Business SystemsGlossary of Terms
Clear, expert-written definitions and deep-dives into core concepts powering modern business software architectures.
What is the ERPStack glossary of terms?
It defines the 68 pieces of B2B software and ERP terminology that decide how a custom system is built — from custom development architectures and database design to SOC 2, HIPAA and GDPR compliance frameworks. The 68 terms are grouped into 6 categories and connected by 408 cross-references, and each one carries an exact definition, a card of concrete figures and cited standards, how the concept behaves in production, ERPStack's own implementation position, and 4 questions answered in full — 272 across the set.
ERP & Business Systems
11 terms
Resource Planning & ERP
Resource Planning & ERP refers to a centralized software suite used by organizations to manage and…
Scope: 1 shared schema spanning 5 core domains: finance, inventory, procurement, manufacturing and…
See also: Headless ERP, Custom Software Development, Multi-tenant Architecture
Customer Relationship Management (CRM)
Customer Relationship Management (CRM) is a software platform that centralizes, manages, and analyzes all interactions and…
Record spine: 4 linked entities: account, contact, opportunity and activity, keyed to 1 customer…
See also: Resource Planning & ERP, Data Subject Access Request (DSAR), Row-Level Security (RLS)
Headless ERP
Headless ERP is an architectural pattern that completely decouples the backend database schema, business logic, and…
Contract: 1 backend, N clients: web, mobile and partner integrations over REST, GraphQL…
See also: Resource Planning & ERP, Multi-tenant Architecture, API-First Development
Custom Software Development
Custom software development is the process of designing, building, deploying, and maintaining software applications tailored to…
Deliverable: 1 repository you own outright, with 0 runtime licence fees attached to…
See also: Technical Debt, Resource Planning & ERP, CI/CD Deployment Pipelines
B2B Software
Custom software is organization-level software designed to coordinate operations, manage transactions, process large volumes of data…
Buying unit: 1 purchase decision, many stakeholders: end users, IT, security review and finance
See also: Multi-tenant Architecture, Role-Based Access Control (RBAC), Feature Flags (Feature Toggles)
Bill of Materials (BOM) Management
A Bill of Materials (BOM) is a comprehensive list of raw materials, assemblies, sub-assemblies, parts, and…
Structure: A directed acyclic graph, not a list: 1 parent part can expand…
See also: Resource Planning & ERP, Immutable Audit Trail, PostgreSQL Database
Sabre GDS Travel Integration
Sabre is a global distribution system (GDS) travel technology platform that connects travel service providers with…
Domain: 1 distribution layer connecting 3 supplier types — airlines, hotels and car…
See also: Idempotency in API Design, Edge Caching / CDN, Webhooks & Event Notifications
Certified Timesheet Tracking
Certified Timesheet Tracking is a time tracking system that complies with labor laws and government contracting…
Record: 1 immutable entry per approved period; corrections stored as adjustments, never edits
See also: Immutable Audit Trail, WORM Storage (Write Once Read Many), Role-Based Access Control (RBAC)
Shadow IT Risk
Shadow IT refers to software, SaaS subscriptions, and technology infrastructure used within an organization without formal…
Definition: Any system holding company data that IT cannot enumerate — 1 unknown…
See also: Software License Audit, Zero-Trust Security, Role-Based Access Control (RBAC)
Software License Audit
A Software License Audit is a compliance review where a software vendor (SAP, Oracle, Salesforce) audits…
Two surfaces: 1 commercial seat-entitlement check and 1 open-source obligation check over the dependency…
See also: Shadow IT Risk, CI/CD Deployment Pipelines, Technical Debt
NetSuite SuiteScript vs Custom Code
SuiteScript is NetSuite's proprietary JavaScript-based scripting language for customizing ERP workflows, with strict sandboxing limitations, governance…
Platform model: SuiteScript runs inside 1 Oracle NetSuite account; custom code runs in a…
See also: Headless ERP, API-First Development, Custom Software Development
Architecture Patterns
16 terms
Multi-tenant Architecture
Multi-tenant architecture is a software architecture pattern where a single physical instance of an application serves…
Isolation models: 3 options: database-per-tenant, schema-per-tenant, or 1 shared schema with a tenant column
See also: Headless ERP, B2B Software, Row-Level Security (RLS)
API-First Development
API-First Development is an engineering approach that prioritizes the design and implementation of application programming interfaces…
