B2B Software Consulting in Seoul
Seoul enterprise deals are gated by an audit, not a demo: ISMS-P certification under Article 47 of the Network Act, and for financial buyers the 망분리 network-separation rule the FSC only partly relaxed on 20 April 2026. ERPStack is remote-first and designs around both, in PostgreSQL on AWS ap-northeast-2.
Quick Answer
In short: a Seoul ERP has to produce ISMS-P audit evidence, transmit NTS e-Tax invoices, and respect the 망분리 network-separation split for financial workloads. ERPStack builds it on PostgreSQL in AWS ap-northeast-2, four Availability Zones and under 12 ms across Seoul, with PIPA handling and CSAP-aware design for public-sector work.
Regional Compliance
- Personal Information Protection Act (PIPA), enforced by the PIPC
- ISMS-P certification under Article 47 of the Network Act
- NTS e-Tax Invoice (전자세금계산서) issuance and transmission
- Electronic Financial Transactions Act — network separation (망분리)
- CSAP (Cloud Security Assurance Program) for public-sector work
- SOC 2 and ISO 27001 evidence mapped to ISMS-P control artefacts
Security & Compliance Architecture
Korean compliance runs on a certificate and an active regulator. In Seoul, ISMS-P is the audit that gates enterprise procurement, and the PIPC has now put a price on the downside.
ISMS-P: 80 plus 22 controls, evidence all year
Certification under Article 47 of the Network Act is compulsory above KRW 10 billion of information and communications revenue or one million average daily users, is issued by KISA under MSIT, lasts three years and is re-audited annually. ERPStack builds Seoul systems so the 80 security and 22 privacy controls have machine evidence: RBAC, access logs, CI/CD deployment pipelines and Semgrep SAST in GitHub Actions.PIPA enforcement is now expensive
The amended Personal Information Protection Act took effect on 15 September 2023. On 18 June 2026 the PIPC fined Coupang a record KRW 624.681 billion over data breaches, and on 2 July 2026 sanctioned Bithumb over unlawful cross-border transfers. A PIPC order to suspend a transfer carries up to 3% of total revenue if ignored. ERPStack therefore keeps every Seoul transfer path inventoried in schema, not in a spreadsheet.Automated decisions have to be explainable
Since the Enforcement Decree of 15 March 2024, a Seoul data subject can demand an explanation of a fully automated decision, and refuse it where rights are materially affected. Credit scoring, fraud rules and pricing logic therefore need their inputs and model version persisted with the outcome. ERPStack writes that as an immutable audit trail in PostgreSQL beside the decision row.Four insurances, severance and the 52-hour ceiling
Korean payroll is four statutory insurances: national pension at 4.75% each side capped at KRW 6,590,000 monthly from July 2026, health insurance near 4.0674% each from January 2026, employment insurance at 0.90% for the employee, and employer-only accident cover from 0.56% to 18.56% by industry. Add severance of 30 days’ average wages per year and the 52-hour week, and a Seoul ERP must record hours, not estimate them.
Engineering Blueprint
In Seoul the network topology is decided before the data model. The network-separation rule (망분리) under the Electronic Financial Transactions Act kept regulated systems off the internet for years, and the FSC only partly reopened it on 20 April 2026. ERPStack designs Korean systems as two planes on AWS ap-northeast-2 (Seoul) — four Availability Zones — with PostgreSQL, Drizzle ORM and Next.js on both sides of the line.
Two planes, drawn where the FSC drew them
From 20 April 2026 a Seoul financial company may run listed SaaS on its internal business network without a sandbox approval — but the exemption stops at personal identification information and personal credit information, pseudonymised data still needs sandbox approval, the SaaS must be pre-screened by the Financial Security Institute, and controls are reviewed every six months for the CISO. So ERPStack keeps identity and credit columns in a separated PostgreSQL core with RBAC and zero-trust security, and puts reporting, workflow and CRM on the SaaS-eligible plane behind an API boundary.
