B2B Software Consulting in New York
New York software is examined, not just bought: 23 NYCRR Part 500 for anything DFS licenses, the SHIELD Act for everyone else, and NYC Local Law 144 the moment an algorithm touches hiring. ERPStack is remote-first — we build your custom ERP into AWS us-east-1 with the us-east-1-nyc-2a Local Zone, and generate the evidence from the PostgreSQL schema.
Quick Answer
In short: custom software development for New York teams runs into two rulebooks at once: the SHIELD Act's reasonable-safeguards duty under GBL § 899-bb, and, for DFS-licensed firms, 23 NYCRR Part 500, whose final phase landed on 1 November 2025 with MFA for every individual and a documented asset inventory. ERPStack builds SaaS architecture and ERP for New York in AWS us-east-1 — six Availability Zones — with the us-east-1-nyc-2a Local Zone at the edge.
Regional Compliance
- 23 NYCRR Part 500, Second Amendment — effective 1 November 2023
- 23 NYCRR 500.12 MFA and 500.13(a) asset inventory — in force since 1 November 2025
- 23 NYCRR 500.17 — 72-hour incident notice, 24-hour extortion-payment notice
- NY GBL § 899-bb safeguards; § 899-aa 30-day breach notice, DFS added in 2024
- NYC Local Law 144 — AEDT bias audit, enforced since 5 July 2023
- SEC Rule 17a-4 electronic records and FINRA Rule 4511 six-year retention
Security & Compliance Architecture
Three regimes overlap in New York: 23 NYCRR Part 500 if the Department of Financial Services licenses you, the SHIELD Act if it does not, and NYC Local Law 144 the moment an algorithm touches hiring. Each one is a schema decision.
72 hours, then 24, then 30
Section 500.17 gives 72 hours from determining a cybersecurity incident occurred, 24 hours to report an extortion payment, and 30 days to file the written explanation of why it was necessary. A New York system that logs Sentry alerts into PostgreSQL but never records a determination cannot evidence any of the three, so ERPStack writes the determination row itself.
Local Law 144 audits what you recorded
DCWP has enforced Local Law 144 since 5 July 2023: an automated employment decision tool needs an independent bias audit within one year of use, published results, and 10 business days of notice to candidates. That obliges a New York build to store the model version and the scored input alongside the decision, as an Immutable Audit Trail in PostgreSQL.
The evidence a New York examiner asks for
Access reviews come from the RBAC tables in PostgreSQL, MFA coverage from the SSO provider, the asset inventory from Terraform state, change history from GitHub Actions, incident timelines from Sentry and the Immutable Audit Trail, and retention proof from AWS object storage under a lock. A New York ERP that generates its own SOC 2 and ISO 27001 artefacts answers an examination with a query, which is how ERPStack builds them.
The SHIELD Act reaches everyone else
GBL § 899-bb requires reasonable administrative, technical and physical safeguards for the private information of any New York resident. Amendments signed 21 December 2024 added a 30-day breach-notification deadline, added DFS to the notified regulators, and pulled medical and health-insurance information into scope.Retention runs on two clocks
SEC Rule 17a-4(b) requires not less than three years, the first two easily accessible; FINRA Rule 4511(b) requires at least six years where nothing else is specified. A New York broker-dealer affiliate gets a retention policy per record class in PostgreSQL under Drizzle ORM, with AWS object storage under a lock, never one blanket purge.
Engineering Blueprint
New York work is examined, not merely delivered. The PostgreSQL primary sits in AWS us-east-1 — six Availability Zones — with latency-sensitive compute pushed to the us-east-1-nyc-2a Local Zone, which AWS itself describes as located in New Jersey. Next.js and TypeScript on Vercel on top; Terraform and GitHub Actions underneath, with PostgreSQL and Drizzle ORM in between.
MFA everywhere, since 1 November 2025
The final phase of the Second Amendment to 23 NYCRR Part 500 moved section 500.12 from remote and privileged access to any individual accessing any information system. ERPStack implements it as an SSO boundary in front of every New York surface — admin, REST API and job runner — with RBAC in PostgreSQL and short-lived JWT sessions rather than a second password.
The asset inventory is a table, not a spreadsheet
Section 500.13(a) wants a complete, documented inventory recording owner, location, classification, support expiration date and recovery time objective. In a New York build that is a first-class entity in PostgreSQL under Drizzle ORM, populated from Terraform state and GitHub Actions, so the New York inventory is a query rather than a quarterly re-typing exercise.
