Systems Architecture Audit
Find out if your architecture can handle operational scale. Get a personalized readiness score and an actionable gap analysis.
What does this Systems Architecture Audit score?
In short: a free 5-question systems architecture audit that scores your legacy stack out of 100 on hosting, authentication, multi-tenant isolation and release cadence. It takes about 5 minutes, needs no signup to see the score, and flags the gaps that stall SOC 2 and HIPAA reviews.
Systems Architecture Audit
Benchmark your system against modern multi-tenant SaaS standards. Takes 2 minutes.
How is the architecture audit score calculated?
The 4 weighted properties decide whether a B2B Software system can be scaled, secured and audited without a rewrite. The headline score appears immediately; the written gap analysis and the 48-hour architecture review follow a short form.
4 of the 5 questions carry weights of 1, 3 or 5 points: 1 for the legacy answer, 3 for a partial Cloud Migration, 5 for the modern pattern. Those 4 are hosting model, authentication and RBAC, multi-tenant isolation, and CI/CD frequency. The fifth question, your biggest bottleneck, scores a flat 2 whatever you answer, because it routes the follow-up rather than grading you. The maximum is 22 points, the floor is 6, and the audit reports your total as a percentage of 22.
What do the architecture audit score bands mean?
18 points of 22 and above, 82% or higher, reads as a flexible architecture: serverless or cloud-native hosting on AWS or Microsoft Azure, SSO with granular RBAC, isolated tenant schemas in PostgreSQL, and daily deployment through GitHub Actions. 12 to 17 points, 55% to 77%, reads as modernisation required, where the ERP works but 1 or 2 properties will block growth or procurement. Below 12 points, under 55%, reads as a critical overhaul, typically an on-premises monolith with hand-rolled authentication, no multi-tenant isolation and accumulating Technical Debt.
Which architecture gaps does the audit flag in writing?
2 answers trigger a written warning whatever your total. If authentication scores below 5, meaning anything short of SSO with granular RBAC, the audit flags it, because access control is the first control set a SOC 2 or HIPAA assessor examines and the first thing a GDPR data-subject request depends on. If multi-tenant isolation scores below 5, meaning a shared PostgreSQL database with tenant_id filtering or 1 instance per client, it flags that too, because a single filtering bug exposes one customer's rows to another.
Both gaps are engineering work, not paperwork: security and compliance engineering closes the first, and the tenancy chapter of the Systems Architecture Blueprint sets out the options for the second. The technology stack behind both is published in full, and the ERP ROI Calculator prices the move when the blocker is budget rather than architecture.
Questions about this architecture audit
How long does the architecture audit take?
About 5 minutes. There are 5 questions with 3 options each, no free-text fields and no account. The grader keeps your answers in the browser's local storage, so if you close the tab part-way the architecture audit resumes where you left off on the same device, and the reset button clears them again. The headline score out of 100 appears as soon as you answer the fifth question, before any email is requested.
Is the architecture audit score comparable between systems?
Within its own scale, yes: every ERP, CRM or B2B Software product is graded on the same 22-point rubric, so 2 systems from the same company can be ranked against each other. It is not a certification and not an industry benchmark. The audit measures 4 structural properties: hosting model, authentication, multi-tenant isolation and deployment cadence. A system can score 100 here and still have a poor PostgreSQL data model, which no 5-question architecture audit can see.
What happens to the answers I give the audit?
They stay in your browser while you work through the 5 questions; nothing is transmitted until you submit the form. Submitting sends your name, work email, role and score so a senior engineer can prepare the gap analysis and the 48-hour architecture review. The reset button clears the stored answers from the device. ERPStack is remote-first, so a submission reaches an engineer rather than a call centre.
Can the architecture audit tell me whether to rebuild or refactor?
Partly. A score in the flexible band usually means refactoring inside the current architecture is the cheaper path, because hosting, authentication and multi-tenant isolation are already right. A score below 12 of 22 usually means the constraints are structural, such as shared-tenant data, hand-rolled auth without SSO, and monthly manual releases, and incremental work keeps colliding with them. The audit narrows that question; the Systems Architecture Blueprint and a call settle it.
Does a perfect architecture audit score mean the system is compliant?
No. The audit checks that the structural preconditions for an assessment exist, isolated tenant data in PostgreSQL, SSO with granular RBAC, and reproducible deployments declared in Terraform, not that any control is operating. SOC 2, HIPAA, GDPR and ISO 27001 outcomes are decided by an external assessor against your scope and your evidence. ERPStack builds systems designed to pass that assessment and holds no certifications of its own, so treat this architecture score as a 5-minute readiness signal.