Bills of quantities, customer requests and orders contain confidential information: projects, prices, customers and terms. Before a large company trusts AI software with this data, IT wants to know exactly where the data is stored, who can access it and whether it is used to train third-party models. This article answers the questions that come up most often in security questionnaires, using Mercura as the example.

Key takeaways

• Mercura is ISO/IEC 27001 certified and GDPR-compliant.

• Data is stored in Europe, in an Azure data centre in Frankfurt. There is a separate US region for US customers.

• Every customer has its own tenant, separated at database level.

• Customer data is not used to train external AI models.

• Login with Microsoft Entra ID (SAML/OIDC), user provisioning via SCIM from Entra ID, Okta or other identity providers.

The questions IT asks

A typical security questionnaire for AI software in sales covers five topics: certification, where data is stored, separation from other customers, how AI models are used, and access management. On top comes the question of how the software talks to the ERP. The sections below go through these points one by one.

Certification: ISO/IEC 27001

Mercura is ISO/IEC 27001 certified. The standard requires an information security management system that records risks systematically, defines controls and is audited regularly by an independent body. For procurement and IT, it is the fastest proof that security does not depend on chance.

Where is the data stored?

Application data of European customers is stored in an Azure data centre in Frankfurt. For customers in the US, Mercura runs a separate US region, so data is not mixed between regions. Mercura is GDPR-compliant.

Separation from other customers

Every customer has its own tenant in Mercura. The organisations' data is separated at database level: every query only sees the data of its own organisation. Within a tenant, data is structured by organisation, location and user.

Is my data used to train AI?

No. Customer data is not used to train external AI models. What Mercura learns from your data, such as which articles fit which bill-of-quantities items, stays in your tenant and is only available to your organisation.

Login, users and roles

In a large company, user management belongs in the central identity management. Mercura connects to it:

Your admins set up SCIM themselves. IT keeps managing users and groups in one place instead of creating them twice in Mercura.

Running interfaces securely

The connection to the ERP is often the most sensitive part. Mercura offers several routes that your IT controls:

• Webhooks are signed (HMAC). Authentication options are Basic, Bearer, API key, OAuth2 client credentials and SAP OData.

• SFTP for article data and exports when your ERP works with files.

• API with documentation for master data, quotes and orders.

• Log and alerts: one shared log shows imports, API calls, webhooks and ERP exports. If an interface fails, admins get an email.

The ERP stays the system of record. Prices and conditions come from the ERP; Mercura prepares the line items and the article matching. Our article on SAP integration for quotes and bills of quantities shows how this works with SAP. For a general overview, see ERP integration.

People stay in control

Security in sales also means: no quote leaves unchecked. In Mercura, inside sales reviews every suggestion before a quote goes to the customer or an order goes into the ERP. Uncertain line items are flagged, never guessed.

Frequently asked questions

Is Mercura ISO 27001 certified? Yes, Mercura is ISO/IEC 27001 certified.

Is Mercura GDPR-compliant? Yes.

Where does Mercura host the data? In Europe, in an Azure data centre in Frankfurt. There is a separate US region for US customers.

Do customers share a database? Every customer has its own tenant. The organisations' data is separated at database level, so one organisation never sees another's data.

Does Mercura use my data to train AI models? No, customer data is not used to train external AI models.

Does Mercura support SSO with Microsoft Entra ID? Yes, via SAML/OIDC. Users and roles can be provisioned via SCIM from Entra ID, Okta or other identity providers.

Our enterprise checklist for AI in the quoting process shows how large companies fit the security review into the overall evaluation. You will find more about features on Quotes and tenders. If your IT has a security questionnaire, talk to us.

Sources

• Note "Mercura is ISO/IEC 27001 certified, GDPR-compliant, Hosted in Europe" in the footer of the customer stories on mercura.ai, retrieved 10 November 2026

• Mercura product documentation on security, single sign-on, SCIM and webhooks (developer documentation), as of November 2026