B2B Software Consulting in Sydney
APRA sets the terms in Sydney: CPS 230 operational-risk tolerances since 1 July 2025, CPS 234 information security since 2019, and Consumer Data Right sharing live in banking since 1 July 2020. ERPStack is remote-first and builds Sydney ERP and CRM systems into AWS ap-southeast-2 against those standards.
Quick Answer
In short: APRA CPS 230 wants tolerances for critical operations, CPS 234 wants an incident clock, and the Consumer Data Right wants working APIs. ERPStack builds Sydney ERP and CRM systems on PostgreSQL in AWS ap-southeast-2, three Availability Zones and about 2 ms across the metro, with Australian Privacy Principle handling built into the schema.
Regional Compliance
- APRA CPS 230 Operational Risk Management
- APRA CPS 234 Information Security
- Consumer Data Right Rules & Consumer Data Standards
- Privacy Act 1988 & the Australian Privacy Principles
- Notifiable Data Breaches scheme (Part IIIC)
- NSW Cyber Security Policy (Circular DCS-2021-02)
Security & Compliance Architecture
Sydney’s compliance load is prudential before it is privacy. Its software buyers are disproportionately APRA-regulated — banks, insurance carriers and superannuation funds — so a Sydney ERP is audited against standards that read like engineering specifications, not policies.
CPS 230: 72 hours, and a service-provider register
CPS 230 has applied since 1 July 2025; the transition for pre-existing material service provider contracts closed on 1 July 2026. Paragraph 32 gives a Sydney bank 72 hours to notify APRA of a material operational risk incident, paragraph 48 an annual register of material service providers. Both are generated from ERP tables in PostgreSQL by a GitHub Actions job, not kept in a parallel spreadsheet.CPS 234: 72 hours and 10 business days
CPS 234 Information Security, in force since 1 July 2019, makes a Sydney insurance carrier classify every information asset by criticality and sensitivity, notify APRA within 72 hours of a material incident and within 10 business days of an unremediated control weakness. In the schema that is RBAC, an Immutable Audit Trail, Row-Level Security (RLS) in PostgreSQL and Sentry alerting wired to both clocks.Privacy Act: 30 days to assess, plus a new tort
Section 26WH(2) of the Privacy Act 1988 allows 30 calendar days to assess a suspected eligible data breach; s 26WK(2) then requires a statement to the OAIC as soon as practicable. Since 10 June 2025 a serious invasion of privacy is an actionable statutory tort, so a Sydney media or insurance API needs an automatic breach clock, WORM Storage (Write Once Read Many) for evidence and a Data Subject Access Request (DSAR) path.NSW Cyber Security Policy: the 31 October attestation
NSW Government agencies report to Cyber Security NSW by 31 October each year under Circular DCS-2021-02, attesting posture and listing crown-jewel assets. A Sydney government build therefore ships Essential Eight-aligned controls, ISO 27001-shaped evidence, Semgrep SAST and OWASP ZAP runs in CI/CD Deployment Pipelines, and Terraform state an agency auditor can read.
Engineering Blueprint
Sydney ERP workloads run in ap-southeast-2, the Australian AWS region enabled by default on every account, across three availability zones. Microsoft Azure’s Australia East region in New South Wales is the only Australian Azure region with availability-zone support, so the primary PostgreSQL write node for a Sydney ERP belongs here. The latency figures quoted for Sydney are engineering design targets, not measured production SLAs.
CPS 230 tolerances as PostgreSQL columns
APRA CPS 230 paragraph 50 makes a Sydney bank fix, per critical operation, a maximum outage, a maximum data loss and a minimum service level. We keep that register in Drizzle ORM, so the RTO and RPO an APRA reviewer asks for are rows in the multi-tenant PostgreSQL ERP, readable over a typed REST API with Role-Based Access Control (RBAC) on every column.
