Ionel Merca
Software engineer. 10 years building backends, microservices, and the occasional cryptographic protocol — mostly in places where the cost of being wrong is high: identity, payments, compliance.
Give me a problem and a deadline. I've shipped everything from NFC smartcard authentication to marketplace payment splits across 6 countries — usually as the one person who owns it end-to-end.
Based in Bucharest, working across Europe.
Experience
A decade across payments, identity, and government systems.
Full Stack Development
Node.js backends, Flutter and React frontends, end-to-end ownership from API contracts to deployment
Microservice Platforms
Event-driven systems with Kafka, Kubernetes, and OpenAPI REST contracts — cross-team coordination on service integrations across TS, Python, C#, and Java backends
Requirements to Production
Translating business requirements into shipped software — scoping, architecture, build, delivery, and production support, usually as the single owner
VTEX Platform
VTEX IO, VTEX API, MasterData modelling, checkout orchestration, admin apps, and 11+ payment providers across 6+ European markets — plus order lifecycle, catalog, and multi-seller marketplace operations
Payment Architecture
Marketplace splits, multi-provider connectors, and commission engines across 6+ European markets
Cryptographic Protocols
PACE, ECDH, AES-CMAC secure messaging · EU DSS / eIDAS digital signatures and validation · PKI, trust chains, and timestamping · QES · NFC smartcard authentication
Digital Identity & eID
National eID apps, MRTD document reading, QES signing, and push-based authentication for external services
DevOps & Infrastructure
Kubernetes orchestration, Docker, CI/CD pipelines, Nginx, Firebase, GCP, monitoring with Elastic APM
AI & LLM Integration
MCP protocol servers, Claude/Gemini tool-use, agentic patterns, RAG pipelines
Freelance Software Engineer
Independent
- ›Built the cryptographic NFC stack for Romania's national eID mobile application — PACE protocol, Chip Authentication, AES-CMAC secure messaging, and Qualified Electronic Signatures
- ›Owned the backend identity-verification and request-security layer for the same platform — split-PACE with Passive Authentication against Romanian CSCA trust chains, a signed and encrypted request channel with cached asymmetric keys, enterprise IDM integration, cloud liveness verification with government face/address database cross-reference, TSA-stamped QES PDF signing, and a push-authentication module (tap-to-approve)
- ›Principal engineer on the back-office of REGES — Romania's Labor Inspection platform. Built the business APIs, the async access-request verification workflows on Kafka, and the report generation pipeline. Integrated the platform's document signing and signature validation services. Kubernetes
- ›End-to-end VTEX engineer — 11+ payment integrations across 6+ European countries (Adyen, PayU, Oney, P24, Netopia, Mokka, TBI, ING, Stripe, Checkout.com)
- ›Deep VTEX backend work — marketplace split payments with multi-seller commission engines for OBI/Adyen, VTEX IO services, MasterData, checkout orchestration, and payment gateway architecture
- ›Developed a cross-border journey planner for 6 Danube-region countries — an integration layer across national APIs implementing the EU OJP standard
Software Engineer
VTEX
- ›Engineer on the 1st-Party Apps team — fullstack on the VTEX e-commerce platform: VTEX IO services, admin apps, and checkout-side integrations
- ›Started the OBI/Adyen marketplace split-payment work that I continued to own and extend through the freelance years
- ›Payment connectors live in production across European markets
Freelance Software Engineer
Independent
- ›Led development of Flow — electric scooter rental platform with IoT/MQTT backend for real-time hardware telemetry and a Flutter rider app. Team lead for the second half of the engagement
- ›Built the Alini Medical App — fullstack mobile application in Flutter with a Firebase backend
NLP Researcher
University Politehnica Bucharest
- ›NLP research and AI coursework at Politehnica Bucharest — Computer Vision, Data Mining, Knowledge Representation
- ›Built an NLP recommendation system matching project descriptions to relevant documentation
Software Engineer
Teamnet
- ›Core engineer on the National Emergency Unit System — a fullstack medical application linking Romania's 112 dispatch, the responding ambulance, and the receiving hospital in real time, so the hospital could prepare before the patient arrived
- ›Bachelor's thesis: "The Graph of Romanian Businessmen" — graph analysis of business networks using social-network metrics
BSc Computer Science Engineering
Politehnica University of Bucharest · Faculty of Automatic Control and Computers
Projects
Production systems processing real data, real money, real identities
ROeID
Romania's national electronic identity mobile application. The NFC chip stack on the phone plus the identity-verification and request-security layer on the backend.
