B2B Software Consulting in Singapore
Singapore is the ASEAN market where the tax authority sits inside the invoice flow: IRAS receives a validated copy of every InvoiceNow document across IMDA’s Peppol network. ERPStack builds custom ERP for Singapore remotely, deploying into ap-southeast-1 and writing PDPA, MAS Notice 658 and OSPAR evidence into the PostgreSQL schema instead of bolting it on afterwards.
Quick Answer
In short: a Singapore ERP has to issue GST InvoiceNow on Peppol, hold the PDPA's 500-record breach clock, and produce MAS Notice 658 and ABS OSPAR v2.0 evidence. ERPStack builds it on PostgreSQL in AWS ap-southeast-1, three Availability Zones and no opt-in, with a p95 design target under 20 ms inside Singapore.
Regional Compliance
- Personal Data Protection Act 2012 (PDPA) — 500-record breach threshold
- MAS Notice 658 on Management of Outsourced Relevant Services (11 December 2024)
- ABS OSPAR v2.0 control objectives (effective 1 January 2025)
- MAS Technology Risk Management Guidelines (18 January 2021)
- IMDA MTCS SS 584 tiering and IRAS GST InvoiceNow (PINT-SG)
Security & Compliance Architecture
Singapore’s Personal Data Protection Act 2012 stopped being a policy document on 1 October 2022, when the section 48J ceiling moved to 10% of annual turnover in Singapore, or S$1 million, whichever is higher. The PDPC enforces it — so what follows are schema requirements for a Singapore ERP, not legal footnotes.
The 500-record breach clock
A breach is notifiable in Singapore when it is likely to cause significant harm, or when it touches 500 or more individuals regardless of harm, and the PDPC must hear about it within 3 calendar days of your assessment. Three days is an engineering deadline: the ERP answers “how many Singapore subjects” from a classified PostgreSQL schema and an Immutable Audit Trail, not a forensics engagement.MAS Notice 658 and the OSPAR that gates you
MAS Notice 658 on Management of Outsourced Relevant Services for Banks was issued 11 December 2023 and took effect 11 December 2024: each material arrangement is independently audited at least once every three years, and the outsourcing register is filed within 15 business days of 30 June and 31 December. Vendors clear it with an ABS OSPAR — version 2.0 effective 1 January 2025, covering entity-level, general IT and service controls annually. We make that evidence real: GitHub Actions logs, Semgrep SAST findings, OWASP ZAP scans, RBAC matrices.MTCS SS 584 and IM8 for public-sector Singapore
Singapore government and statutory-board buyers procure through Government on Commercial Cloud, whose blueprints map to IM8 clauses 10.5 to 10.11 on data residency, with 70+ agencies onboarded. MTCS SS 584 certifies a provider at Level 1 to Level 3, and Level 3 is what Singapore government data requires. ERPStack is remote-first and holds no certification of its own — not SOC 2, not ISO 27001 — so we build inside a certified provider’s Singapore region and hand your assessor the evidence.Data portability is drafted, not commenced
The data portability obligation added to the PDPA by the 2020 amendments still has not been brought into force in Singapore, and the PDPC has issued no implementing regulations. Building a Singapore ERP as though it had is cheap; retrofitting is not. A subject-access endpoint already emitting machine-readable JSON over a REST API turns a future commencement date into a Next.js route and a feature flag.
Engineering Blueprint
Singapore is one of the few AWS regions needing no account-level opt-in: ap-southeast-1 (Singapore) runs three Availability Zones and is enabled by default, so an ERPStack tenant is live on the first Terraform apply. Microsoft Azure Southeast Asia is the warm-standby pair, and IMDA’s MTCS SS 584 — Level 3 for Singapore government data — is the yardstick local procurement applies to a cloud migration.
InvoiceNow is a five-corner network
IMDA is Singapore’s Peppol Authority, and the GST InvoiceNow Requirement makes IRAS a fifth corner: a PINT-SG document moves C1 to C4 between accredited Access Points while a validated copy reaches IRAS. Voluntary transmission opened 1 May 2025, newly incorporated voluntary GST registrants followed on 1 November 2025, all new voluntary registrants on 1 April 2026, and IRAS extends it to every GST-registered business by April 2031. A Singapore invoice is now an API payload, so ERPStack models PINT-SG in PostgreSQL with Drizzle ORM, validates with Zod, and retries idempotently off Redis.
