B2B Software Consulting in Hong Kong
Hong Kong has no VAT or GST, and section 33 of the Personal Data (Privacy) Ordinance has never been brought into force — so the pressure on a Hong Kong ERP comes from the HKMA, the SFC and the mainland boundary, not from an invoicing mandate. ERPStack builds remotely into ap-east-1 and designs PostgreSQL tenancy around that asymmetry.
Quick Answer
In short: a custom ERP in Hong Kong answers to the PDPO, whose section 33 never commenced, to HKMA SA-2 cloud notification and SFC external-storage rules, to iXBRL profits tax e-filing, and to Pillar Two top-up tax data. ERPStack builds it with MPF payroll on PostgreSQL in AWS ap-east-1, a p95 target under 15 ms in Hong Kong, with Drizzle ORM and RBAC over the ledger.
Regional Compliance
- Personal Data (Privacy) Ordinance (Cap. 486) — section 33 not in force
- HKMA Supervisory Policy Manual SA-2 (Outsourcing) and TM-G-1
- SFC Circular on the use of external electronic data storage (31 October 2019)
- Insurance Authority GL20 Guideline on Cybersecurity (1 January 2025)
- GBA Standard Contract for cross-boundary personal information (13 December 2023)
Security & Compliance Architecture
The structural fact most vendor pages miss about Hong Kong: section 33 of the Personal Data (Privacy) Ordinance (Cap. 486) — the cross-border transfer restriction — was enacted in 1995 and has never been brought into force. Hong Kong data-residency obligations come from contracts, from the HKMA, the SFC and the Insurance Authority, and from mainland law. A Hong Kong ERP design therefore starts with the contract stack, not the statute.
HKMA: notify first, prove key control second
Under Supervisory Policy Manual module SA-2 on outsourcing, a Hong Kong authorized institution notifies the HKMA generally three months before a public-cloud arrangement starts, with TM-G-1 and OR-2 covering technology risk and operational resilience. On 8 January 2026 the HKMA issued its Practice Guide on Cloud Adoption, widening coverage from four cloud domains to eight and expecting BYOK or HYOK key models that keep encryption keys under the institution rather than the provider. Cloud is now roughly 80% of reportable technology projects among Hong Kong banks, so key custody on AWS, Terraform state and Zero-Trust Security are board-level artefacts on a Hong Kong finance build.SFC records: 7 years, 2 years, two named humans
The Securities and Futures (Keeping of Records) Rules require client agreements and related records for at least 7 years and order records for at least 2 years. The SFC circular of 31 October 2019 permits those Regulatory Records to sit with an external electronic data storage provider only if at least two Managers-In-Charge in Hong Kong hold read access and the SFC obtains access without undue delay. In Hong Kong we build that as append-only PostgreSQL partitions, an Immutable Audit Trail, SSO with hardware keys and RBAC scoped to those two roles.Insurance Authority GL20 for Hong Kong insurers
The revised GL20 Guideline on Cybersecurity took effect on 1 January 2025 and runs on three parts — inherent risk assessment, cybersecurity maturity assessment and threat intelligence-based attack simulation — with the first two repeated at least every three years. A Hong Kong insurance group needs control evidence queryable on that cadence, so we wire Sentry, OpenTelemetry Observability, Semgrep SAST and OWASP ZAP output into the same Postgres store as the ERP.Doxxing powers changed the exposure profile
The Personal Data (Privacy) (Amendment) Ordinance 2021 took effect on 8 October 2021, criminalising doxxing and giving the Privacy Commissioner criminal investigation and cessation-notice powers; between then and 31 December 2025 the PCPD issued 2,104 cessation notices to 57 platforms. For a Hong Kong CRM or retail loyalty database that raises the cost of over-collecting contact data, so Hong Kong builds default to field-level minimisation, GDPR-style subject-access tooling and short JWT lifetimes.Transfer pricing files are a reporting requirement
Hong Kong master file and local file obligations bite unless the entity meets two of three tests — revenue not more than HK$400 million, assets not more than HK$300 million, headcount not more than 100 — and country-by-country reporting starts at HK$6.8 billion. A Hong Kong trading group running Pearl River Delta manufacturing needs intercompany flows tagged at posting time: a PostgreSQL modelling decision made once, not something Sage X3 or Microsoft Dynamics 365 decides for you.
Engineering Blueprint
ap-east-1 (Hong Kong) is an opt-in AWS region, disabled by default on every account — unlike ap-southeast-1 or eu-west-2 — so a Hong Kong build starts with region enablement, region-scoped service control policies and a Terraform provider block that inherits nothing. It launched 25 April 2019 with three Availability Zones; Microsoft Azure East Asia is the pair, and the PostgreSQL primary sits in AWS ap-east-1 behind Next.js and Drizzle ORM. That one flag is why a Hong Kong cloud migration copied from a Singapore runbook fails on day one, before Terraform has provisioned a single PostgreSQL row.
The mainland boundary is a schema boundary
A Hong Kong entity operating into Guangdong falls under PIPL, the Cybersecurity Law and the Data Security Law for anything collected there, and the CAC Provisions of 22 March 2024 set the outbound routes: no standard contract below 100,000 individuals a year, standard contract or certification above it. The Greater Bay Area standard contract, released 13 December 2023, is the voluntary Hong Kong path. ERPStack never replicates one PostgreSQL database across that line — we split tenancy at it and keep the Hong Kong and mainland API surfaces on separate JWT audiences and separate AWS accounts.
