Executive Summary
AI-generated analysis for Mercury
Mercury (mercury.com) is a U.S.-focused online business banking platform serving startups, small businesses, and scaling companies. Based on independent evidence gathered across 24 data sources, the rule engine has assigned Mercury a Tier 4 (Low Risk) rating with a 94% confidence score, reflecting an overall strong security and compliance posture with a small number of low-severity gaps. Mercury demonstrates several meaningful positive signals:
Key Findings
- The domain has been registered since 1990, reflecting over 35 years of established online presence.
- The domain is clean across all major threat intelligence blacklists (SURBL, Spamhaus DBL, URLhaus), with no active malware URLs and a 0% IP abuse score on its Cloudflare-backed infrastructure.
- Mercury's website operates over TLS 1.3 with a strong AES-256-GCM cipher and HSTS enforced, indicating sound transport-layer security.
- No sanctions matches, adverse media signals, or SEC/FDIC enforcement actions were identified.
- Mercury publicly claims SOC 2 Type II compliance on its security page (https://mercury.com/security), which — while unverified through a public registry — is a meaningful indicator of security program maturity.
- Malware detection service and web security scanning service both return clean results, with no malicious indicators detected. A small number of areas warrant attention before finalizing vendor approval:
- The subprocessor page at https://mercury.com/help/subprocessors was found but contained no identifiable subprocessor entries, representing a material gap for GDPR and supply chain due diligence at a medium data access level.
- The SOC 2 Type II claim on the trust page is vendor-attested only and has not been independently verified — the actual audit report should be requested.
- The marketing site (mercury.com) received a HTTP security scanner grade of C (50/100), with Content-Security-Policy and X-Frame-Options headers missing. Note that the application domain (app.mercury.com) was not independently scanned and may have a stronger configuration.
- A Hacker News discussion from May 2025 references a fintech industry article titled "Mercury's High Risk, High Rewards Strategy Runs into Regulatory Reality," suggesting some regulatory scrutiny of Mercury's business model during this period — this warrants monitoring.
- Mercury's AI data usage policy does not explicitly address training commitments, retention timelines, or third-party AI provider relationships, which should be clarified given the financial data sensitivity of the platform. Overall, Mercury presents a well-established, cleanly operating vendor with meaningful security investments and a low threat profile. The identified gaps are manageable and do not materially alter the low-risk determination, but procurement teams should obtain the SOC 2 Type II report, seek a complete subprocessor list, and clarify AI data handling practices before finalizing onboarding.
Independence Statement
All evidence supporting this assessment was independently sourced from external data providers, public registries, and open-source intelligence — Mercury was not contacted, consulted, or given the opportunity to influence these findings.