- Mobile client — Flutter + a forked, extended dmrtd Dart library: NFC chip reading, PACE, Chip Authentication
- Node.js backend — request-security boundary and identity-verification orchestration
- Python verification service — CSCA trust-chain validation and document-hash verification
- Split-PACE topology — ephemeral session keys live on the backend, never on the phone
- Production-deployed cryptographic stack for Romania's national eID
- Same protocols implemented consistently across Dart, Node.js, and Python
- TSA-stamped QES PDF signing for legally binding documents
- Tap-to-approve push-authentication module powering external-service logins
- Public eID libraries stop at BAC; PACE on brainpoolP256r1 with AES-CMAC had to be built from scratch
- Mobile-to-backend request channel had to survive replay, MITM, and key rotation
- Identity cross-reference across MRZ, CNP, and QES certificate without false positives
- End-to-end chip authenticity verified against the Romanian CSCA trust chain
- Forked dmrtd and added full PACE + Chip Authentication on the Dart side; published the fork as open source
- Signed-and-encrypted request channel with cached asymmetric keys
- Strict matching on identity boundaries with MRZ/CNP/QES cross-reference
- Passive Authentication against the multi-CSCA Romanian trust chain in the Python verification service
REGES
The back-office of Romania's Labor Inspection platform — services used internally by labor inspectors to manage registry access, run verification workflows, and generate signed reports. Front-office owned by a separate team.
- TypeScript / NestJS — business APIs (reges-bapi)
- TypeScript / NestJS workers — async processing on Kafka (reges-process)
- C# / .NET — document signing service (reges-sign)
- Java — signature validation, EU DSS compliance (reges-dss)
- Kafka event bus, Kubernetes deployment, mTLS-bounded ingress
- Principal engineer on the back-office — full ownership of business APIs and the async workflow layer
- Access management for delegated representatives and employee accounts in production
- Kafka-driven report generation pipeline with horizontal scaling per topic
- Long-running validation and external registry lookups couldn't block the request path
- PDF signing flows had to remain compliant with EU DSS
- Multi-language services needed a shared validation and contract layer
- Async workflows on Kafka — PDF validation, registry lookups, and data extraction kept off the request path
- Document signing routed through a dedicated C# service backed by a state signing API
- Shared NestJS library (reges-cmn) for axios+retry, MinIO, Kafka config, and validation pipes
Agent Commerce on AP2
Production-grade implementation of Google's Agent Payments Protocol (AP2) — cryptographically signed mandates for AI-mediated shopping with a three-party trust chain anyone can verify. Live demo on VTEX; backend-agnostic by design.
