B2B Software Consulting in Mumbai
Mumbai is where India's financial regulators physically sit — SEBI Bhavan at C-4A in BKC, the NSE at Exchange Plaza, RBI's payment-data localisation circular of 6 April 2018. ERPStack is remote-first: we deploy your custom ERP into AWS ap-south-1, keep the ledger append-only, and put RBI's outsourcing clauses in the contract.
Quick Answer
In short: custom ERP development for Mumbai BFSI and capital-markets teams starts with two rules: RBI's payment-data localisation circular of 6 April 2018 keeps the whole payment record inside India, and SEBI's Reg. 3(5) forbids outsourcing the insider-trading database. ERPStack engineers a Mumbai ERP to both, on AWS ap-south-1 with an append-only PostgreSQL ledger.
Regional Compliance
- RBI Storage of Payment System Data (circular of 6 April 2018)
- RBI Master Direction — Outsourcing of IT Services (10 April 2023)
- SEBI Cybersecurity and Cyber Resilience Framework (20 August 2024)
- SEBI (Prohibition of Insider Trading) Regulations 2015, Reg. 3(5)
- DPDP Act 2023 and DPDP Rules 2025 (G.S.R. 846(E))
- CERT-In Directions under Section 70B(6), 28 April 2022
Security & Compliance Architecture
Mumbai’s regulators are not abstractions: SEBI Bhavan stands at Plot C-4A in BKC, the NSE at Exchange Plaza across the road. Four instruments decide how a Mumbai ERP is engineered, and each lands in the PostgreSQL schema rather than in a policy PDF.
Two log clocks run at once in Mumbai
CERT-In’s Directions of 28 April 2022 require ICT logs kept 180 days inside Indian jurisdiction and incidents reported within six hours. DPDP Rule 8(3) separately requires personal data, traffic data and processing logs for at least one year, and Rule 7(2)(b) allows 72 hours to file detail with the Data Protection Board. So a Mumbai OpenTelemetry Observability pipeline terminates in ap-south-1, with Sentry Observability Platform events routed to an in-region sink and a 12-month WORM Storage (Write Once Read Many) tier.
SEBI CSCRF as build criteria
SEBI’s Cybersecurity and Cyber Resilience Framework of 20 August 2024, compliance extended to 30 June 2025 for most regulated entities, is organised around anticipate, withstand, contain, recover, evolve. We ship it as Zero-Trust Security defaults: Multi-Factor Authentication (MFA) on every admin path, RBAC per desk, Semgrep SAST in GitHub Actions — so a Mumbai broker’s SOC 2 and ISO 27001 evidence is a pipeline artefact.
Payment localisation reaches your vendors
RBI’s circular DPSS.CO.OD.No.2785/06.08.005/2017-18 of 6 April 2018 gave six months to put the entire payment-system data set in a system only in India, and a Mumbai bank counts as non-compliant if its processor is not — which rules out cross-region PostgreSQL replicas and offshore Redis caches at design time.RBI outsourcing clauses we have to satisfy
The Master Direction on Outsourcing of Information Technology Services of 10 April 2023, effective 1 October 2023, demands a documented exit strategy and keeps RBI’s right to audit the provider. We answer with Terraform, Infrastructure as Code (IaC) and CI/CD Deployment Pipelines a Mumbai inspection can re-run.DPDP duties land in 2026 and 2027
A Mumbai insurer notified a Significant Data Fiduciary owes an annual Data Protection Impact Assessment and audit under Rule 13(1) and a 90-day path under Rule 14(3). The Data Subject Access Request (DSAR) route is a queued PostgreSQL job with Row-Level Security (RLS), not a mailbox.
Engineering Blueprint
A Mumbai ERP is a residency problem before it is a performance problem. We build on AWS ap-south-1 — three zones, aps1-az1 to aps1-az3 — with Next.js and TypeScript over a PostgreSQL primary that keeps no replica outside India, because RBI’s circular of 6 April 2018 puts the whole payment record inside the country.
Zone redundancy: Azure West India has none
One fact sets the Mumbai topology. Microsoft Azure’s West India region is physically Mumbai and carries no availability zones; Central India, which has them, is physically Pune, 150 km inland. A zone-redundant Microsoft Azure deployment for a Mumbai buyer therefore lands in another city, while AWS ap-south-1 holds three zones inside Mumbai itself. We default Mumbai finance and insurance workloads to ap-south-1 and keep Azure Central India as the paired recovery target.
Keys that never leave the region
Residency is not only rows. Master keys live in AWS Key Management Service (KMS) in ap-south-1, envelope encryption wraps the PostgreSQL column keys, and the Virtual Private Cloud (VPC) has no peering outside India. An RBI inspection of a Mumbai lender then sees one region code, one key ARN and one Bastion Host — not a diagram with an unexplained arrow leaving the country.
