Store Isolation
Your Store's Data, Kept Apart by the Database Itself
Many stores share Mercayo, but no store can ever see another's orders, shoppers or products. The wall is built into the database, where it cannot be skipped by a bug in a screen.
- In every plan
- Free for 14 days
Kosha is a demo store on Mercayo. Its products, orders and customers are sample data.
In short
What It Does
On Mercayo, every piece of data that belongs to a store (products, orders, shoppers, discounts, settings, invoices, messages, everything) carries the store it belongs to. The database itself checks, on every read and every write, that the request is for that same store:
- When a shopper opens your storefront, the request is tied to your store by its address: your free Mercayo address or your own domain.
- When your team uses the admin, the request is tied to the store they chose, and only if they are on that store's team.
- Mercayo's server then gives the request a short-lived pass for that one store. The pass is never sent to the browser, so nobody can change it to point at another store.
- Every query runs with only that pass. A row of another store is simply invisible to it: it cannot be listed, counted, changed or deleted.
This is not a filter added by each screen, which one forgotten line could break. It is a rule on every table, switched on and enforced by the database for every request, whichever screen or feature made it.
Walls Inside Your Store, Too
The same rules keep people inside your store to what is theirs. A signed-in shopper sees only their own orders, invoices, addresses and wishlist, never another shopper's. Your team sees what their roles allow, and those rights are read from the database as well, not from anything the browser sends.
Settings, Pictures and Files
Settings that apply to a whole store (checkout, discounts, tax, localization and the rest) are one set per store, so a change in your store can never alter another's. Pictures and files are stored under your store's own folder, with the same kind of rule on that folder.
Tested on Every Change
Automated tests create two stores and check, table by table, that one can never read, list, count, change or delete the other's rows. The tests were proven to fail on a deliberately broken rule and on a table without the wall, so a gap cannot slip in unnoticed. Every new table gets the same treatment before it ships.
When Mercayo Itself Works Across Stores
A few jobs must see more than one store: sign-up, billing, sending messages, nightly reports and Mercayo's own console. They use a separate permission that only Mercayo's servers hold, every such use names the one store it works on, and each one is kept on a reviewed list. Mercayo's support access to a store's admin goes through its own recorded session, never through someone's place on a team.
For your store
Why It Matters
When you put your customers' names, phone numbers and addresses on a platform, you are trusting it with your business and with their privacy. A shared platform has to be sure that one store's mistake, or a bug in one screen, can never expose another store's shoppers.
For an Indian store this matters more every year. Shoppers share a mobile number, a home address and often a GSTIN with you; India's Digital Personal Data Protection Act makes you answerable for keeping that safe. A competitor on the same platform must never be one bug away from your customer list, your prices or your best sellers.
Putting the wall in the database, and testing it, is the strongest way to keep that promise for every store, including yours. A screen can have a bug; the rule underneath still refuses the request. And because the check sits in one place, every new feature Mercayo builds inherits it the day it ships, without anyone having to remember.
Step by step
How It Works
Each Request Belongs to One Store
A storefront request is tied to the store by its address. An admin request is tied to the store the signed-in person chose, and only when they are an active member of that store's team. Someone who is on two stores' teams works in one at a time, with that store's rights only.
The Request Gets a Pass for That Store Alone
Mercayo's server gives the request a short-lived pass that names the store and who is asking (a shopper, a team member or a support session). It stays on the server and is never handed to the browser, so it cannot be copied or edited to name another store.
The Database Checks Every Row
Each table only shows and accepts rows of the pass's store. Another store's rows do not exist for that request: a search, a count, an export or an update simply never reaches them. Pictures and files follow the same rule on each store's own folder.
Rights Come From the Database Too
What each person on your team may do is read from the database, never trusted from a sign-in token. Mercayo keeps a short copy to stay fast and throws it away the moment anything changes, so a removed person, a turned-off account or a changed role takes effect at once.