Order of work: The contract is designed and agreed before either side writes 1 line…
See also: GraphQL API Schema, tRPC Protocol, Headless ERP
Microservices Architecture
Microservices is an architectural style that structures an application as a collection of small, loosely coupled…
Unit: 1 service, 1 database, 1 deploy pipeline — sharing a database re-couples…
See also: Monolithic Architecture, Saga Pattern (Distributed Transactions), Event-Driven Architecture
Monolithic Architecture
A Monolithic Architecture is a traditional software development pattern where the database, backend business logic, and…
Unit: 1 deployable artefact, 1 database, 1 transaction boundary across the whole domain
See also: Microservices Architecture, Strangler Fig Migration Pattern, Technical Debt
Event-Driven Architecture
Event-Driven Architecture is a software architecture pattern where database changes, transactions, and user events trigger background…
Shape: 1 producer, N consumers — adding a consumer requires 0 changes to…
See also: Apache Kafka, Webhooks & Event Notifications, Idempotency in API Design
Headless CMS
A Headless CMS is a backend-only content management system built from the ground up as a…
Split: Content stored once, delivered to N front ends over 1 API instead…
See also: Payload CMS, Incremental Static Regeneration (ISR), Edge Caching / CDN
Next.js SaaS Starter Boilerplate
A Next.js SaaS Starter Boilerplate is a audit-ready software codebase containing built-in authentication, billing, database migrations…
What it removes: The first 4 weeks: auth, tenancy, billing hooks, CI and deployment wiring
See also: B2B Software, Multi-tenant Architecture, Drizzle ORM
Strangler Fig Migration Pattern
The Strangler Fig Pattern is a software migration strategy that incrementally replaces a legacy monolithic system…
Mechanism: 1 routing facade sends each path to either the legacy system or…
See also: Monolithic Architecture, Cloud Migration, Technical Debt
Idempotency in API Design
Idempotency is the API design principle where making the same HTTP request multiple times produces identical…
Definition: N identical requests produce the same state as 1 — the standard's…
See also: API-First Development, Webhooks & Event Notifications, Saga Pattern (Distributed Transactions)
CQRS (Command Query Responsibility Segregation)
CQRS is an architectural pattern that separates database read (query) operations from write (command) operations into…
Split: 2 models: 1 write model enforcing invariants, 1 or more read models…
See also: Event-Driven Architecture, OLAP vs. OLTP Database Partitioning, ClickHouse Analytics Database
Saga Pattern (Distributed Transactions)
The Saga Pattern is a microservices design pattern for managing long-running distributed transactions across multiple services…
Shape: N local transactions, each with 1 compensating action that semantically undoes it
See also: Microservices Architecture, Event-Driven Architecture, Idempotency in API Design
Data Mesh Architecture
Data Mesh is a decentralized data architecture that treats data as a product, owned and published…
Principles: 4: domain ownership, data as a product, self-serve platform, federated governance
See also: OLAP vs. OLTP Database Partitioning, ClickHouse Analytics Database, Event-Driven Architecture
Backend for Frontend (BFF) Pattern
The Backend for Frontend (BFF) pattern is an API design strategy that creates a dedicated backend…
Shape: 1 backend per client type — web, mobile, partner — over the…
See also: API-First Development, GraphQL API Schema, tRPC Protocol
Webhooks & Event Notifications
A webhook is an HTTP callback that allows one system to notify another system in real…
Direction: Server-to-server push — 1 call when the fact occurs, instead of a…
See also: Idempotency in API Design, Event-Driven Architecture, API-First Development
Payload CMS
Payload CMS is an open-source, TypeScript-native headless CMS built on Next.js that provides a fully customizable…
Model: Config-as-code — collections defined in TypeScript 5.9 files that live in your…
See also: Headless CMS, PostgreSQL Database, Incremental Static Regeneration (ISR)
Feature Flags (Feature Toggles)
Feature flags are configuration switches that enable or disable specific application features at runtime without deploying…
Core idea: Deploy and release become 2 separate events instead of 1
See also: CI/CD Deployment Pipelines, B2B Software, Multi-tenant Architecture
Data & Databases
10 terms
ACID Compliance
ACID compliance is a set of database transaction properties (Atomicity, Consistency, Isolation, Durability) that guarantee database…
The 4 properties: Atomicity, Consistency, Isolation, Durability — all 4 or the guarantee is not…
