B2B Software Consulting in Charlotte
The Federal Reserve's Large Commercial Banks table puts Bank of America and Truist in Charlotte, so software sold here is examined, not merely procured. ERPStack is remote-first — no Charlotte office — building ERP and CRM systems in Next.js, TypeScript and PostgreSQL that survive a bank's third-party risk review.
Quick Answer
In short: Charlotte software is examined, not just procured. ERPStack builds bank-vendor ERP to the 2023 interagency third-party guidance at 88 FR 37920, the 36-hour incident notice in 12 CFR 53.3, the GLBA Safeguards Rule's 30-day FTC notice and SEC Rule 17a-4(f) retention, generating SOC 2 evidence from the PostgreSQL schema.
Regional Compliance
- Interagency Guidance on Third-Party Relationships (88 FR 37920)
- 12 CFR 53.3 — 36-hour incident notification to the OCC
- 12 CFR 53.4 — four-hour bank service provider notice
- GLBA Safeguards Rule, 16 CFR 314.4(j) — 30-day FTC notice
- SEC Rule 17a-4(f) — non-rewriteable, non-erasable retention
- SOC 2 Type II evidence generated from the PostgreSQL schema
Security & Compliance Architecture
Charlotte’s two largest banks do not share a charter: the Federal Reserve lists Bank of America NA as nationally chartered and Truist Bank as state-chartered nonmember, which is why one incident rule exists three times — 12 CFR 53 for the OCC, 12 CFR 225 for the Federal Reserve, 12 CFR 304 for the FDIC. Since 6 June 2023 those agencies examine vendors under 88 FR 37920, so each rule below lands on the PostgreSQL schema and the CI/CD deployment pipelines, not in a legal summary.
36 hours to the OCC, four hours to the bank
12 CFR 53.3 gives a Charlotte bank 36 hours from determination to notify the OCC; 12 CFR 53.4 makes its service provider warn a bank-designated contact once covered services degrade for four or more hours. Both clocks start at one event, so the ERP records it in PostgreSQL and fires both notices from Redis jobs into the bank’s intake API.GLBA Safeguards Rule: 500 consumers, 30 days
Since 16 CFR 314.5 took effect on 13 May 2024, 16 CFR 314.4(j) requires a notification event touching at least 500 consumers to reach the FTC within 30 days. Counting them is a query problem, so a Charlotte lender’s records stay addressable by one tenant-scoped key, with row-level security (RLS) in Postgres and an immutable audit trail.SEC Rule 17a-4(f): WORM or an audit trail
A Charlotte broker-dealer affiliate may preserve records exclusively in a non-rewriteable, non-erasable format, or run the audit-trail alternative that re-creates the original after modification or deletion. ERPStack builds the second as a hash-chained journal in PostgreSQL and holds the WORM copy in AWS object storage, keyed by AWS Key Management Service (KMS).Third-party artefacts, generated not written
The 2023 guidance rescinded OCC Bulletin 2013-29, OCC Bulletin 2020-10, SR 13-19/CA 13-21 and FDIC FIL-44-2008, so every Charlotte bank asks one consistent set of questions. Data flows, RBAC matrices and change history come from the repository and GitHub Actions; Semgrep SAST, OWASP ZAP and Playwright results attach as evidence, with Sentry supplying the incident timeline.What ERPStack does not claim in Charlotte
ERPStack holds no SOC 2 or ISO 27001 attestation and says so in Charlotte vendor questionnaires. The SOC 2 Type II report belongs to your institution; the system we ship keeps its controls — immutable audit trail, RBAC, key custody — in the PostgreSQL schema, so the audit tests evidence, not narrative.
Engineering Blueprint
The Federal Reserve’s Large Commercial Banks table, data as of 31 March 2026, seats two of the ten largest US banks in Charlotte: Bank of America NA at $2,672,192 million in consolidated assets across 3,604 branches, and Truist Bank at $541,180 million. Software sold into Charlotte is examined, so ERPStack treats custom ERP development here as an evidence problem — the PostgreSQL schema, retention and access proofs come before screens.
Why Charlotte workloads land in us-east-1
AWS publishes no Local Zone in either Carolina. The nearest are us-east-1-atl-2a in Atlanta and the parent region us-east-1 in Northern Virginia, about 520 km from uptown Charlotte. ERPStack does not invent a Charlotte region: the PostgreSQL primary sits in us-east-1 across three availability zones, Redis and the Next.js app run beside it, Terraform pins placement, and 12–18 ms from Charlotte is a design target we hold, never a measured SLA.
The determination clock is a column
A Charlotte bank’s notification duty starts the moment it determines a notification incident occurred, so that timestamp belongs in the PostgreSQL schema rather than a runbook. ERPStack writes it with Drizzle ORM into an immutable audit trail, derives both deadlines — four hours to the bank, 36 hours to the OCC — from one row, and exposes them on a REST API the bank’s own monitoring can poll.