-- PostgreSQL row-level policy: mainland rows never resolve in the Hong Kong tenant
ALTER TABLE counterparty ENABLE ROW LEVEL SECURITY;
CREATE POLICY gba_boundary ON counterparty
USING (
residency = current_setting('app.residency', true)
AND (residency <> 'cn' OR current_setting('app.gba_contract', true) = 'filed')
);No GST, so the tax surface is the return
Hong Kong has no VAT or GST and therefore no e-invoicing clearance mandate — the opposite of Singapore. The pressure sits a layer up: profits tax is two-tiered at 8.25% on the first HK$2 million of assessable profits and 16.5% above for corporations, and the Inland Revenue Department made e-filing of the profits tax return mandatory from the year of assessment 2025/26 for Hong Kong entities in MNE groups over the EUR 750 million Pillar Two threshold, with financial statements and tax computations tagged in iXBRL. A Headless ERP with an API-first ledger traces a tagged figure back to its posting; an extract layer bolted onto SAP or NetSuite does not.
MPF and the 468 rule in payroll
Hong Kong MPF contributions are 5% from each side on relevant income between HK$7,100 and HK$30,000 a month, capping employer and employee at HK$1,500 each, and offsetting against severance and long service payments ended on 1 May 2025. On 18 January 2026 the Employment Ordinance replaced the 418 rule with the 468 rule: four consecutive weeks plus 17 hours a week, or 68 hours across the window. Hong Kong part-time rosters now change statutory entitlement, so the roster feeds payroll through an event-driven Node.js job, with Vitest cases pinned to both thresholds and Sentry alerting on the boundary.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Hong Kong
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyTarget Industries in Hong Kong
Frequently Asked Questions
In Hong Kong the trigger is the return, not the invoice. There is no VAT or GST and therefore no e-invoicing clearance mandate. Instead the Inland Revenue Department made e-filing of the profits tax return mandatory from the year of assessment 2025/26 for Hong Kong entities inside MNE groups above the EUR 750 million Pillar Two threshold, with financial statements and tax computations tagged in iXBRL. That is a data-lineage problem the ERP owns.
Odoo is often right for a Hong Kong trading company under a few hundred staff: multi-currency, purchase-to-pay and light assembly ship out of the box. SAP S/4HANA earns its cost once the Hong Kong entity consolidates Pearl River Delta factories on a group template. Build custom when the margin sits where neither reaches — back-to-back letters of credit, bonded re-export, or supplier chargebacks across the boundary.
Both are arithmetic the ledger should own. MPF mandatory contributions are 5% from employer and 5% from employee on relevant income between HK$7,100 and HK$30,000 a month, capping each side at HK$1,500. From 18 January 2026 Hong Kong replaced the 418 rule with the 468 rule: four consecutive weeks plus 17 hours a week, or 68 hours across that window. Part-time rosters now change statutory entitlement.
ERPStack is remote-first: no Hong Kong entity, no local staff, no local address. The deployment is local — ap-east-1 (Hong Kong) with three Availability Zones — and accountability stays where the regulator expects it. Under the SFC circular on external electronic data storage your licensed corporation designates at least two Managers-In-Charge in Hong Kong who can produce Regulatory Records on demand. That role is yours; we build the access path.
No, and this is the fact most vendor pages get wrong. Section 33 of the Personal Data (Privacy) Ordinance (Cap. 486), the cross-border transfer restriction, was enacted in 1995 and has never been brought into force. The PCPD publishes non-binding guidance and recommended model clauses instead. Hong Kong data-residency obligations therefore come from contracts, from the HKMA and the SFC, and from mainland law — not from the PDPO.
Notification first, evidence second. Under Supervisory Policy Manual module SA-2 on outsourcing, a Hong Kong authorized institution notifies the HKMA generally three months before a public-cloud arrangement commences. On 8 January 2026 the HKMA issued its Practice Guide on Cloud Adoption, widening coverage from four cloud domains to eight and setting expectations on key control — BYOK and HYOK models that keep keys under the institution — and on exit.
Under the Securities and Futures (Keeping of Records) Rules, client agreements and related records are kept at least 7 years and order records at least 2 years. The SFC circular of 31 October 2019 lets those Regulatory Records sit with an external electronic data storage provider provided at least two Managers-In-Charge in Hong Kong hold read access and the SFC obtains access without undue delay.
It is the voluntary route for moving personal information between the mainland and Hong Kong. The Cyberspace Administration of China and Hong Kong’s Innovation, Technology and Industry Bureau released the implementation guidelines on 13 December 2023, and the PCPD published matching guidance the same day. If a Hong Kong ERP reads customer records out of a Guangdong subsidiary, the standard contract is usually the cheapest lawful path — and it forces a residency column.
GL20 binds; SOC 2 persuades. In Hong Kong the Insurance Authority’s revised GL20 Guideline on Cybersecurity took effect 1 January 2025 and requires an inherent risk assessment and a cybersecurity maturity assessment at least every three years, plus threat intelligence-based attack simulation for higher-risk insurers. SOC 2 is what your enterprise buyers ask for. ERPStack builds Hong Kong systems auditable against both, and holds neither certification itself.