B2B Software Consulting in Portland
Oregon lets a consumer demand the list of specific third parties that received their data, so Portland systems need per-disclosure lineage in the schema, not category tags. ERPStack is remote-first: we build that lineage into PostgreSQL under Drizzle ORM and deploy into us-west-2, the Oregon region itself.
Quick Answer
In short: custom ERP development in Portland turns on the Oregon Consumer Privacy Act duty to name the specific third parties you disclosed personal data to, and on the corporate activity tax rather than a sales tax. ERPStack keeps that disclosure list queryable in PostgreSQL and hosts the Portland ERP in-state on AWS us-west-2.
Regional Compliance
- Oregon Consumer Privacy Act (ORS 646A.570-589)
- Specific third-party list (ORS 646A.574)
- Corporate activity tax (ORS 317A.125)
- UFLPA import traceability (Pub. L. 117-78)
- Paid Leave Oregon payroll contributions
Security & Compliance Architecture
The Oregon Consumer Privacy Act, effective 1 July 2024, asks Portland companies for something category-level privacy programmes cannot answer, and it is a schema problem before it is a policy problem.
Named recipients, not categories
ORS 646A.574(1)(a)(B) lets an Oregon consumer demand a list of the specific third parties that received personal data. Category disclosure fails it, so a Portland ERP needs per-event lineage in PostgreSQL, a third-party registry with stable identifiers, and RBAC over who may add one.45 days, one extension, then an appeal
ORS 646A.576 gives 45 days to answer, one 45-day extension, and a documented appeal decided within 45 days. That is an ERP queue with SLA timers and an immutable audit trail, not an inbox — and OCPA biometric data reaches gait and voiceprints.The cure period ended in 2026
Since 1 January 2026 the Oregon Department of Justice need not offer 30 days to cure, and penalties reach $7,500 per violation. Portland apparel and logistics teams carry a second burden: UFLPA has presumed Xinjiang-linked goods inadmissible since June 2022 unless clear and convincing evidence says otherwise, which is bill-of-materials traceability.
Engineering Blueprint
Portland is the rare US city whose cloud is genuinely local: AWS us-west-2 is the Oregon region itself, with the us-west-2-pdx-1a Local Zone in-metro for latency-bound work, access on request. Microsoft Azure has no Oregon region, so Oregon-only clauses point at AWS. Portland ERP builds run Next.js and TypeScript over PostgreSQL, no cross-region hop.
Disclosure lineage is a table
Oregon consumers can demand the list of specific third parties that received their data, so a Portland ERP cannot store disclosure as a category flag. Every share, every API call and every CRM sync writes a PostgreSQL row naming the recipient, and Drizzle ORM joins it back to the subject on request.
// ORS 646A.574(1)(a)(B): named recipients, not categories
export const disclosure = pgTable('disclosure', {
subjectId: uuid('subject_id').notNull(),
recipient: text('recipient').notNull(), // legal entity name
purpose: text('purpose').notNull(),
disclosedAt: timestamp('disclosed_at').defaultNow(),
});No sales tax, still a tax engine
Oregon levies no statewide retail sales tax, which is why retail distribution and logistics sit here — but the Portland ERP still computes the corporate activity tax at $250 plus 0.57% of commercial activity above $1,000,000, less 35% of the greater of cost inputs or labour, plus Portland’s 1% clean-energy surcharge on large retailers.
Four withholdings on one Portland payslip
A Portland ERP payroll run carries Paid Leave Oregon at 1% of wages to $184,500 split 40/60, the 0.1% statewide transit tax, Metro’s 1% above $128,000 single and $205,000 joint for 2026, and Multnomah County’s 1.5% plus 1.5% preschool tax — four rules no NetSuite or Odoo payroll module ships.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Portland
Order-to-Cash & GST Compliance Engine
GST-compliant invoicing, consignment settlement, and receivables automation for a D2C handcraft brand
Read Case StudyTarget Industries in Portland
Frequently Asked Questions
It has plenty. Oregon charges no statewide retail sales tax, but a Portland ERP still calculates the corporate activity tax of $250 plus 0.57% of commercial activity above $1,000,000, less 35% of the greater of cost inputs or labour, plus the 1% Portland clean-energy surcharge on retailers above $1 billion national revenue.
NetSuite is the faster route when your Portland catalogue is stable and finance wants a closed book. A custom ERP earns its keep when UFLPA traceability, PLM data and lot-level genealogy have to meet in one PostgreSQL model — that is schema work, and NetSuite, Odoo and Microsoft Dynamics 365 all stop at the bill of materials.
Usually all four. A Portland payslip carries Paid Leave Oregon at 1% of wages to $184,500 with a 40/60 employer-employee split, the 0.1% statewide transit tax in force since 1 July 2018, Metro's 1% supportive housing tax, and Multnomah County's 1.5% plus 1.5% preschool tax, each with separate withholding rules.
Yes, and Portland is unusual in that. AWS us-west-2 is the Oregon region, so the PostgreSQL primary, object storage and CI runners sit in-state with no cross-region hop, while the us-west-2-pdx-1a Local Zone adds in-metro capacity on request for latency-bound manufacturing and logistics workloads. Microsoft Azure has no Oregon region.
Named companies, not categories. ORS 646A.574(1)(a)(B) lets an Oregon consumer demand a list of the specific third parties that received their personal data or any personal data. A Portland ERP therefore logs every disclosure as a PostgreSQL row against a third-party registry, because category-level notices and CRM exports cannot answer it.
45 days. ORS 646A.576 requires a response without undue delay and no later than 45 days, allows one 45-day extension when reasonably necessary, and requires an appeal path decided within 45 days of receipt. In a Portland ERP that is a request queue with SLA timers and an immutable audit trail.
Often yes. The Oregon Consumer Privacy Act covers controllers processing personal data of 100,000 or more consumers, with no revenue threshold on that limb, or 25,000 consumers where more than 25% of gross revenue comes from selling data. A Portland SaaS product crosses the first threshold long before the second.
No longer. Since 1 January 2026 the Oregon Department of Justice is not required to give notice and an opportunity to cure, whatever the violation, and civil penalties reach $7,500 per violation. For Portland teams that moves privacy engineering into the ERP schema: lineage, deletion and consent must hold on day one.