Live ERP & HRIS integrations — streaming, not periodic.
Periodic audit uploads describe what already happened. VeraStream describes the connector list: NetSuite, SAP, Oracle / Fusion ERP, Workday, plus corporate-card streams from Brex, Ramp, Expensify and Concur. Integrations ship progressively by tier — NetSuite + QuickBooks land first with Growth; SAP, Coupa, and Workday round out the Enterprise connector list; Oracle and the card streams ship later as the Enterprise rollout expands. See /pricing for the per-tier enumeration.
Integration targets
The connector targets — one row per system, one connector shape per row
Five targets: four ERPs/HRISes the spend stream comes from, plus the corporate-card-issuer and expense-platform row that streams the cardholder signal. Each row names the connector shape (the protocol the deploy uses), the live signal that streams in, and the rollout status by tier.
| System | Category | Connector shape | Live signal stream | Rollout status |
|---|---|---|---|---|
NetSuite | ERP | SuiteTalk REST reads from a designated read-only role; vendor master + posted invoice + payment header events streamed in. | NetSuite GL — vendor master records, posted vendor bills, AP payment events, expense report postings. SuiteTalk REST pulls continuously; new postings hit the eight detectors within seconds. | Growth tier |
SAP | ERP | OData + IDoc pull from a designated read-only S-user; controlling-area scoped read; no SAP-issued writes beyond standard connector reads. | SAP posted AP rows — vendor master (LFA1/LFB1), posted invoice (RBKP / RSEG), payment events — pulled via OData and IDoc, normalized, and passed to the same eight detectors. | Enterprise tier |
Oracle / Fusion ERP | ERP | BIP (BI Publisher) report pull + Fusion REST API from a designated read-only role; AP-focused query set, no Fusion-issued writes. | Oracle Payables — supplier master, posted AP invoices, payment batches — pulled via BIP and the Fusion REST interface. Connection is read-only against an AP-scoped role. | Enterprise tier |
Workday | HRIS | SCIM 2.0 + Workday RaaS (Report-as-a-Service) pull of the approver roster; the approver chain arrives alongside each AP receipt and feeds the SOD / ghost-employee detectors. | Workday HCM — supervised worker roster, current manager / approver chain, hire / termination events. The approver cross-check on every AP receipt depends on this roster. | Enterprise tier |
Brex, Ramp, Expensify, Concur | Card issuer & expense platform | Public APIs (Brex, Ramp) and OAuth-tied connectors (Expensify, Concur) — cardholder transactions stream in as they post; identity-as-approver surface is preserved. | Corporate-card transactions — cardholder, MCC, posted date, amount, vendor memo, receipt match state. Streaming pulls give detectExpenseAnomalies, detectVendorRisk, and detectRoundDollar a real-time signal — not the weekly drop the cards industry ships. | Available on request |
Why live streaming replaces periodic audit uploads
Six aspects — same population, different cadence
A weekly CSV drop and a live ERP connector read the same AP population. They differ on six specific aspects — each one shifts the workpaper trail, the recovery path, and the cost driver. The table below names what shifts when you move from periodic audit uploads to a streaming connector.
| Aspect | Periodic CSV upload at /audit | Live connector streaming |
|---|---|---|
| Cadence | Per-transaction? No — weekly or monthly CSV drop at /audit. | Per-transaction. New ERP postings hit the eight detectors within seconds of the post. |
| Integrity / dedupe | CSV re-import dedupe — vulnerable to row-format drift, duplicate header lines, and stale master IDs. | Durable connector dedupe state — the same connector handles idempotent reads, so the same source row never fires twice. |
| Mean-time-to-flag | Three-week audit lag — a duplicate posted Monday is surfaced in the next quarterly sample. | Minutes from a posted receipt — the four lowest-latency detectors (evaluatePolicy, detectThresholdGaming, detectRoundDollar, detectVendorRisk) read the row at post time. |
| Replay window | Last snapshot only — what didn’t make the CSV is invisible to the population. | Always live — the last 90 days are always in the rolling window, so a flag can be re-evidenced against the original posted receipt at any time. |
| Workpaper shape | Post-hoc sampling — a quarterly packet of N rows that no longer match the live AP state by the time the auditor opens them. | Signed per-flag receipt at flag time — the timestamped receipt, the rule that fired, and any override are bundled the second the row trips. |
| Cost driver | Per CSV drop — a recovery firm charges contingency on what was found in the drop. | Per posted receipt — continuous detection runs against the live stream, not against the sample. |
Progressive rollout
Now, Next, Later — the honest connector roadmap
Connectors ship under tier rules — not on a fabricated go-live calendar. Growth ships the first two connectors in production; Enterprise rounds out the broad connector list; the longer tail (Oracle, Brex / Ramp / Expensify / Concur) lands as the rollout scope gates clear. Use the per-tier enumeration on /pricing as the source of truth.
