Commerce operations, on one ledger
Cloud Merchant runs your marketplaces, storefront and wholesale from one system of record. Stock, orders, payments and margins that agree with each other, in a database that belongs to your shop alone.
Connects to
01Scatter
Every marketplace keeps its own stock count, its own order format and its own idea of what sold. A spreadsheet reconciles them after the fact: after the oversell, after the refund, after the margin report was wrong.
02Converge
Marketplace, storefront and wholesale orders land in one queue, in one shape. A webhook delivered twice is recorded once, because the stock an order moves carries a key built from what caused it, not from when the message arrived.
03Record
Every stock movement is an entry, never an edit. On-hand is the sum of the ledger, not a number somebody typed. Payments work the same way, and the audit trail goes further: the database itself refuses to change an audit event.
04Resolve
Availability is checked and taken under a per-item lock, so two channels cannot both sell the unit you have. Checkout holds stock while the customer pays, and every channel reads the same available-to-sell figure, less the safety stock you set for it.
05Grow
When the ledger is the source of truth, a new marketplace, a new country or a wholesale account is one more lane out of the same core: priced in its own currency, taxed correctly, and measured on the cost you actually paid.
The platform
Selling, running and understanding the business are usually three systems that argue. Here they share one database, one ledger and one set of rules.
Sell
One catalogue, published to every channel, with the price decided on the server every time.
Run
Stock, orders, delivery, purchasing and tax, all writing to the same ledger.
Know
Reports that say what they do not know, and a history that cannot be edited.
For developers
A GraphQL Storefront API for shop fronts, a scoped Admin API for integrations, OAuth for apps and signed webhooks for what happens in between. Versioned by date, starting with 2026-01.
# Storefront API, version 2026-01mutation AddToCart($lines: [CartLineInput!]!) { cartCreate(lines: $lines) { cart { token # a credential: keep it private subtotal { amount currencyCode } lines { quantity unitPrice { amount } } } userErrors { code message } }}# CartLineInput has no price field.# Every line is priced from the catalogue.import { createHmac, timingSafeEqual } from "node:crypto";// Deliveries are signed over "{timestamp}.{body}".export function verify(req: Request, body: string, secret: string) { const ts = Number(req.headers.get("x-inf-timestamp")); const sig = req.headers.get("x-inf-signature") ?? ""; if (!ts || Math.abs(Date.now() / 1000 - ts) > 300) return false; const expected = createHmac("sha256", secret) .update(`${ts}.${body}`) .digest("hex"); return sig.length === expected.length && timingSafeEqual(Buffer.from(sig), Buffer.from(expected));}Security
Security claims are easy to write. These are properties of how the platform is built.
Every shop runs on its own Postgres database. There is no shared table with a tenant column to forget, and a query with no shop in scope fails closed.
Audit events are append-only below the application: triggers reject UPDATE, DELETE and TRUNCATE, so history cannot be quietly rewritten.
Channel and payment keys are stored with AES-256-GCM and a fresh salt per credential, so a database dump or a misplaced backup is not a set of working keys.
Roles and permissions for staff, scoped keys for integrations, and install screens where a merchant can refuse any scope an app asks for.
No client names a price: not in the cart, not at checkout, not on a refund. Delivery is chosen by rate id and coupons by code, then priced server-side.
Access and erasure requests are verified before anything runs. Erasure keeps the financial record, removes the person, and audits counts rather than values.
Pricing
Isolation is not a premium feature. Choose by how many channels and products you run; moving up later is a change of plan, not a migration.
For brands selling on a few channels and ready to stop reconciling them.
$95/month
Billed annually
For operations across many channels, markets and suppliers.
$279/month
Billed annually
Everything in Pro, plus:
For high-volume and multi-region businesses with their own requirements.
Custom
Annual agreement
Everything in Scale, plus:
No card is needed to request a shop. A person reviews every request before anything is built.
No. Every shop gets its own Postgres database, provisioned when the shop is created. There is no shared table that separates merchants by a column, and a request that does not resolve to a shop cannot reach any database.
Amazon, eBay, Etsy, Walmart, Wayfair, TikTok Shop, Facebook and WooCommerce, plus your own storefront through the Storefront API and wholesale buyers through B2B accounts. All of them read and write the same inventory ledger.
One of them gets it. Availability is checked and taken under a per-item database lock, so the check and the sale cannot interleave. Checkout also holds stock while the customer pays, and the hold is released automatically if they do not.
There is no bundled storefront to be locked into. Cloud Merchant is headless: a shop front you build, or one an agency or app builds for you, talks to the GraphQL Storefront API, and reads your brand colours and type from it.
From landed cost, meaning purchase price plus freight, duty and other charges allocated from the purchase order, taken at the cost that applied on the day of the sale. Sales with no recorded cost are excluded and counted, so the report tells you how much of revenue it can actually account for.
Tax at checkout is computed by Stripe Tax. Cloud Merchant records a tax line for every order line, extracts inclusive tax correctly from the gross, and books tax that a marketplace collected as the marketplace’s rather than as your liability.
Yes. The Admin API uses scoped keys, apps install through OAuth with PKCE, and outbound webhooks are signed and retried with a stable event id. The API is versioned by date, so an integration keeps working as it evolves.
Request a shop and a person reviews it, usually within one business day. Once it is approved, the shop is built automatically in a single run: its own database, schema, roles and owner account, with nothing for you to install.
Tell us what you sell and where. A person reads every request, and once it is approved your shop, with its own database, roles and owner account, is built automatically.