See also: PostgreSQL Database, Saga Pattern (Distributed Transactions), Immutable Audit Trail
TimescaleDB
TimescaleDB is an open-source time-series database extension for PostgreSQL that optimizes database performance for time-series logging…
What it is: 1 PostgreSQL extension, not a separate engine — ordinary SQL and existing…
See also: PostgreSQL Database, ClickHouse Analytics Database, OLAP vs. OLTP Database Partitioning
OLAP vs. OLTP Database Partitioning
OLAP (Online Analytical Processing) and OLTP (Online Transactional Processing) are database architectures optimized for analytical query…
OLTP shape: Many small transactions: read 1 row, write 2, commit — measured in…
See also: ClickHouse Analytics Database, PostgreSQL Database, CQRS (Command Query Responsibility Segregation)
Drizzle ORM
Drizzle ORM is a lightweight, type-safe Object-Relational Mapper (ORM) for TypeScript that lets developers write SQL…
Version in use: Drizzle ORM 0.45 with TypeScript 5.9 against PostgreSQL 18
See also: PostgreSQL Database, ACID Compliance, Neon Serverless PostgreSQL
PostgreSQL Database
PostgreSQL is an advanced, open-source object-relational database management system (RDBMS) that supports ACID compliance, complex SQL…
Current major: PostgreSQL 18, released in the 18.x line; majors 14 through 18 are…
See also: Drizzle ORM, Row-Level Security (RLS), ACID Compliance
Apache Kafka
Apache Kafka is a distributed event store and stream-processing platform designed to handle high-throughput, real-time data…
Model: A durable append-only log per topic, split into partitions that can be…
See also: Event-Driven Architecture, ClickHouse Analytics Database, Idempotency in API Design
ClickHouse Analytics Database
ClickHouse is a fast, open-source columnar database management system (DBMS) designed for Online Analytical Processing (OLAP)…
Storage model: Columnar — a query reading 3 of 200 columns touches only those…
See also: OLAP vs. OLTP Database Partitioning, PostgreSQL Database, CQRS (Command Query Responsibility Segregation)
WORM Storage (Write Once Read Many)
WORM (Write Once, Read Many) storage is a data storage technology that allows data to be…
Guarantee: Write once, read many — 0 modifications and 0 deletions before the…
See also: Immutable Audit Trail, FDA 21 CFR Part 11 Compliance, AWS Key Management Service (KMS)
Row-Level Security (RLS)
Row-Level Security (RLS) is a database access control feature in PostgreSQL that restricts which rows a…
Where it runs: Inside PostgreSQL 18 — the predicate applies to 100% of queries, including…
See also: PostgreSQL Database, Multi-tenant Architecture, Role-Based Access Control (RBAC)
Neon Serverless PostgreSQL
Neon is a serverless PostgreSQL platform that separates storage from compute, enabling instant database branching, autoscaling…
What it is: PostgreSQL with storage and compute separated, so compute can scale to 0…
See also: PostgreSQL Database, Drizzle ORM, CI/CD Deployment Pipelines
Security & Access
8 terms
Immutable Audit Trail
An Immutable Audit Trail is a security logging pattern that records all system events, database updates…
Rule: Append only — 0 updates and 0 deletes; a correction is a…
See also: WORM Storage (Write Once Read Many), SOC 2 Compliance, Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) is an authorization mechanism that restricts system access and database operations to…
Model: 3 layers: users hold roles, roles hold permissions, permissions gate operations
See also: Row-Level Security (RLS), Zero-Trust Security, Multi-Factor Authentication (MFA)
JSON Web Token (JWT)
A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact, self-contained…
Specification: RFC 7519, published May 2015 by the IETF
See also: Multi-Factor Authentication (MFA), Zero-Trust Security, Role-Based Access Control (RBAC)
Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA) is a security authentication process that requires a user to provide two or…
Factor types: 3 categories: something you know, something you have, something you are
See also: Zero-Trust Security, JSON Web Token (JWT), Role-Based Access Control (RBAC)
Zero-Trust Security
Zero-Trust is a cybersecurity framework based on the premise that no user, device, or system should…
Principle: Never trust, always verify — 0 implicit trust from network location
See also: Multi-Factor Authentication (MFA), Bastion Host, Virtual Private Cloud (VPC)
Bastion Host
A Bastion Host is a special-purpose computer on a network specifically designed and configured to withstand…
Role: 1 hardened, audited entry point into a private subnet where databases have…
See also: Virtual Private Cloud (VPC), Zero-Trust Security, Multi-Factor Authentication (MFA)
Virtual Private Cloud (VPC)
