B2B Software Consulting in Chicago
Chicago is the one US market where a timeclock is a litigation question: the Illinois Biometric Information Privacy Act, 740 ILCS 14, carries a private right of action worth $1,000 or $5,000 a violation. ERPStack is remote-first — we build Chicago custom ERP software to BIPA consent and destruction rules, and to CFTC Regulation 1.31 recordkeeping, on AWS us-east-2.
Quick Answer
In short: Illinois BIPA turns one unconsented fingerprint scan into a private right of action, and CFTC Regulation 1.31 wants five years of electronic records. A Chicago ERP is built to both: biometric consent and deletion modelled in PostgreSQL, SEC Rule 17a-4 retention, RBAC per desk, running in AWS us-east-2 with the Chicago Local Zone us-east-1-chi-2a.
Regional Compliance
- Illinois Biometric Information Privacy Act (740 ILCS 14)
- Illinois Personal Information Protection Act (815 ILCS 530)
- CFTC Regulation 1.31 recordkeeping (17 CFR 1.31)
- SEC Rule 17a-4 electronic records (17 CFR 240.17a-4)
- Chicago Paid Leave and Paid Sick and Safe Leave Ordinance
- SOC 2 Type II, PCI DSS and ISO 27001 control mapping
Security & Compliance Architecture
SOC 2 Compliance and PCI DSS are the floor in Chicago; every ERP vendor clears them. The argument is the Illinois Biometric Information Privacy Act, 740 ILCS 14 — the state privacy statute carrying a private right of action, and why a Chicago timeclock is a custom ERP development problem.
BIPA 740 ILCS 14/15 rewrites the Chicago workforce module
Section 15(a) wants a public written policy with a retention schedule and destruction guidelines firing when the initial purpose is satisfied or within 3 years of the individual’s last interaction, whichever occurs first. Section 15(b) wants written notice of the specific purpose and length of term plus a written release before first capture. In a Chicago ERP that is a consent row, a purpose string and a last-interaction timestamp driving a scheduled PostgreSQL purge, validated by Zod at the API edge.SB 2979 changed the arithmetic, not the design
Illinois amended BIPA by SB 2979, effective 2 August 2024: repeated collection of the same identifier from the same person by the same method is now a single violation carrying at most one recovery, and a written release may be signed electronically. Damages are untouched — $1,000 negligent, $5,000 reckless, plus fees. Facebook settled at $650 million, TikTok at $92 million. Chicago manufacturing and logistics employers carry that exposure at the ERP timeclock.Illinois has no comprehensive privacy act — 815 ILCS 530 is the breach rule
SB 2875, the proposed Illinois Consumer Data Privacy Act, was re-referred to Assignments on 22 May 2026, so a Chicago SaaS or B2B Software operator is bound by BIPA plus the Personal Information Protection Act, 815 ILCS 530. Section 10 wants notice in the most expedient time possible without unreasonable delay, permitting substitute notice only above $250,000 of cost or 500,000 affected residents. We wire detection into Sentry and PostgreSQL audit tables so the Chicago clock starts on evidence.Chicago payroll carries two accrual banks, not one
The Chicago Paid Leave and Paid Sick and Safe Leave Ordinance covers anyone working 80 hours for a Chicago employer in any 120-day window, accruing one hour of paid leave and one hour of paid sick leave per 35 hours worked — two parallel balances an ERP carries separately. Employers with 5 employees every quarter of the prior year, trading 2 years, with no qualified plan, must also run My Illinois Savings deductions. Neither SAP S/4HANA nor NetSuite ships that Chicago configuration.
Engineering Blueprint
There is no AWS region in Chicago. The nearest full AWS region is us-east-2, US East (Ohio) — where a Chicago ERP keeps its PostgreSQL primary — and the Vercel compute region cle1, Cleveland, maps to that same AWS region, so the Next.js front end and the PostgreSQL database share one failure domain.
Chicago cloud topology, stated honestly
AWS does run a Local Zone here — US East (Chicago) 2, zone name us-east-1-chi-2a — but its parent region is us-east-1, not us-east-2, so control-plane calls resolve in N. Virginia while the compute sits in Illinois. We keep Drizzle ORM pooling, Redis and the ledger in us-east-2, and push only latency-bound work into the Chicago Local Zone: edge JWT verification, RBAC checks, Next.js middleware. Chicago cross-connects land at 350 East Cermak, Digital Realty ORD10. It is all Terraform, so a Chicago ERP is reproducible.