// Drizzle ORM + PostgreSQL: CPS 230 critical-operations register
export const criticalOps = pgTable('critical_ops', {
operation: varchar('operation', { length: 120 }).notNull(),
maxOutageMins: integer('max_outage_mins').notNull(), // RTO
maxDataLossMins: integer('max_data_loss_mins').notNull(), // RPO
minServicePct: numeric('min_service_pct').notNull(),
});A Consumer Data Right API surface
Consumer Data Right sharing opened in banking on 1 July 2020 and in energy on 15 November 2022 for retailers above 10,000 customers. The Consumer Data Standards build on FAPI 1.0 Advanced, so a Sydney accredited data recipient needs pushed authorisation requests, private_key_jwt, mutual-TLS bound tokens and PKCE. A bearer JWT behind plain OAuth fails conformance: the Node.js API presents a client certificate, and TypeScript types are generated from the CDR schema.
NPP and PayTo settlement events
The New Payments Platform runs 24 hours a day, 365 days a year and settles in central bank funds through the Reserve Bank’s Fast Settlement Service, carrying ISO 20022 remittance data and PayID keys such as an ABN. Sydney finance teams get an Event-Driven Architecture on Redis streams: every PayTo mandate webhook carries an idempotency key, so a replayed message never double-posts to the ERP ledger, and Sentry traces the retry.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Sydney
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyTarget Industries in Sydney
Frequently Asked Questions
Yes, and CPS 230 names no product. It asks a Sydney bank to set tolerance levels for critical operations and to manage material service providers. A custom ERP often makes that easier than SAP S/4HANA or Oracle NetSuite, because the RTO, RPO and provider register sit in your own PostgreSQL schema, queryable over an API instead of buried in vendor configuration.
Budget 9 to 14 months for a Sydney insurance carrier of moderate complexity, using a Strangler Fig Migration Pattern rather than a big-bang cutover. Eight weeks go to policy and claims modelling in PostgreSQL; CPS 230 scenario testing and CPS 234 control evidence add roughly six weeks, which a packaged insurance ERP rollout pays as well.
We build for NSW Government agencies and their suppliers, with one honest caveat: ERPStack is not IRAP assessed, so we hold no assessment for OFFICIAL: Sensitive workloads. We build to the controls instead — Essential Eight mitigations, a crown-jewel inventory, SSO with MFA and RBAC, and CI/CD evidence a Sydney agency can drop into its 31 October attestation.
If the need is statutory general ledger, consolidation and group reporting across many entities, SAP S/4HANA or Microsoft Dynamics 365 is genuinely the safer buy for a Sydney insurance group. A custom build earns its cost on underwriting, claims triage or a broker CRM — the parts no vendor ships — integrated back to that ledger over REST.
Often yes. CPS 230, in force since 1 July 2025, defines critical operations by the harm a disruption would cause, so a Sydney bank's payments, ledger or claims ERP usually qualifies. Paragraph 50 then demands a maximum tolerable disruption, a maximum data loss and a minimum service level — RTO, RPO and degraded throughput, proven by PostgreSQL replication lag and Sentry traces.
Both, running in parallel. CPS 234 requires notice to APRA within 72 hours of a material information security incident, and CPS 230 sets 72 hours for a material operational risk incident. Section 26WH(2) of the Privacy Act 1988 separately allows 30 calendar days to assess a suspected eligible data breach. A Sydney ERP should start both timers from a PostgreSQL trigger, not an email.
Considerably more than ordinary OAuth. The Consumer Data Standards build on FAPI 1.0 Advanced, so a Sydney accredited data recipient implements pushed authorisation requests, private_key_jwt client authentication, mutual-TLS certificate-bound tokens and PKCE against the register the ACCC operates. Banking sharing began 1 July 2020 and energy on 15 November 2022, so expect a dedicated Node.js API service.
Sydney workloads sit in AWS ap-southeast-2, which has three availability zones and is enabled by default on every account. Replicating to Melbourne's ap-southeast-4 keeps data onshore and is a sound disaster-recovery pattern, but that region is opt-in — enabled per account, with a narrower service catalogue — so verify each managed service before you design ERP failover.
NSW payroll tax is the local one: 5.45% on wages above a $1.2 million annual threshold, unchanged across 2025-26 and 2026-27. Single Touch Payroll Phase 2 then forces bonuses and commissions to be reported to the ATO as their own income type, which reshapes a Sydney finance employer's pay run where variable pay dominates. A Sydney ERP versions both rule sets in PostgreSQL rather than hardcoding rates.