B2B Software Consulting in Stockholm
Stockholm ERP buyers answer to Bokföringslagen, which keeps räkenskapsinformation in Sweden for seven years, to Peppol BIS Billing 3 on every public contract, and to Skatteverket’s monthly AGI. ERPStack is remote-first: we deploy your PostgreSQL estate to eu-north-1 and Microsoft Azure’s Sweden Central and write those rules into the schema.
Quick Answer
In short: Bokföringslagen keeps seven years of Swedish books in Sweden, Peppol BIS Billing 3 is mandatory to public buyers, and AGI payroll is due monthly. ERPStack builds a Stockholm ERP on PostgreSQL in AWS eu-north-1, 12 ms to Oslo and 27 ms to Frankfurt, with the 24-hour NIS2 reporting path instrumented in Sentry.
Regional Compliance
- GDPR + dataskyddslagen (2018:218) 3 kap. 10 § — personnummer processing restricted
- Bokföringslagen (1999:1078) 7 kap. — 7-year retention, PostgreSQL records held in Sweden
- Lag (2018:1277) — Peppol BIS Billing 3 e-invoicing API for Swedish public buyers
- Offentlighets- och sekretesslagen (2009:400) — disclosure duty, RBAC-scoped redaction
- Patientdatalagen (2008:355) — Immutable Audit Trail, 10-year journal retention
- Cybersäkerhetslagen (2025:1506) — NIS2 24-hour reporting, Sentry-instrumented
Security & Compliance Architecture
Stockholm compliance is not GDPR with a Nordic accent. Three Swedish instruments change the ERP schema itself — and one makes disclosure the default.
Offentlighetsprincipen: a Stockholm public ERP must hand data out
Tryckfrihetsförordningen 2 kap. 1 § gives everyone the right to read allmänna handlingar, 2 kap. 4 § makes a document official once received or drawn up at an authority, and requests are answered skyndsamt. Offentlighets- och sekretesslagen (2009:400) 5 kap. 1 § adds a registration duty; 2 kap. 3 § extends the regime to companies under a kommun’s rättsligt bestämmande inflytande. A Stockholm government or energy utility needs a diarium table, per-field secrecy classification and a redacted export API: disclosure by default, secrecy by exception — the inverse of an ERP built for GDPR alone.
Personnummer is a regulated identifier, not a primary key
Dataskyddslagen (2018:218) 3 kap. 10 § allows personnummer to be processed without consent only where it is clearly justified by the purpose, by secure identification, or by another significant reason. Ten digits — birth date, a three-digit birth number whose last digit encodes legal sex, a computed control digit — disclose more than an identifier should. ERPStack keeps it in one encrypted PostgreSQL column behind Row-Level Security (RLS) and RBAC, joins on a surrogate uuid, and records a purpose per consumer so a Data Subject Access Request (DSAR) resolves in SQL.
Patientdatalagen makes access logging a table
For Stockholm healthcare and biotech sponsors, Patientdatalagen (2008:355) 4 kap. 1 § confines access to staff involved in the patient’s care, 4 kap. 3 § requires automated access to be documented and controllable, and 3 kap. 17 § keeps a journalhandling ten years after its last entry. That is an append-only Immutable Audit Trail, Role-Based Access Control (RBAC) gated on a care relationship, and retention the PostgreSQL schema enforces — the controls a SOC 2 or ISO 27001 assessment asks to see.
Transfers priced in kronor, and a 24-hour clock
IMY fined Tele2 SEK 12 million on 30 June 2023 over analytics transfers to the United States, so a Stockholm transfer-impact assessment is a costed engineering decision. Cybersäkerhetslagen (2025:1506) has applied since 15 January 2026 with NIS2 timing: early warning inside 24 hours, notification inside 72 hours, final report within a month. ERPStack wires Sentry and OpenTelemetry Observability into CI/CD Deployment Pipelines and keeps Zero-Trust Security defaults, so a Stockholm ERP proves what happened.
Engineering Blueprint
A Stockholm ERP build starts where most vendors never look: Bokföringslagen (1999:1078) 7 kap. 2 § keeps räkenskapsinformation until the seventh year after the financial year closes — and says it shall be stored in Sweden.
Where a Stockholm PostgreSQL ledger may legally sit
Lag (2024:342), in force 1 July 2024, permits records elsewhere in the EU only if the storage location is reported to Skatteverket; outside the EU needs permission under 7 kap. 4 §. ERPStack makes residency a PostgreSQL column, and Infrastructure as Code (IaC) in Terraform reads it to place data in AWS eu-north-1 — three Availability Zones since 12 December 2018 — or Microsoft Azure’s Sweden Central in Gävle. The Next.js front end runs on Vercel; the ledger never leaves Sweden, and backups inherit the tag.
// Drizzle ORM — residency is a PostgreSQL column, not a convention
export const verifikation = pgTable('verifikation', {
bevarasTill: date('bevaras_till').notNull(), // BFL 7 kap. 2 §
residency: varchar('residency').default('eu-north-1').notNull(),
});Peppol BIS Billing 3 is the Swedish invoice; the PDF is not
Lag (2018:1277) has required electronic invoices to Swedish contracting authorities since 1 April 2019, and SFTI recommends Peppol BIS Billing 3 bound to UBL 2.1 with national rules for Bankgiro, F-skatt and Peppol-ID. ERPStack validates with Zod inside the ERP and serialises UBL behind a REST API, so a Stockholm supplier gets a typed error, not a lost receivable. ViDA — Council Directive (EU) 2025/516 — moves intra-EU B2B software invoicing to 1 July 2030.
