Security, without the badges we haven’t earned.

Mercantyl is early, and plenty of platforms our size decorate this page with compliance logos that turn out to mean nothing. We would rather tell you exactly what is in place today and exactly what is not, so your InfoSec team can make a real decision instead of a flattered one.

One structural point worth knowing up front: we never take custody of your money and never hold your buyers’ card numbers. You connect your own PayPal, Stripe, or Authorize.Net account; funds settle directly to you, and card data goes to that gateway rather than through us.

What is in place today

Access & permissions

  • Role-based access control on every admin action
  • Buyer accounts scoped to their own organisation
  • Session and password reset tokens expire and are single-use
  • Rate limiting and CSRF protection on authenticated routes

Data & isolation

  • TLS in transit on every request
  • Payment gateway credentials encrypted at rest with AES-256-GCM
  • Every tenant row carries a tenant ID, enforced in the data layer
  • Cross-tenant isolation covered by a dedicated automated test suite

Audit & logging

  • Order status changes recorded with actor and timestamp
  • Structured application logging with no secrets written to logs
  • Webhook events stored idempotently for replay and reconciliation

Infrastructure

  • Managed Postgres with automated daily backups and point-in-time recovery
  • Migrations gated in the release phase — a failed migration blocks the deploy
  • Secrets held as platform config vars, never in the repository

What is not in place yet

If any of these is a hard requirement for your procurement process, tell us before you trial rather than after. We would rather lose the deal early than surprise you at signature.

  • SOC 2 Type II — no audit has been performed. We will say so the day one starts.
  • SSO / SAML — planned, not built.
  • Third-party penetration test — not yet commissioned.
  • HIPAA and PCI-DSS attestation — out of scope; card data is handled by your chosen payment gateway, never by us.

Need to talk to an engineer?

Mail security@mercantyl.io. You will get someone who has read the code, not a CSM reading a script.