Tests Prove It on Every Change
Two-store tests run on every change to Mercayo, for every table, and fail if any table lacks the wall. A new table cannot ship without its own rule and its own test, so the wall grows with every feature instead of being added later.
- Orders
- Customers
- Products
- Orders
- Customers
- Products
- Orders
- Customers
- Products
The database itself keeps every store's rows apart (row-level security)
Your shoppers
What Your Shoppers See
Nothing visible: shoppers simply never see anything of another store. A shopper's account is per store too: their account in your store is separate from any account they have in another Mercayo store, with its own sign-in, addresses and orders. Inside your store, a signed-in shopper sees only their own orders, invoices, addresses and wishlist.
Settings
Settings You Control
Each one is in your admin. A new store starts with the value shown.
Nothing to set up: it works the same way in every store.
Mercayo
Mercayo's Controls
There is no switch for the wall: it is always on, for every store, and no setting or override can turn it off. Mercayo's own background jobs (sending messages, billing, reports) work across stores with a separate permission that only Mercayo's servers hold, and each of those uses names the store it works on. Mercayo's support team can open a store's admin only through a support session, which is recorded in Mercayo's own log and, by default, shown to the store (see support access).
Limits today
Good to Know Before You Start
- All stores share one database (each walled off); a store cannot have a database of its own.
- Mercayo's own background jobs and support sessions can work across stores, under their own recorded permissions.
- The wall keeps stores apart; inside your store, what each team member can see is set by the roles you give them.
- A shopper who buys from two Mercayo stores has two separate accounts; nothing is shared between them, not even a saved address.
Questions
About Store Isolation
Can another store on Mercayo see my customers?
No. The database refuses any request for your rows that does not belong to your store, whatever screen or feature it comes from, and tests prove it table by table. Another store cannot list, count, search or export your customers, orders or products.
Are my shoppers shared with other stores?
No. Shopper accounts are per store. The same person can have accounts in two stores, and neither store sees the other's account, orders or addresses. Mercayo never builds a shared shopper list across stores.
What about my pictures and files?
They are stored in your store's own folder, under the same kind of rule as your data. Product photos, invoices and the files you upload belong to your store's space and are served for your store.
Can Mercayo's team see my data?
Mercayo's background jobs work with your data to run your store: sending your messages, making your invoices and reports. Mercayo's support team can open your admin through a recorded support session, which by default you see in Settings and in your activity log.
What if a screen in Mercayo has a bug?
The wall does not depend on the screen. Even if a screen asked for the wrong rows, the database would answer only with your store's rows, because the rule sits on the table itself. That is the reason it was built there.
I run two stores on Mercayo. Are they kept apart too?
Yes. Each store is its own walled space, even when the same person owns both. You choose a store when you sign in to the admin, and your rights, settings and data in one never reach the other.
Does a team member's access end at once when I remove them?
Yes. Rights are read from the database, and the short copy Mercayo keeps for speed is thrown away the moment a person is removed, turned off or given a different role. Their next click is refused.
Related
Related Features
- Staff and RolesInvite people by email or phone, give them roles with exactly the rights they need, switch access off at once, and hand over ownership safely.
- Support AccessWhen Mercayo's support team opens your admin to help, it is a time-limited session with a reason, recorded, and by default shown to you with what was changed.
- Encrypted KeysRazorpay keys, courier sign-ins and ad tokens are encrypted with a key kept outside the database, bound to your store, and never shown again.
- Privacy and ConsentA cookie banner written for India's DPDP Act, marketing tags only after consent, double opt-in for subscribers, and a Delete My Account that really deletes.
- Customer AccountsShoppers sign in with a one-time code by email or phone, or with Google, and find their orders, invoices, addresses and credit in one place.
More in Security and Trust: Staff and Roles · Two-Step Sign-In · Activity Log · Support Access · Encrypted Keys · Privacy and Consent
Try It on Your Own Store
Every feature is in every plan, free for 14 days.
