B2B Software Consulting in Seattle
Washington's My Health My Data Act reaches any product that infers health status from ordinary data, which makes Seattle the hardest US market to retrofit. ERPStack is remote-first: we deploy into us-west-2-sea-1a and Microsoft Azure West US 2, building ERP schemas that carry consent, B&O class and export-control flags.
Quick Answer
In short: a Seattle ERP is shaped by the My Health My Data Act, ch. 19.373 RCW, by Washington's B&O gross-receipts classification rather than a sales tax, and by ITAR technical-data residency for aerospace suppliers. ERPStack builds it remote-first in AWS us-west-2 with the Seattle Local Zone us-west-2-sea-1a, and you keep the source code.
Regional Compliance
- My Health My Data Act (ch. 19.373 RCW)
- Washington Biometric Privacy Act (ch. 19.375 RCW)
- Breach notice in 30 days (RCW 19.255.010)
- ITAR encrypted technical data (22 CFR 120.54)
- 2 CFR 200 grant cost principles
Security & Compliance Architecture
Seattle compliance is not SOC 2 paperwork. It is the My Health My Data Act, ch. 19.373 RCW, Washington’s alone, and it lands in the ERP schema rather than the privacy policy.
Inferences count as health data
RCW 19.373.010 sweeps in data extrapolated from non-health inputs by algorithms, so a Seattle wellness score is regulated where HIPAA never reaches. Derived PostgreSQL columns carry lineage tags, and RBAC plus deletion follow the tag.Selling needs a signed authorization
RCW 19.373.070 demands one separate from consent, expiring 1 year after signature and retained 6 years: an authorization ledger, an immutable audit trail, and an ERP export API that will not run without a live row.Seattle consumers sue you directly
RCW 19.373.090 makes a violation an unfair act under the Consumer Protection Act, unlike ch. 19.375 RCW biometric duties, which only the attorney general enforces. Breach notice runs 30 days, so multi-tenant PostgreSQL logs stay append-only for discovery.
Engineering Blueprint
In Seattle, “keep it in state” is a real architecture decision: the nearest full AWS region, us-west-2, sits in Oregon, so AWS capacity inside Washington means the us-west-2-sea-1a Local Zone, while Microsoft Azure runs a complete West US 2 region in-state. Seattle ERP builds — Next.js and TypeScript over PostgreSQL — split across both.
B&O tax is a ledger field
Washington taxes gross receipts with no deduction for costs, so every Seattle revenue row carries a B&O class: 0.471% retailing, 0.484% wholesaling and manufacturing, services at 1.5%, 1.75% or 2.1% by prior-year gross, under Seattle’s own 0.342% and 0.658% 2026 rates. Those stay PostgreSQL data under Drizzle ORM, never ERP branching logic.
// Drizzle ORM: the B&O class travels with the revenue line
export const revenueLine = pgTable('revenue_line', {
boClass: text('bo_class').notNull(), // retailing | wholesaling | service
stateRate: numeric('state_rate'), // 0.00471 | 0.00484 | 0.021
cityRate: numeric('city_rate'), // 0.00342 | 0.00658
});Payroll reads every band
Seattle’s payroll expense tax engages at $9,074,409 of 2025 Seattle payroll plus one employee paid $194,452 or more, then steps 0.746% to 2.557% by band. No NetSuite or Odoo localisation ships it, so the ERP owns that per-employee calculation.
Seattle global-health grant ledgers
Seattle’s global-health ngo cluster posts pass-through money against 2 CFR 200: a 15% de minimis indirect rate on modified total direct costs, and a single audit past $1,000,000 expended. Award and sub-award ledgers stay separable in multi-tenant PostgreSQL.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Seattle
Target Industries in Seattle
Frequently Asked Questions
Classify revenue before it posts. Washington's B&O tax hits gross receipts with no deduction for costs — 0.471% retailing, 0.484% wholesaling and manufacturing, 1.5% to 2.1% on services — so a Seattle ERP holds the class on the revenue row in PostgreSQL under Drizzle ORM, beside Seattle's 0.342% and 0.658% city rates.
SAP S/4HANA wins when your Seattle plant runs a parent's global template and consolidation beats fit. A custom ERP wins when AS9100 aerospace standard traceability and ITAR residency drive the build: that is schema and workflow design, and no NetSuite, Odoo or Epicor localisation ships Washington's B&O classification.
No. us-west-2 is in Oregon, and the only AWS capacity physically in Washington is the us-west-2-sea-1a Local Zone, which serves compute and storage but not every managed service. Microsoft Azure's West US 2 region sits inside Washington with availability zones, so for a Seattle build the PostgreSQL primary runs there, with Terraform-managed peering to AWS.
The Seattle payroll expense tax, because it reads each employee's compensation band, not a company total: it engages at $9,074,409 of prior-year Seattle payroll with one employee paid $194,452 or more, then runs 0.746% to 2.557%. It is a city filing, so the Seattle ERP computes it per pay period.
Yes. Washington's My Health My Data Act (ch. 19.373 RCW) governs consumer health data, and RCW 19.373.010 counts data extrapolated from non-health inputs by algorithms or machine learning. A step-derived wellness score is regulated in Seattle even where HIPAA never applies, so the ERP tags derived PostgreSQL columns, not only source ones.
A separate written authorization. RCW 19.373.070 requires it distinct from collection consent, naming the data, seller and purchaser, expiring one year after signature and retained six years. In a Seattle ERP that is an authorization ledger with an immutable audit trail plus an export API that blocks without a live row.
Yes, and that is Washington's differentiator. RCW 19.373.090 makes a violation an unfair act under the Consumer Protection Act, which carries a private right of action. The biometric statute, ch. 19.375 RCW, binds only the attorney general, so Seattle ERP audit tables stay append-only in PostgreSQL, sized for discovery not a SOC 2 sample.
In us-west-2 or Microsoft Azure West US 2, provided it stays end-to-end encrypted. 22 CFR 120.54(a)(5) treats encrypted technical data as not exported when FIPS 140-2 modules are used, decryption never reaches a third party, and nothing is stored in a 22 CFR 126.1 country — key management inside the Seattle aerospace ERP.