What a New York ERP has to sit beside
A New York estate is rarely empty. SAP S/4HANA or Oracle NetSuite carries the statutory books, Salesforce or HubSpot carries the pipeline, and the custom ERP takes the regulated workflow neither models — joined over a REST or GraphQL API and migrated with a Strangler Fig Migration Pattern. Microsoft Dynamics 365, Odoo and Epicor ERP show up in New York mid-market groups, and ERPStack reads each into PostgreSQL through Drizzle ORM with Idempotency in API Design on every feed.
What a New York build actually runs on
Next.js and TypeScript on Vercel or AWS, a PostgreSQL primary behind Drizzle ORM, RBAC and SSO with short-lived JWT sessions, Redis for queues, an Immutable Audit Trail, Terraform and GitHub Actions in CI, Sentry for observability and Semgrep SAST on every pull request. SOC 2 and ISO 27001 evidence for a New York firm falls out of the PostgreSQL schema, and the whole stack redeploys from the repository into AWS us-east-1.
A determination timestamp the clock can start from
// Drizzle ORM — 23 NYCRR 500.17 notice clocks
export const incidents = pgTable('incidents', {
id: uuid('id').primaryKey().defaultRandom(),
determinedAt: timestamp('determined_at', { withTimezone: true }),
dfsNoticeDueAt: timestamp('dfs_notice_due_at'), // determinedAt + 72h
extortionPaidAt: timestamp('extortion_paid_at'), // + 24h notice
});Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in New York
Field Operations & Compliance Portal
Unified operational portal for field tracking and compliance
Read Case StudyTarget Industries in New York
Frequently Asked Questions
The last two transitional items. Section 500.12 now requires multi-factor authentication for any individual accessing any information system of a covered entity, not only remote or privileged access, and section 500.13(a) requires a complete, documented asset inventory recording owner, location, classification, support expiration date and recovery time objective. For a New York build both are PostgreSQL schema features: an SSO integration with RBAC, and an inventory the New York ERP maintains from Terraform state rather than a spreadsheet somebody updates.
Within 72 hours of determining that a cybersecurity incident occurred, under 23 NYCRR 500.17(a). If an extortion payment is made, notice goes to the Superintendent within 24 hours and a written explanation of why payment was necessary within 30 days. A New York system therefore needs a determination timestamp, not just an alert: we write the determination event into an append-only PostgreSQL table so the clock is evidenced rather than reconstructed later.
Yes. GBL § 899-bb requires any business holding private information of a New York resident to develop, implement and maintain reasonable administrative, technical and physical safeguards. The amendments signed on 21 December 2024 added a 30-day breach-notification deadline, added DFS to the regulators who must be told, and brought medical and health-insurance information into the definition of private information — which widens what a general B2B system has to encrypt and log.
If it substantially assists an employment decision in New York City, yes. DCWP began enforcing Local Law 144 on 5 July 2023: the tool needs an independent bias audit within one year of use, the audit results published, and notice to candidates or employees at least 10 business days before use. In practice the New York ERP has to record which model version scored whom in PostgreSQL, because an auditor cannot audit what was never written down.
Yes, since the 2022 amendments. Rule 17a-4(f)(2)(i) now lets an electronic recordkeeping system either preserve records exclusively in a non-rewriteable, non-erasable format or maintain a complete time-stamped audit trail of every modification and deletion; the broker-dealer compliance date was 3 May 2023. A New York affiliate can therefore run a hash-chained PostgreSQL journal under Drizzle ORM, with 17a-4(b)'s three-year retention — the first two years easily accessible — expressed as policy in the schema and AWS object storage under a lock.
Not a region — a Local Zone. AWS us-east-1 in Northern Virginia has six Availability Zones and is the parent region; the New York City Local Zone is us-east-1-nyc-2a, which AWS itself describes as located in New Jersey. A New York build normally puts the PostgreSQL primary in us-east-1 and pushes latency-sensitive compute into the Local Zone, rather than pretending there is a region under Manhattan.
FINRA Rule 4511(b) requires at least six years for books and records with no other specified period, and 4511(c) ties the format and media back to SEC Rule 17a-4. Because Exchange Act records under 17a-4(b) run three years with the first two easily accessible, a New York broker-dealer affiliate ends up with two retention clocks. We model them as separate policies per record class rather than one blanket purge rule.
If you set a price with an algorithm that uses personal data, yes. GBL § 349-a, enacted as part of Chapter 58 of the Laws of 2025, requires a clear and conspicuous disclosure reading "THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA", with carve-outs for insurers and GLBA-covered financial institutions. For a New York commerce build that is a pricing-decision log plus a rendering rule, not a legal footnote.
A separate balance. NY Labor Law § 196-b requires every employer to provide 20 hours of paid prenatal personal leave in any 52-week period on and after 1 January 2025, on top of the city paid safe and sick time entitlement. A New York payroll schema that models one leave bucket will misreport it, so we model accrual, usage and the 52-week window as their own rows.