B2B Software Consulting in Toronto
Toronto runs on federal PIPEDA, because Ontario has no private-sector privacy statute of its own — while Quebec’s Law 25 binds the same PostgreSQL database the moment one Quebec customer appears in it. ERPStack builds custom ERP software remote-first for the city’s nearly 210,000 financial services workers and its TSX-listed mining and insurance issuers, deploying into Canadian AWS and Microsoft Azure regions.
Quick Answer
In short: a Toronto ERP still answers to PIPEDA, because the CPPA never passed, plus Quebec Law 25, Ontario PHIPA and OSFI Guideline B-13. ERPStack builds it on PostgreSQL in Microsoft Azure canadacentral, which is physically Toronto, with AWS ca-central-1 in Montreal as the recovery region, and you own every line.
Regional Compliance
- PIPEDA (S.C. 2000, c. 5) — federal private-sector privacy, 24-month breach records
- Quebec Law 25 — s. 3.3 privacy impact assessment, s. 27 portability API
- PHIPA (Ontario) — IPC breach notification and 1 March annual statistics
- OSFI B-13 and B-10 — technology, cyber and third-party risk over your ERP vendor
- FINTRAC — CAD 10,000 large cash, EFT and suspicious transaction reporting
- Ontario ESA — written electronic monitoring policy at 25+ employees
Security & Compliance Architecture
A Toronto ERP answers to three privacy regimes at once and only one is Ontario’s: federal PIPEDA governs, because Ontario has no private-sector statute; Quebec’s Law 25 attaches to the same PostgreSQL row the moment a Quebec resident sits in it; PHIPA takes over when that row is health data. GDPR habits get Toronto teams halfway, then mislead them.
PIPEDA is still the law — the CPPA never passed
Bill C-27 and its Consumer Privacy Protection Act died on the Order Paper at the January 2025 prorogation, so PIPEDA (S.C. 2000, c. 5, last amended 4 March 2025) still measures a Toronto business — no CPPA rebuild to budget. Section 10.3 forces a record of every breach of security safeguards, kept 24 months, reportable or not: in a custom ERP, a PostgreSQL table with a retention job, RBAC on reads and an immutable audit trail — the evidence a SOC 2 auditor asks for. Knowingly failing to report is a $100,000 indictable offence under section 28.
Quebec Law 25 reaches Toronto head offices
Section 3.3 has required a privacy impact assessment for any project to acquire, develop or overhaul an information system handling personal information since 22 September 2022 — the ERP build itself. Section 17 has required an assessment before personal information leaves Quebec since 22 September 2023; section 27 portability — structured, commonly used technological format, so JSON or CSV, never PDF — since 22 September 2024. Toronto builds ship that as a versioned REST API generated from the Drizzle ORM schema, validated by Zod, over PostgreSQL row-level security. The Commission d’accès à l’information levies CAD 10 million or 2% of worldwide turnover administratively, CAD 25 million or 4% penally.
-- PostgreSQL RLS: Quebec rows carry duties Ontario rows do not
CREATE POLICY law25_portability ON customer
FOR SELECT TO erp_dsar_role
USING (residency = 'QC' AND origin = 'collected_from_subject');
-- s.27 excludes inferred data: only collected rows are portablePHIPA, and Ontario’s electronic-monitoring rule
Ontario healthcare data is provincial, not federal: PHIPA custodians answer to the Information and Privacy Commissioner of Ontario, who must hear about qualifying breaches and files an annual statistics report every 1 March for the prior year — a counter in the schema, and a HIPAA control set is no substitute. Toronto hospital integrations speak FHIR over an authenticated API. Any Ontario employer with 25 or more employees on 1 January also needs a written electronic monitoring policy before 1 March, kept three years: an ERP or CRM timestamping warehouse logins for a logistics or retail client is electronic monitoring.OSFI puts your vendor inside the audit
For a Bay Street bank or insurance carrier the auditor is OSFI, and a generic SOC 2, ISO 27001 or PCI DSS attestation does not answer it. Guideline B-13, Technology and Cyber Risk Management, has applied since 1 January 2024; Guideline B-10, Third-Party Risk Management, since 1 May 2024 — and B-10 covers every third-party arrangement, not outsourcing alone, which puts ERPStack inside the audit. B-10 expects records on servers located as the FRFI statutes stipulate and, outside Canada, immediate, direct, complete and ongoing access for OSFI: a read-only PostgreSQL replica behind a signed export API. Incidents are reportable within 24 hours, so detection is a Sentry pipeline in CI/CD.
Engineering Blueprint
“Canadian data residency” resolves two ways for a Toronto buyer, and most ERP vendors never say which. AWS ca-central-1 — the region Canadian RFPs name — sits in the Montreal area of Quebec, 500 km east. Microsoft Azure canadacentral is physically in Toronto and the only Canadian Azure region with availability zones. ERPStack is remote-first: we pick the region against your regulator, not your postcode.
Region topology for Toronto workloads
The Toronto reference stack is Next.js and TypeScript on Vercel over a multi-tenant PostgreSQL primary in Microsoft Azure canadacentral, with AWS ca-central-1 or ca-west-1 — Calgary, opened 20 December 2023 with three availability zones — as failover, Redis for sessions and Docker images shipped by GitHub Actions. Illustrative engineering targets, not measured SLAs: ~3 ms in-city, ~10 ms Toronto to Montreal, ~55 ms to Calgary. Terraform pins every VPC and KMS key to a Canadian region, so no Toronto insurance ledger drifts into us-east-1, and Sentry alerts on the first cross-border egress.