A Virtual Private Cloud (VPC) is an isolated private network carved out of a public cloud…
Structure: 2 subnet tiers: public for load balancers, private for application and PostgreSQL…
See also: Bastion Host, Zero-Trust Security, Infrastructure as Code (IaC)
AWS Key Management Service (KMS)
AWS Key Management Service (KMS) is a secure, managed service that makes it easy for developers…
Model: Envelope encryption in 2 layers — 1 managed master key wraps the…
See also: Zero-Trust Security, HIPAA Compliance, PCI-DSS Financial Compliance
Compliance & Regulation
11 terms
SOC 2 Compliance
System and Organization Controls (SOC) 2 is a voluntary compliance standard for service organizations, developed by…
Framework: AICPA Trust Services Criteria — 5 categories, of which only Security is…
See also: HIPAA Compliance, Immutable Audit Trail, Role-Based Access Control (RBAC)
HIPAA Compliance
The Health Insurance Portability and Accountability Act (HIPAA) is a regulatory framework establishing national standards to…
Statute: Public Law 104-191 of 1996, extended by the HITECH Act, Public Law…
See also: SOC 2 Compliance, FHIR (Fast Healthcare Interoperability Resources), Virtual Private Cloud (VPC)
GDPR Data Compliance
The General Data Protection Regulation (GDPR) is a comprehensive European Union regulation establishing strict guidelines for…
Instrument: Regulation (EU) 2016/679, adopted 27 April 2016 and applicable from 25 May…
See also: Data Subject Access Request (DSAR), Row-Level Security (RLS), Immutable Audit Trail
FERPA Education Compliance
The Family Educational Rights and Privacy Act (FERPA) is a federal law in the United States…
Statute: 20 U.S.C. 1232g, implemented by 34 CFR Part 99, Family Educational Rights…
See also: GDPR Data Compliance, Immutable Audit Trail, Role-Based Access Control (RBAC)
PCI-DSS Financial Compliance
The Payment Card Industry Data Security Standard (PCI-DSS) is a set of security standards designed to…
Standard: PCI DSS v4.x, maintained by the PCI Security Standards Council
See also: AWS Key Management Service (KMS), Zero-Trust Security, SOC 2 Compliance
FISMA Government Compliance
The Federal Information Security Modernization Act (FISMA) is a United States federal law that defines a…
Control catalogue: NIST SP 800-53 Rev. 5, finalised 23 September 2020
See also: FedRAMP Security Controls, Zero-Trust Security, Infrastructure as Code (IaC)
FedRAMP Security Controls
The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program that provides a…
Basis: NIST SP 800-53 Rev. 5 controls, finalised 23 September 2020, applied to…
See also: FISMA Government Compliance, Zero-Trust Security, Infrastructure as Code (IaC)
AS9100 Aerospace Standard
AS9100 is a widely adopted and standardized quality management system (QMS) for the aerospace industry, incorporating…
Basis: The ISO 9001 quality management system plus aviation, space and defence requirements
See also: Bill of Materials (BOM) Management, Immutable Audit Trail, WORM Storage (Write Once Read Many)
FDA 21 CFR Part 11 Compliance
FDA 21 CFR Part 11 is a United States Food and Drug Administration regulation establishing criteria…
Regulation: 21 CFR Part 11, Electronic Records; Electronic Signatures, published at 62 FR…
See also: Immutable Audit Trail, WORM Storage (Write Once Read Many), Certified Timesheet Tracking
FHIR (Fast Healthcare Interoperability Resources)
FHIR (Fast Healthcare Interoperability Resources) is a standard for healthcare data exchange developed by HL7 International…
Current release: FHIR R5, published by HL7 as version 5.0.0; R4 and R4B remain…
See also: HIPAA Compliance, API-First Development, Immutable Audit Trail
Data Subject Access Request (DSAR)
A Data Subject Access Request (DSAR) is a legal right granted to individuals under GDPR, CCPA…
Legal clock: GDPR Article 12(3) — 1 month to respond, extendable by 2 further…
See also: GDPR Data Compliance, WORM Storage (Write Once Read Many), Immutable Audit Trail
Cloud & Delivery
12 terms
Cloud Migration
Cloud migration is the strategic process of moving an organization's digital assets, legacy database systems, servers…
Strategies: Rehost, replatform, refactor, repurchase, retire, retain — 6 options, rarely just 1
See also: Strangler Fig Migration Pattern, Infrastructure as Code (IaC), Virtual Private Cloud (VPC)
Technical Debt
Technical debt is the implied cost of future software refactoring and debugging caused by choosing a…
Definition: The gap between the design you have and the design the problem…
See also: Custom Software Development, CI/CD Deployment Pipelines, Strangler Fig Migration Pattern
Edge Caching / CDN
Edge Caching is the practice of storing static files, API JSON payloads, and pre-rendered HTML pages…