Reconciling against a T+1 market
Indian equities have settled T+1 since 27 January 2023, with an optional T+0 beta since 28 March 2024, so a back office in BKC or Nariman Point reconciles overnight, not across two nights. We model obligations as an Event-Driven Architecture: broker, custodian and bank feeds hit idempotent REST endpoints keyed by settlement date, post into an append-only PostgreSQL ledger, and surface through Drizzle ORM under Role-Based Access Control (RBAC).
The UPSI table SEBI will not let you outsource
For a listed Mumbai issuer, Reg. 3(5) forbids outsourcing the structured digital database, so Drizzle ORM provisions it inside your own AWS account — hash-chained, and an Immutable Audit Trail at the grant level.
// Drizzle ORM — SEBI PIT Reg. 3(5) structured digital database
export const upsiAccessLog = pgTable('upsi_access_log', {
id: uuid('id').primaryKey().defaultRandom(),
upsiNature: text('upsi_nature').notNull(),
sharedByPan: varchar('shared_by_pan', { length: 10 }).notNull(),
sharedAt: timestamp('shared_at', { withTimezone: true }).defaultNow(),
prevHash: char('prev_hash', { length: 64 }).notNull(),
residency: varchar('residency').default('ap-south-1').notNull(),
});
// REVOKE UPDATE, DELETE ON upsi_access_log FROM erp_app;Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Mumbai
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyOrder-to-Cash & GST Compliance Engine
GST-compliant invoicing, consignment settlement, and receivables automation for a D2C handcraft brand
Read Case StudyTarget Industries in Mumbai
Frequently Asked Questions
No. RBI's circular DPSS.CO.OD.No.2785/06.08.005/2017-18 of 6 April 2018 requires the entire payment-system data set to be stored in a system only in India, and it makes the bank answerable for its vendors. For a Mumbai fintech that means AWS ap-south-1 only — no cross-region PostgreSQL replica, no offshore Redis cache.
For a small Mumbai NBFC, Tally Prime is the honest answer: 2.5 million-plus Indian businesses run it and it files GST well. It stops being enough when you need Role-Based Access Control (RBAC) per branch, an Immutable Audit Trail an RBI inspection can read, and an API reconciling a core banking feed. That is where custom ERP development pays.
Single-digit milliseconds inside the metro is a realistic design target: Mumbai holds the largest share of India's operational data-centre supply, 34% of 1,520 MW as of 2025, so peering into ap-south-1 is dense. Those are engineering targets we load-test, not measured SLAs. An ERP is not a co-located trading system — microsecond work needs exchange colocation, not ERPStack.
Usually not. For most Mumbai groups the right move is a Strangler Fig Migration Pattern: SAP S/4HANA keeps the statutory books while we build treasury reconciliation, depository feeds and partner portals in Next.js and TypeScript over PostgreSQL, joined by a REST boundary. Full replacement only pays when licence and change costs exceed a rebuild.
Yes. Regulation 3(5) of the SEBI (Prohibition of Insider Trading) Regulations, 2015 says the database shall not be outsourced and must be kept internally with time stamping and audit trails ensuring non-tampering. For a listed Mumbai company that rules out vendor-hosted multi-tenant SaaS: ERPStack builds the UPSI log inside your own AWS ap-south-1 account with Row-Level Security (RLS).
The RBI Master Direction on Outsourcing of Information Technology Services, dated 10 April 2023 and effective 1 October 2023, requires a documented exit strategy preserving business continuity, and keeps both the lender's and RBI's right to audit the provider. We answer it with Terraform, Infrastructure as Code (IaC) and open-format PostgreSQL exports a Mumbai inspection team can re-run.
Two clocks run. The CERT-In Directions of 28 April 2022 require ICT logs kept 180 days inside Indian jurisdiction, incidents reported within six hours. DPDP Rule 8(3) requires personal data, traffic data and processing logs for at least one year. So a Mumbai OpenTelemetry Observability pipeline cannot terminate in a US-hosted log SaaS.
The DPDP Rules, 2025 were published on 14 November 2025. Rule 4, Consent Manager registration, commences one year later; Rules 3 and 5 to 16 — notice, security safeguards, breach intimation, Significant Data Fiduciary duties — eighteen months later, in May 2027. A Mumbai breach reaches the Data Protection Board within 72 hours; the security ceiling is ₹250 crore.
Yes. Indian equities completed T+1 on 27 January 2023 and an optional T+0 beta began 28 March 2024, so a Mumbai back office reconciles overnight, not across two nights. That forces Idempotency in API Design on every obligation feed and a PostgreSQL ledger that replays a day without double-booking.