- AP2 v0.2 protocol engine — Ed25519 signing, JCS (RFC 8785) canonicalization, did:web identities, EdDSA JWT artifacts
- Three-actor trust chain — Merchant, Credentials Provider, Payment Network, each with its own DID and keypair
- Shopping assistant — Claude Desktop (MCP) + storefront widget (React pixel app), same backend HTTP routes
- Two-stage RAG — OpenAI embeddings into Pinecone, hydrated against the live VTEX catalog at query time
- Backend-agnostic core + adapter pattern (CartProvider, CatalogProvider, KeyStore) for VTEX / Shopify / BigCommerce / headless
- Live demo on VTEX (Romanian catalog) — agent searches → merchant signs cart → CP signs payment → network signs receipt
- Production-ready cryptographic engine; mock providers swap in as one class each
- Solo across architecture, backend, frontend, and ops
- Open for deployment on any storefront backend — VTEX adapter shipped, Shopify / BigCommerce / headless designs ready
- AP2 is a 2025 spec with no production reference implementations to copy from
- Three parties signing three artifacts must produce a chain anyone can verify with public keys alone
- Catalog-aware product retrieval — keyword search collapses on multilingual queries against a fashion catalogue
- LLM-backed public routes are an obvious abuse vector — every call costs real money
- Built the spec end-to-end — Ed25519 + JCS + did:web + EdDSA JWTs, drift detection at pay-time, always-emit signed receipts (rejections included)
- Mock Credentials Provider and Payment Network classes designed for one-class swap-in to Stripe / Adyen / PayPal and Visa / Mastercard
- Two-stage RAG — bulk-sync outside the request path + live hydration on query; ~200ms total latency
- Four-layer security: origin allowlist + shared secret, per-IP rate limits, per-session cost caps, auth-gated artifact endpoints
VTEX Payment Connectors
Payment integrations for European e-commerce clients on the VTEX platform — authorizations, captures, marketplace splits, and refunds wired into VTEX checkout. 11+ providers across 6 countries, all live in production.
- TypeScript on VTEX IO — provider-side connector apps integrated with VTEX checkout
- Per-provider integrations (auth, capture, refund, settlement, webhooks)
- MasterData for distributed locking and stateful flows
- Shared multi-seller commission engine for marketplace splits (OBI/Adyen)
- 11+ payment connectors live in production across DE, PL, FR, RO, BG, and Asia (Adyen, PayU, Oney, P24, Netopia, Mokka, TBI, ING, Stripe, Checkout.com)
- OBI/Adyen flagship: ~20K LOC TypeScript, dominant contributor
- Klarna partial-capture flows, mixed-cart handling, multi-seller checkouts shipped
- Each provider has its own state machines, webhook contracts, and refund semantics
- Marketplace splits with multi-seller commissions across 6+ regulatory environments
- Race conditions between webhook arrival and order-state mutation
- 11+ connectors implemented to a common VTEX payment-provider protocol
- Multi-seller commission engine with 4 distinct refund flows (full cancel, partial, returns, goodwill) — each recomputing commissions correctly
- Distributed locking via MasterData; idempotency keys for webhook dedup
OJP4Danube
An EU project to let travellers plan a single trip across 6 Danube-region countries' public transport networks — each country with its own OJP-XML dialect, journey planner, and border-crossing rules. Delivered solo.
- TypeScript backend on Firebase Cloud Functions — federated journey planner
- Multi-platform Flutter client (web, Android, iOS, Windows) on AsyncRedux + Freezed
- Parallel federation across 6 national journey planners
- 307 of 325 commits (94%) — sole architect of backend, client, and CI/CD
- 6 Danube-region countries served in production
- EU OJP standard compliance
- Each country uses its own OJP-XML dialect — schemas, namespaces, and optional fields all vary
- Cross-border trips require chaining through exchange points
- Three transport modes (bike-only, public-transport, mixed) need separate routing logic
- XML namespace and schema normalisation layer per country
- Exchange-point chaining algorithm with per-mode path resolution
- Parallel federation across 6 planners; results merged and ranked
Flow
Real-time IoT backend for an electric scooter rental platform — unlock commands, GPS, battery state over MQTT with a proprietary scooter protocol.