AGI: the Stockholm payroll run Skatteverket reconciles monthly
Since January 2019 every Swedish employer files an individuppgift per payee by the 12th of the following month — field 215 (personnummer), 011 (kontant bruttolön), 001 (avdragen preliminärskatt) — and since January 2025 parental-leave and vab absence as a percentage of normal full time, forwarded to Försäkringskassan. Through Drizzle ORM the ERP writes each period as an immutable PostgreSQL snapshot with an Immutable Audit Trail: a Swedish payroll fix restates a filed period, never edits it.
One Stockholm parent, four Nordic rulebooks
Stockholm is where Nordic groups consolidate and the books disagree: 25 % moms in Sweden against 25.5 % in Finland since 1 September 2024, a Norwegian entity outside the EU rendering SAF-T Financial XML (version 1.40 from 1 January 2027), and Danish bookkeeping that from 1 January 2026 pulls firms outside årsregnskabsloven into registered systems. The ERP answer: one PostgreSQL chart of accounts with per-entity dimensions, SIE-4 export for the auditor, SEK, NOK, DKK and EUR reconciled at consolidation — the shape Stockholm manufacturing, mining, telecom and finance groups run.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Target Industries in Stockholm
Frequently Asked Questions
AWS eu-north-1 in Stockholm — three Availability Zones since 12 December 2018 — or Microsoft Azure’s Sweden Central in Gävle. Microsoft’s July 2026 P50 dataset puts Sweden Central 12 ms from Norway East, 21 ms from Denmark East, 27 ms from Frankfurt and 31 ms from London, so one PostgreSQL primary in Stockholm serves an entire Nordic group.
Only behind a documented transfer-impact assessment, because Sweden has priced the alternative: IMY fined Tele2 SEK 12 million on 30 June 2023 over analytics data sent to the United States. For Stockholm builds ERPStack keeps first-party events in PostgreSQL inside eu-north-1, so product analytics is a SQL query rather than a third-country export.
Against a semesterår running 1 April to 31 March, never the calendar year. Semesterlagen (1977:480) 4 § gives 25 days, 16 b § computes semesterlön as 12 % of pay earned in the intjänandeår, and 17–17 b §§ keep accrual running through 180 days of sick leave. A Stockholm kollektivavtal usually overrides all three, so the ERP holds accrual as configuration and reconciles Fora and Collectum against the same PostgreSQL ledger.
If the work is bookkeeping, invoicing and payroll on Swedish defaults, Fortnox or Visma beats a custom build on cost and time to value, and we will say so. Custom ERP development in Stockholm earns its place where the operating model is the product: Nordic multi-entity consolidation, a proprietary pricing or logistics engine, or an integration surface no Swedish package covers.
Bokföringslagen (1999:1078) 7 kap. 2 § is the default: räkenskapsinformation is kept to the seventh year after the financial year closes, and stored in Sweden. 7 kap. 3 a §, amended by Lag (2024:342) from 1 July 2024, lets a Stockholm company hold electronic records elsewhere in the EU if the storage location is reported to Skatteverket; outside the EU needs permission under 7 kap. 4 §. ERPStack pins the PostgreSQL primary to AWS eu-north-1.
It inverts the default. Tryckfrihetsförordningen 2 kap. 1 § makes allmänna handlingar readable on request, and Offentlighets- och sekretesslagen (2009:400) 2 kap. 3 § extends that to companies under a kommun’s or region’s rättsligt bestämmande inflytande. A Stockholm municipal utility needs its ERP to register documents under OSL 5 kap. 1 §, classify secrecy per field with RBAC, and emit a redacted export API skyndsamt.
A PDF does not count. Lag (2018:1277) has required invoices to Swedish contracting authorities to be electronic and conform to the European standard since 1 April 2019, and SFTI recommends Peppol BIS Billing 3 bound to UBL 2.1 with Swedish rules for Bankgiro, F-skatt and Peppol-ID. A Stockholm supplier needs the ERP to emit a Zod-validated document over an API, not a person attaching a file.
Per employee, every month. An individuppgift is due for each payee by the 12th of the following month — field 215 for personnummer, 011 for kontant bruttolön, 001 for avdragen preliminärskatt — mandatory for all Swedish employers since January 2019. From January 2025 parental-leave and vab absence is reported as a percentage of normal full time and Skatteverket forwards it to Försäkringskassan, so a Stockholm ERP models absence in PostgreSQL, not just pay.
If you need statutory depth in twenty countries and your processes are ordinary, SAP S/4HANA or Microsoft Dynamics 365 is the lower-risk answer, and that is what we would recommend. A Stockholm Nordic HQ is often the other shape: four rulebooks — 25 % Swedish moms against 25.5 % Finnish, Norwegian SAF-T outside the EU, Danish registered bookkeeping — around one differentiated model. There a custom ERP on PostgreSQL costs less to change than NetSuite costs to keep, and the Technical Debt sits in your repository.