Mechanism: Responses served from a location near the user instead of 1 origin…
See also: Incremental Static Regeneration (ISR), Headless CMS, Multi-tenant Architecture
Incremental Static Regeneration (ISR)
Incremental Static Regeneration (ISR) is a Next.js rendering pattern that allows developers to update static pages…
What it solves: Static speed with fresh data, without rebuilding 10,000 pages to change 1
See also: Edge Caching / CDN, Headless CMS, Payload CMS
GraphQL API Schema
GraphQL is a query language for APIs that allows client applications to request precisely the data…
Model: 1 endpoint, 1 typed schema; the client states exactly which fields it…
See also: API-First Development, tRPC Protocol, Backend for Frontend (BFF) Pattern
tRPC Protocol
tRPC is a protocol that allows developers to build end-to-end type-safe APIs without code generation by…
Model: Typed remote procedure calls where 1 TypeScript 5.9 type definition serves client…
See also: GraphQL API Schema, API-First Development, Headless ERP
Progressive Web Application (PWA)
A Progressive Web Application (PWA) is a type of application software delivered through the web, built…
Requirements: 3 pieces: HTTPS, a web app manifest, and a service worker controlling…
See also: Edge Caching / CDN, Idempotency in API Design, Incremental Static Regeneration (ISR)
CI/CD Deployment Pipelines
CI/CD (Continuous Integration and Continuous Delivery) is a set of practices and tools that automates the…
Pipeline stages: 5 gates on every pull request: typecheck, lint, unit tests, end-to-end tests…
See also: Infrastructure as Code (IaC), Feature Flags (Feature Toggles), Technical Debt
Infrastructure as Code (IaC)
Infrastructure as Code (IaC) is the practice of managing and provisioning computer cloud infrastructure—such as virtual…
Principle: The repository is the source of truth; a console change is drift…
See also: CI/CD Deployment Pipelines, Virtual Private Cloud (VPC), Cloud Migration
Sentry Observability Platform
Sentry is an open-source application monitoring and error tracking platform that helps developers identify, diagnose, and…
Primary job: Group thousands of raw exceptions into a handful of distinct issues with…
See also: OpenTelemetry Observability, CI/CD Deployment Pipelines, Technical Debt
OpenTelemetry Observability
OpenTelemetry (OTel) is an open-source observability framework for collecting, processing, and exporting telemetry data — traces…
Signals: 3: traces, metrics and logs, emitted through 1 vendor-neutral instrumentation API
See also: Sentry Observability Platform, Microservices Architecture, Event-Driven Architecture
FinOps (Cloud Financial Operations)
FinOps is a cloud financial management practice that enables organizations to maximize business value by collaborating…
Practice: 3 phases repeated continuously: inform, optimise, operate
See also: Cloud Migration, Infrastructure as Code (IaC), Neon Serverless PostgreSQL
Frequently asked questions about this glossary
What does the ERPStack glossary cover?
This Glossary of Terms defines the 68 concepts that recur in custom ERP, CRM and B2B software work, across 6 groups: business systems, architecture patterns, data and databases, security and access, compliance and regulation, and cloud delivery. Each entry gives an exact definition, a reference card of concrete figures and standards, how the concept behaves in production, how ERPStack implements it, and 4 questions buyers and engineers actually ask.
How are the terms organised?
By the layer of the system they belong to rather than alphabetically, because related decisions are usually made together. The Glossary groups all 68 entries into 6 categories and adds 408 cross-references between them, so reading about Multi-tenant Architecture leads directly to Row-Level Security and RBAC. An alphabetical index helps when you already know the word; this arrangement helps when you are trying to decide something.
Are these definitions vendor-neutral?
Mostly. The definition and the production behaviour in each of these Terms describe the concept as the industry uses it, with named standards and specifications cited where they exist. One section per page is explicitly ERPStack's own position — how we build it, and what we would not build. Keeping the two separated means you can use the reference without accepting the opinion attached to it.
How current are the figures quoted here?
Version numbers in these Terms describe the stack ERPStack builds on today, and regulatory figures cite the instrument they come from — 21 CFR Part 11, Regulation (EU) 2016/679, NIST SP 800-53 Rev. 5 — so you can verify them at source rather than trusting the Glossary. Anything we could not verify against a primary document was left out instead of being stated approximately.