- Node.js IoT backend — MQTT broker talking directly to scooter controllers
- Flutter rider app — Redux + epics, real-time map clustering, MobilePay tokenised payments
- Proprietary scooter telemetry protocol (~50 field codes)
- Dominant contributor on the IoT backend (56% of commits)
- #1 contributor on the Flutter rider app
- Production deployment with live telemetry, payments, and ride state
- Hardware unlock had to confirm reception with no protocol-level guarantees
- Telemetry from many scooters at once required parsing variable-rate streams
- Cross-platform map clustering had to render thousands of pins on mobile
- Unlock handshake — MQTT command → EventEmitter callback awaiting hardware ACK with a 1.5s timeout
- Decoded ~50 telemetry field codes across GPS, BMS cell voltages, ESC firmware
- Custom map clustering on Flutter for performance at scale
cryptobot
Personal exploration into systematic crypto trading on Binance — an orchestrated execution framework, not another buy-the-dip script. Built over four months as a sandbox for strategy and architecture ideas, never shipped commercially.
- Python orchestrator with a pluggable Strategy interface
- Three execution modes from the same code path — live Binance, BacktestExchange (Redis-backed), PaperBinance
- State + Persistence layer (PersistLayer) for crash recovery
- Telegram notifications for fills, exceptions, and wallet status
- 16 strategy variants run interchangeably (MACD, SAR, ADX, Fractal combinations)
- Quantified per-strategy results — win rate, drawdown, fees ratio, average holding time
- 78 commits across 4 months of active iteration
- Open source — github.com/exilonX/cryptobot
- Multiple strategies needed independent iteration without touching the execution core
- Backtests had to share the same code as live runs to avoid drift
- A multi-pair live bot will die — open positions can't be lost on restart
- Orchestrator / Strategy split — strategies are subclasses with four entry points (check_entry, open_position, exit_limits, check_exit)
- BacktestExchange replays Redis-backed historical candles through the same orchestrator
- PersistLayer hydrates open positions and wallet state on restart; MAX_COINS guard enforced before strategy entry
Case Studies
Long-form breakdowns of specific projects — architecture, numbers, and what didn't work.
A working EUDI wallet
A real EU Digital Identity wallet built from my two libraries — hardware-backed keys and the SD-JWT VC / OpenID4VC holder flow — joined by a 72-line adaptor. It runs the full issue → hold → present journey both offline and against the live EU reference issuer/verifier. The capstone that proves the other two compose.
SD-JWT VC + OpenID4VC
A pure-Dart holder library for SD-JWT Verifiable Credentials over OpenID4VCI/VP — receive, hold, and selectively present EUDI-wallet credentials. Key- and HTTP-agnostic, 100% covered, and verified end-to-end against the EU reference wallet. The protocol companion to Attested Secure Keys.
Attested Secure Keys
A Flutter plugin for hardware-backed, non-exportable EC P-256 keys — minted inside Android StrongBox/TEE or the iOS Secure Enclave, with a manufacturer-signed attestation your server can verify. Fills a real gap: no pub.dev package exposed key attestation, and flutter_secure_storage protects data, not keys.
Agent Commerce on AP2
Production AP2 v0.2 implementation — verifiable signed mandates for AI-mediated payments. Three-party trust chain (Merchant · Credentials Provider · Payment Network), Ed25519 / JCS / did:web, RAG-powered shopping assistant. Showcased on VTEX; backend-agnostic by design.
cryptobot
An orchestrated crypto-trading framework on Binance — a sandbox for strategy architecture with real backtest numbers and an honest read on what they mean.
The Graph of Romanian Businessmen
From 6.8 GB of Romanian Official Gazette PDFs to a searchable graph of ~370,000 people. End-to-end pipeline: extraction, classification, graph construction, Neo4j, SigmaJS visualisation.
Skills & Technologies
The stack and domains behind the projects above.
Languages
Backend & APIs
Frontend & Mobile
Infrastructure
Data & Messaging
Security & Identity
Domain Expertise
AI & LLM
Clients & Markets
Corporate, government, and payment-platform clients I've shipped production code for.
Payment Providers Integrated
Engagements I take
Back-end contract work in payments, identity, or compliance-heavy systems. End-to-end ownership preferred — architecture, build, deployment, production hardening. European clients, Bucharest timezone, remote.