// Drizzle ORM + PostgreSQL — Charlotte bank incident journal
export const incident = pgTable('incident', {
id: uuid('id').primaryKey().defaultRandom(),
determinedAt: timestamp('determined_at', { withTimezone: true }).notNull(),
spNoticeDueAt: timestamp('sp_notice_due_at'), // +4h — 12 CFR 53.4
regNoticeDueAt: timestamp('reg_notice_due_at'), // +36h — 12 CFR 53.3
bankId: uuid('bank_id').notNull(), // RBAC + RLS tenant key
});Per-bank isolation an examiner can query
When one platform serves several Charlotte institutions, multi-tenant architecture has to be demonstrable rather than asserted. ERPStack enforces row-level security (RLS) in PostgreSQL keyed to the bank identifier, issues short-lived JWT sessions behind SSO, runs Semgrep SAST and Playwright inside GitHub Actions, and generates the RBAC matrix from the schema so a reviewer sees which role reads which table.
Two Charlotte tax clocks in one ledger
Mecklenburg County adds 1.00% of sales and use tax on 1 July 2026, taking Charlotte to an 8.25% general rate, while North Carolina withholding drops from 4.25% to 3.99% for years after 2025. An ERP holding one rate per customer mis-bills on 1 July, so ERPStack keeps effective-dated rate rows in PostgreSQL, ships them as Drizzle ORM migrations, and pins Vitest cases to both cut-over dates.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Charlotte
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyTarget Industries in Charlotte
Frequently Asked Questions
The Federal Reserve, FDIC and OCC replaced three separate documents with one: the Interagency Guidance on Third-Party Relationships, final 6 June 2023 at 88 FR 37920. It rescinded OCC Bulletin 2013-29, OCC Bulletin 2020-10, SR 13-19/CA 13-21 and FDIC FIL-44-2008. A Charlotte bank now scopes vendors by criticality, so ERPStack ships an RBAC matrix, data-flow diagrams and an exit plan as deliverables.
Buy Salesforce when the requirement is relationship management with standard reporting — the licence costs less than a build and the vendor evidence pack exists already. Commission custom ERP development when the workflow is the product: exception queues, four-eyes approval, provable evidence that a 12 CFR 53 determination clock started. ERPStack builds that for a Charlotte bank supplier in Next.js and PostgreSQL, and says when Salesforce wins.
Oracle NetSuite wins on cost until bank clients start dictating controls. Once a Charlotte supplier owes 36-hour incident evidence, SEC Rule 17a-4(f) retention and per-client segregation, NetSuite SuiteScript maintenance overtakes a custom PostgreSQL build on Drizzle ORM with row-level security (RLS). ERPStack prices both and will say when NetSuite or Microsoft Dynamics 365 remains right.
Yes. ERPStack is remote-first: no Charlotte office, no local staff, no North Carolina entity. What we bring is deployment into AWS us-east-1, the region that actually serves the Carolinas, plus fluency in the examination your bank clients face — 12 CFR 53 notification duties, third-party artefacts, and an immutable audit trail an OCC examiner reads without translation.
From 12 CFR 53.4: a bank service provider must notify a bank-designated contact once it determines an incident has degraded covered services for four or more hours. ERPStack implements that for a Charlotte supplier as a durable timer on the incident row in PostgreSQL, so the four-hour mark fires a webhook and an audit entry instead of depending on memory.
17 CFR 240.17a-4(f) gives two routes: preserve records exclusively in a non-rewriteable, non-erasable format, or use the audit-trail alternative that re-creates the original record after modification or deletion. ERPStack builds the second for a Charlotte broker-dealer affiliate in PostgreSQL as a hash-chained append-only journal, with the WORM copy in AWS object storage under a retention lock.
Two, on separate clocks. NCDOR's notice of 2 March 2026 adds a 1.00% Mecklenburg County rate from 1 July 2026, taking Charlotte to an 8.25% general sales-and-use rate. Session Law 2023-134 moves North Carolina income tax from 4.25% in 2025 to 3.99% after 2025, changing withholding. ERPStack stores both as effective-dated rows in PostgreSQL.
Criticality and concentration first, then artefacts: an RBAC matrix, change history from GitHub Actions, SOC 2 Type II scope, key custody, subcontractor lists and a tested exit plan. Under the 2023 interagency guidance the Charlotte bank still owns the risk, so ERPStack generates evidence from the repository and the PostgreSQL schema rather than writing prose.
Yes, and the mechanics matter more than the promise. AWS operates no Local Zone in either Carolina, so a Charlotte workload sits in us-east-1 unless pinned elsewhere. ERPStack fixes placement in Terraform, tags every PostgreSQL cluster with its jurisdiction, and blocks cross-region replication in CI so a misconfigured environment fails the pipeline, not an examination.