The e-Tax invoice leaves the ERP, not a portal
Korea has run mandatory e-Tax invoicing (전자세금계산서) for corporations since January 2011, and the sole-proprietor threshold fell to KRW 80 million of prior-year supply from July 2024. Each invoice is XML, signed with the supplier’s certificate, transmitted to the National Tax Service within one day; late transmission costs 0.3% to 1% of supply value at Korea’s 10% VAT. ERPStack models transmission as an idempotent state machine in PostgreSQL rather than a nightly upload a Seoul finance team babysits.
// Drizzle ORM + PostgreSQL — Seoul ERP e-Tax transmission
export const etaxSend = pgTable('etax_send', {
idempotencyKey: varchar('idempotency_key').unique(),
state: text('state'), // signed | sent | nts_ack | failed
ntsAckAt: timestamp('nts_ack_at'),
issuedAt: timestamp('issued_at').notNull(),
});Getting out of the captive-SI pattern
Korean enterprise IT is dominated by large system integrators — Samsung SDS and LG CNS among them — which is why so much Seoul back office is bespoke, undocumented and hard to leave, and why intercompany reconciliation across chaebol affiliates is the recurring failure. ERPStack ships the opposite posture: TypeScript, Terraform, GitHub Actions and Vitest in your own repository, an event-driven architecture for affiliate postings, and Sentry for observability — so a Seoul manufacturing or media group can change vendors without changing systems.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Seoul
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyTarget Industries in Seoul
Frequently Asked Questions
Often yes. Under Article 47 of the Network Act certification is compulsory above KRW 10 billion of information and communications revenue or one million average daily users, and Seoul procurement teams ask for it well below those lines. ERPStack cannot hold your certificate, but builds the RBAC, logging and CI/CD evidence a KISA assessor asks to see.
As signed XML, not a PDF. A Seoul supplier issues the e-Tax invoice, signs it with a certificate from a public authority or the National Tax Service, and transmits it to the NTS within one day of issuance. ERPStack builds that as a retryable, idempotent job in PostgreSQL, because late transmission is penalised at 0.3% to 1% of supply value.
If your process is standard Korean accounting and payroll, Douzone Bizon products such as iCUBE or ERP iU are cheaper and purpose-built for that work. Custom pays off in Seoul when the differentiator is operational — semiconductor supply chain, K-beauty export logistics, game revenue recognition — and ERPStack usually builds around the accounting core rather than replacing it.
Partly, since 20 April 2026. Listed SaaS is exempt from the 망분리 network-separation rule for administrative and back-office work, but not where personal identification or personal credit information is handled, and pseudonymised data still needs sandbox approval. ERPStack splits a Seoul deployment so only the non-identifying plane relies on that exemption.
ISMS-P is Korea's merged security and privacy certification: 80 information security controls plus 22 personal information controls, issued by KISA under MSIT, valid three years with an annual re-audit. It is compulsory for Seoul information network service providers above KRW 10 billion of ICT revenue or one million average daily users, and failure to certify is fined KRW 30 million a year.
It priced a breach. On 18 June 2026 the PIPC imposed a record KRW 624.681 billion penalty on Coupang over data breaches, and on 2 July 2026 sanctioned Bithumb over unlawful cross-border transfers. For Seoul architecture the lesson is boring and structural: least-privilege RBAC, an immutable audit trail on every read of personal data, and no undocumented export path.
Yes, since the amended Enforcement Decree took effect on 15 March 2024. A Korean data subject may demand an explanation of a fully automated decision and refuse it where rights are materially affected. ERPStack persists the decision inputs, rule set and model version alongside the outcome in PostgreSQL, so a Seoul support team can answer without reconstructing anything.
Technically yes, but the PIPC can order a cross-border transfer suspended, and ignoring that order carries a penalty of up to 3% of total revenue. An objection must be filed within seven days and the PIPC answers within thirty. ERPStack therefore keeps the Seoul primary in AWS ap-northeast-2 and treats any egress as an inventoried, reviewable path.
It turns timekeeping into a ledger. The Labor Standards Act allows 40 regular hours plus 12 overtime hours per week, so a Seoul employer needs recorded start and end times, not estimates. ERPStack stores time entries immutably in PostgreSQL alongside the four insurance deductions and the externally funded retirement pension that Korean payroll requires.