About Merula
Merula provides continuous domain posture monitoring for European small and medium-sized businesses, agencies and service providers. The product is operated by Adspace Nordic AB, a Swedish company with long experience running public web services.
Merula exists because important domain posture changes should not depend on someone remembering to log into yet another dashboard. It is built to run quietly in the background: add the domains your organisation depends on, configure who should be notified, and let Merula monitor for drift, expiry, weakened policies and other changes that need attention. The dashboard is there when you need context; the daily value arrives as clear signals into the workflows you already use.
What Merula does
Your public domain — DNS records, TLS certificates, email authentication, transport security, web security headers, availability and domain registration lifecycle — is one of the most important surfaces for operational trust, security and continuity, and the surface that drifts most quietly. A misconfiguration is rarely complicated to fix; the harder problem is that no one was watching when it appeared.
Merula provides continuous observability of that surface. Twenty-six checks run on a regular schedule. Every observation is recorded, compared with the last known-good state and explained in plain language when it changes. Depending on your plan, you can look back later and see exactly when something moved, what the previous value was and whether the change was expected.
Who Merula serves
Merula is a B2B service for EU and EEA-based small and medium-sized businesses and the agencies that serve them. You do not need a large security team to maintain a strong baseline. You need clear signals, useful history and recommendations that are understandable enough to act on.
The Free tier is open to EU and EEA businesses for evaluation — like every Merula plan, it is a B2B product, not a consumer service. Paid plans add VAT and MFA requirements, with full eligibility terms set out in Terms §2 Eligibility.
How Merula relates to standards and frameworks
Each check Merula runs carries the references that apply to it, kept in four distinct kinds so nothing is overstated:
- Technical standards — the RFCs and specifications the check actually tests (DNS, DNSSEC, TLS, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE, CAA, security.txt).
- Security frameworks and risk references — where a result can serve as supporting evidence or risk context: OWASP risk categories, ISO/IEC 27001, CIS Controls and NIST.
- Cyber-hygiene guidance — the practical guidance it aligns with, such as ENISA and national cybersecurity authorities.
- NIS2-relevant evidence — technical evidence that can support NIS2-related risk-management and assurance work.
Posture reports export the same evidence in a form that supports internal documentation, customer assurance and audit preparation. These are technical relevance references — they show where Merula's findings can provide supporting evidence; they are not certifications or claims of legal compliance.
Resilience as a baseline
European SMBs are part of the operating tissue of the digital economy. When their public domains stay correctly configured — when DMARC helps reduce spoofing, when TLS problems do not go unnoticed, when DNS does not drift — the systems that depend on them stay more trustworthy. Resilience at the SMB layer is what makes the wider ecosystem resilient.
Merula's contribution is continuous, calm attention to the technical posture of your public domain environment, so that the foundation you and your customers depend on stays sound.
Where Merula runs
Merula is built and operated from Stockholm under the Swedish legal entity Adspace Nordic AB. Infrastructure runs in AWS, Stockholm region. This supports EU data residency, but should not be confused with full data sovereignty. The legal nuance for EU data on US-owned cloud infrastructure is described on the compliance page.
The name
Merula is Latin for blackbird. The blackbird sits high in the tree, attentive to changes in its surroundings. It does not shout without reason, but when something shifts, it reacts. That is the role Merula is designed to play for your domain environment.