// Drizzle ORM — the PINT-SG fields IRAS actually receives
export const invoiceNowDoc = pgTable('invoicenow_document', {
peppolEndpoint: varchar('peppol_endpoint', { length: 64 }).notNull(),
currency: varchar('currency', { length: 3 }).default('SGD').notNull(),
taxCategory: varchar('tax_category', { length: 8 }).notNull(),
taxableAmount: numeric('taxable_amount', { precision: 15, scale: 2 }),
irasAckAt: timestamp('iras_ack_at', { withTimezone: true }),
});CPF and IR8A belong in the ledger
Singapore CPF runs at 37% combined below age 55 — 17% employer, 20% employee — then 34% above 55 to 60, 25% above 60 to 65, 16.5% above 65 to 70 and 12.5% above 70, on an S$8,000 Ordinary Wage ceiling from 1 January 2026. Employers with 5 or more staff file IR8A through the IRAS Auto-Inclusion Scheme by 1 March, and every Employment Act employee gets a 12-item itemised payslip within 3 working days. We version those rates as PostgreSQL rows with generated TypeScript types, an Immutable Audit Trail and RBAC over who moved one.
One Singapore tenant, four ASEAN residencies
Most Singapore engagements are regional-headquarters work: the Singapore entity consolidates subsidiaries that now hold their own in-country AWS regions — ap-southeast-3 (Jakarta), ap-southeast-5 (Malaysia), ap-southeast-7 (Thailand). One multi-tenant Postgres deployment with row-level policies keyed on a residency column keeps subsidiary rows in-country while Singapore treasury reads a single ledger over a GraphQL API, rendered by Next.js server components. Latency figures on this page are illustrative engineering targets, not measured production SLAs.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Singapore
Order-to-Cash & GST Compliance Engine
GST-compliant invoicing, consignment settlement, and receivables automation for a D2C handcraft brand
Read Case StudyTarget Industries in Singapore
Frequently Asked Questions
It depends how you registered for GST in Singapore. Voluntary transmission opened 1 May 2025; newly incorporated voluntary GST registrants were captured on 1 November 2025; all new voluntary registrants follow on 1 April 2026. IRAS extends the requirement to every GST-registered business by April 2031, so an existing Singapore registrant has a runway, not an exemption — which is why we sequence the ERP cutover with the Strangler Fig Migration Pattern.
Buy SAP S/4HANA if your Singapore entity is one node in a global template the parent already runs; fighting a group ledger standard is a losing engagement. Build custom when the differentiator is local — bunker fuel settlement, commodity trade finance, or a consignment order-to-cash flow no NetSuite or Odoo module models. Plenty of Singapore mid-market groups run a custom ERP that posts into the parent SAP.
Both work, and in Singapore the deciding factor is headcount volatility. A custom ERP module earns its cost when CPF age bands, Employment Pass salary floors and shift allowances all feed the same cost centres. Employers with 5 or more employees must file IR8A through the IRAS Auto-Inclusion Scheme by 1 March, and that is a PostgreSQL data-quality problem the ERP already owns.
ERPStack is remote-first: no Singapore entity, no local staff, no local phone number. The deployment is local — ap-southeast-1 (Singapore), Singapore-resident PostgreSQL, and evidence packaged the way an ABS OSPAR assessor or a MAS-regulated bank’s third-party risk team asks for it. Where a Singapore engagement needs an on-shore signatory, that stays with your entity, not ours.
A breach is notifiable in Singapore when it is likely to result in significant harm, or when it involves the personal data of 500 or more individuals regardless of harm. The PDPC must be notified as soon as practicable and no later than 3 calendar days after you assess it as notifiable. Since 1 October 2022 the section 48J ceiling is 10% of annual turnover in Singapore, or S$1 million, whichever is higher.
MAS Notice 658 on Management of Outsourced Relevant Services for Banks was issued 11 December 2023 and took effect 11 December 2024. It requires the Singapore bank to have each material outsourced relevant service independently audited at least once every three years, and to file an outsourcing register within 15 business days of the 30 June and 31 December reporting dates. Your ERP becomes a line in that register.
Not legally, but it is the fastest route. The ABS Outsourced Service Provider’s Audit Report is the pooled assurance report Singapore banks accept instead of auditing every vendor themselves. OSPAR version 2.0 was published 25 March 2024 and took effect 1 January 2025, covering entity-level, general IT and service controls annually. ERPStack builds so the evidence exists; commissioning the audit stays with you.
The PDPA imposes no Singapore data-residency rule — it requires that a transfer abroad affords a comparable standard of protection. Residency pressure comes from the sector: the MAS Technology Risk Management Guidelines revised 18 January 2021, and IMDA’s MTCS SS 584, where Level 3 is what Singapore government data requires. We keep production in ap-southeast-1 (Singapore) and treat eu-west-1 as disaster recovery, never primary.
Oracle NetSuite is genuinely right for a Singapore fintech whose finance function is standard and whose differentiator is the product, not the ledger. It stops being right when OSPAR-shaped evidence has to come out of your own codebase, when PINT-SG invoice fields need validation logic a vendor will not ship, or when a MAS-regulated counterparty wants row-level isolation enforced in your PostgreSQL rather than in someone else’s UI.