensing, and data residency you decide. Enterprise adds a published reference architecture and guided upgrades.
- Data & residency — Your database, in your region. Enterprise adds export controls and multi-tenant isolation.
- Access & encryption — Role-based access with vendor-scoped, row-level isolation. Enterprise adds SSO (SAML / OIDC) and native MFA.
- Compliance — Enterprise adds Omnibus price history, period-correct tax, GPSR and energy-label fields, and GDPR retention.
- Continuity — Enterprise adds an SLA, disaster recovery, long-term support and a clean exit.
- Integration — Connectors for ERP, PIM, OMS, storefront platforms and vendor feeds.
Inspect it yourself
- A documented disclosure policy — Report privately to security@mercurjs.com. Safe harbor for good-faith research, and coordinated disclosure – no public report before a fix ships.
- Automated scanning — Secret scanning, dependency updates and static analysis live in the same public repository.
Verify it yourself
Read the code, run the stack, then talk to us about putting it in production.