No e-invoicing mandate — a tax matrix instead
Canada has no e-invoicing clearance mandate, so a Toronto ERP has no portal to file to. Place of supply decides: one Toronto invoice carries 13% HST into Ontario, 5% GST into Alberta, 5% GST plus 9.975% QST into Quebec on a separate Revenu Québec registration, 14% in Nova Scotia, 15% in New Brunswick. Oracle NetSuite, SAP S/4HANA, Sage X3, Epicor and Microsoft Dynamics 365 bury that in tax codes; in Drizzle ORM over PostgreSQL the rate is a row with an effective date, validated by Zod at the API boundary.
// Drizzle ORM + PostgreSQL — place of supply, never a hard-coded 13%
export const taxJurisdiction = pgTable('tax_jurisdiction', {
code: varchar('code', { length: 2 }).primaryKey(), // ON AB QC NS
gstRate: numeric('gst_rate', { precision: 6, scale: 5 }),
provRate: numeric('prov_rate', { precision: 6, scale: 5 }), // QC 0.09975
regime: varchar('regime'), // HST | GST_PST | GST_QST
filesWith: varchar('files_with'), // CRA | Revenu Quebec
});Payroll ceilings and the Bay Street filings
A Toronto payroll module clears two federal ceilings before a province: CPP at 5.95% to the $74,600 YMPE, then CPP2 at 4% to the $85,000 YAMPE for 2026 over a $3,500 exemption — Quebec staff leave CPP for QPP plus QPIP. T4s are due the last day of February, electronic above five slips; a Record of Employment reaches Service Canada in five calendar days; WSIB Form 7 in three business days; Ontario ESA overtime at 44 hours. For finance and insurance clients an Apache Kafka topic feeds the Node.js worker emitting FINTRAC filings over a REST API — CAD 10,000 large cash inside 15 calendar days — with RBAC over unfiled reports and an immutable audit trail on every amendment, against Payments Canada’s Q4 2026 Real-Time Rail on ISO 20022.
Evaluate Your Stack
Take our interactive audit to see if your architecture is ready for operational scale.
Start Free AuditRegional Infrastructure
Infrastructure Region
Latency Metrics
Primary Datacenter
Success Stories in Toronto
Real-Time Fraud Detection Platform
Real-time fraud detection and risk scoring platform
Read Case StudyField Operations & Compliance Portal
Unified operational portal for field tracking and compliance
Read Case StudyTarget Industries in Toronto
Frequently Asked Questions
No — build for PIPEDA. Bill C-27 and its Consumer Privacy Protection Act died on the Order Paper at the January 2025 prorogation, and no replacement has been enacted. PIPEDA (S.C. 2000, c. 5) still governs a Toronto business and was last amended 4 March 2025, so ship the consent, DSAR and 24-month breach-record tables your Drizzle ORM migrations enforce in PostgreSQL today.
Usually not outright. Ontario’s five vehicle assemblers — Ford, General Motors, Honda, Stellantis and Toyota — anchor a manufacturing base where Microsoft Dynamics 365 Business Central, Epicor or Sage 300 costs far less than a rebuild. Custom ERP development wins in Toronto only where the differentiator is unmodellable in either: CUSMA origin certification across nine data elements, mixed Ontario–Quebec payroll, or consignment logistics.
Place of supply decides, not your Toronto address. The same invoice carries 13% HST to an Ontario customer, 5% GST to Alberta, 5% GST plus 9.975% QST to Quebec — filed with Revenu Québec, not the CRA. In our custom ERP software rate, regime and filing authority live in a PostgreSQL jurisdiction table, so a rate change is a Drizzle ORM row, not a release.
Only as a jurisdiction table. Ontario employees contribute CPP at 5.95% to the $74,600 YMPE plus CPP2 at 4% to the $85,000 YAMPE in 2026; Quebec employees pay QPP and QPIP instead. Add WSIB, Ontario ESA overtime at 44 hours and T4 filing by the last day of February: one multi-tenant ERP schema for the Toronto payroll team, four rate tables, RBAC per province, one payroll API.
Yes — Law 25 follows the data, not the head office. A Toronto company holding Quebec residents’ personal information owes a section 3.3 privacy impact assessment on any ERP project, a section 17 assessment before that data leaves Quebec, and section 27 portability since 22 September 2024, served as structured JSON from PostgreSQL. The Commission d’accès à l’information can impose CAD 25 million or 4% of worldwide turnover.
Your ERP vendor sits inside the audit, not beside it, and a SOC 2 report alone does not discharge it. Since 1 May 2024, B-10 has covered every third-party arrangement a federally regulated institution holds, not just outsourcing. For a Toronto bank that means criticality classification, exit plans, subcontractor disclosure and — for records outside Canada — direct, ongoing OSFI access to a PostgreSQL replica.
No. AWS places Canada (Central) in the Montreal area of Quebec, roughly 500 km from Toronto. Microsoft Azure canadacentral is the region physically in Toronto, and the only Canadian Azure region with availability zones — canadaeast, in Quebec, has none. Both satisfy Canadian residency; only one gives a Toronto user single-digit millisecond PostgreSQL writes, the deciding number in most AWS-to-Azure cloud migration plans.
If it records employee activity, yes. Ontario’s Employment Standards Act requires every employer with 25 or more employees on 1 January to have a written electronic monitoring policy before 1 March, stating whether, how and when staff are monitored and what the data is used for, then to keep it three years. ERP and CRM login timestamps qualify, so a Toronto rollout ships the policy alongside the RBAC model.
Not the federal regulator directly. The Privacy Commissioner of Canada investigates, audits and publishes findings under PIPEDA but must go to Federal Court for a remedy; PIPEDA’s ceiling is a $100,000 indictable offence. Quebec’s Commission d’accès à l’information imposes administrative penalties itself, to CAD 10 million or 2% of worldwide turnover — for a Toronto multi-tenant SaaS the sharper regulator is provincial.