Aurora, and where a Chicago ERP must not go
CME Group’s 2025 Form 10-K states it leases its largest data centre from CyrusOne in Aurora, Illinois to 2031, and that Google Cloud is building a private cloud region in Aurora for CME Group’s futures and options markets — which logged record average daily volume of 28.1 million contracts in 2025. Cboe Global Markets sits at 433 West Van Buren Street. A Chicago ERP is not a matching engine. For Chicago finance and insurance clients we hold that boundary with an Event-Driven Architecture: FIX Protocol drop-copies land on Apache Kafka, a Node.js consumer writes PostgreSQL, and the general ledger never sits in the order path. Chicago logistics buyers get the same pattern for EDI 204, 210 and 214 intermodal drayage.
Chicago recordkeeping as a table, not a policy
CFTC Regulation 1.31 gives a Chicago futures firm 5 years of retention from record creation and keeps electronic records readily accessible that whole time; paper needs only 2. Rule 1.31(c)(2)(iii) then demands an up-to-date inventory of every system holding data needed to produce them. In a Chicago ERP that inventory is a PostgreSQL table with an immutable audit trail, migrated by Drizzle ORM and shipped by CI/CD Deployment Pipelines on GitHub Actions.
// Drizzle ORM + PostgreSQL — 17 CFR 1.31(c)(2)(iii) systems inventory
export const recordSystems = pgTable('record_systems', {
systemName: varchar('system_name', { length: 128 }).notNull(),
retentionYears: integer('retention_years').notNull().default(5),
awsRegion: varchar('aws_region', { length: 24 }).default('us-east-2'),
});Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Chicago
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyTarget Industries in Chicago
Frequently Asked Questions
Yes. The Illinois Biometric Information Privacy Act reaches any private entity doing business in Illinois whatever the head office, so a Milwaukee firm running finger-scan clocks at a Chicago warehouse sits inside 740 ILCS 14. BIPA’s first wave targeted exactly that — fingerprint timekeeping. Fix consent and destruction in the Chicago ERP as a Drizzle ORM migration and a PostgreSQL purge job.
At $40 million of make-to-order manufacturing, Odoo Enterprise is usually the honest answer for a Chicago fabricator: module coverage is real and total cost beats a build. Custom ERP development wins when BIPA-governed biometric timeclocks, union payroll and intermodal drayage EDI 204 and 214 tendering must reconcile in one PostgreSQL ledger. Past that, Odoo customisation is technical debt and Chicago custom ERP software pays.
Keep state in us-east-2, US East (Ohio), and use the Chicago Local Zone only for latency-bound edge work. AWS runs no Chicago region, and Local Zone us-east-1-chi-2a is parented to us-east-1, so its control plane answers from N. Virginia. Splitting a PostgreSQL primary across that boundary buys milliseconds and costs a clean failover story. Vercel cle1 keeps Next.js beside it. Design targets, not measured SLAs.
It can. Chicago’s Personal Property Lease Transaction Tax hit 15% of charges on 1 January 2026, up from 11% in 2025 and 9% in 2021, and it covers the non-possessory lease of a computer used to input, modify or retrieve customer-supplied data — how a hosted SaaS ERP is characterised. Trade execution on a CFTC-designated contract market is exempt. Price it into the Chicago cloud migration services budget.
Three things. 740 ILCS 14/15(a) needs a published retention schedule and a destruction job firing when the initial purpose is satisfied or within 3 years of the individual’s last interaction, whichever comes first. 15(b) needs the written release, specific purpose and length of term stored as data. 15(e) needs the biometric template guarded at least as well as other confidential data — PostgreSQL row-level security, AWS KMS envelope encryption, an immutable audit trail in the Chicago ERP.
It capped them. SB 2979, signed and effective 2 August 2024, makes repeated collection of the same biometric identifier from the same person by the same method a single violation carrying at most one recovery, and lets a written release be signed electronically. Damages stand at $1,000 negligent and $5,000 reckless. Exposure is per person, not per punch — so a Chicago ERP stores one versioned consent record per employee in PostgreSQL, readable over a REST API.
Five years under CFTC Regulation 1.31, counted from record creation, with electronic regulatory records readily accessible that whole period rather than the 2 years paper gets. A broker-dealer affiliate adds SEC Rule 17a-4: 6 years for core books, first 2 easily accessible, and an electronic recordkeeping system that either keeps a complete time-stamped audit trail or writes WORM storage. For Chicago finance clients we build the audit-trail branch on PostgreSQL with append-only triggers and AWS object lock.
Two Chicago rules and one state rule. The Chicago Paid Leave and Paid Sick and Safe Leave Ordinance accrues one hour of paid leave and one hour of paid sick leave per 35 hours worked, as two separate balances, for anyone reaching 80 hours in any 120-day period. Illinois then makes employers with 5 employees each quarter, trading 2 years, without a qualified plan run My Illinois Savings deductions. Both belong in the Chicago ERP payroll schema.