| Band | Connector scope | What ships vs. what is in flight |
|---|---|---|
Now | NetSuite + QuickBooks (Growth tier) — connectors shipping | SuiteTalk REST and the QuickBooks Online OAuth connector are the first two connectors shipping with the Growth tier. The same eight detectors read every posted AP row from either connector — no separate detector fork per ERP. |
Next | SAP + Coupa + Workday (Enterprise tier) — connectors in flight | OData + IDoc against SAP, the Coupa Open API, and SCIM 2.0 + Workday RaaS — these three are the broad-Enterprise connector list (see FEATURE_MATRIX[erp-integrations] on /pricing). They share the same detector pipeline as the Growth connectors. |
Later | Oracle / Fusion + corporate-card streams — available on request | Oracle Fusion ERP via BIP + REST, plus the corporate-card streams from Brex, Ramp, Expensify, and Concur, are gated behind a contingency slot — they ship as the Enterprise roll expands. No fabricated go-live date — they land as the connector scope gates clear. |
Why a periodic audit upload is not enough
Three filings, three flavors of post-cutover control failure
Each cite below is the actual filing language — pulled character-for-character from EDGAR — followed by the form type, period, and section reference. Periodic audit uploads catch these failures months after the wire, which is the spend-trust problem streaming connectors are designed to fix.
Valvoline — material weakness disclosed after Jan 2024 SAP cutover
“In connection with the implementation of the new ERP system on January 1, 2024, a material weakness in internal control over financial reporting arose […] The material weakness relates to the Company’s January 2024 implementation of a new ERP system and its related impact on IT general controls. Specifically, the Company did not ensure adequate (a) system design for certain business processes, (b) segregation of duties reviews for a portion of time during the three-month period ended March 31, 2024, and (c) evidence to support the rigor of change management activities, sensitive access reviews, and design of user roles and application controls, including certain reports, automated jobs and interfaces.”
Schneider National — 2023 10-K flags ERP deployment risk
“We recently completed the deployment of a new ERP system, and challenges with the system may adversely impact our business and operations. In May 2023, we began the implementation of a new ERP system, which was completed in December, to support and streamline our core financial systems […] Any remaining open disruptions, deficiencies, or other problems associated with the implementation of our ERP system, such as quality issues, programming errors, or any cost increases could adversely affect our ability to operate our business, produce timely and accurate financial statements, or comply with applicable regulations.”
Flowers Foods — DSD route-accounting ERP upgrade is cutover-in-progress
“The upgrade of the ERP system is designed to accurately maintain our financial records, enhance our operational functionality and provide timely information to our management team related to the operations of the business […] During the second quarter of Fiscal 2023, we began deploying the ERP upgrade. The deployment is anticipated to be completed in Fiscal 2026. We may not be able to deploy the ERP system upgrade successfully without experiencing delays, increased costs and other difficulties, including potential design defects, miscalculations, testing requirements, and the diversion of management’s attention from day-to-day business operations. If we are unable to deploy the ERP system upgrade as planned, the effectiveness of our internal control over financial reporting could be adversely affected, our ability to assess those controls adequately could be delayed, and our financial condition, results of operations and cash flows could be negatively impacted.”
Frequently asked
Common questions from AP, internal-audit, and IT teams standing up the connectors
What each connector pulls, how it’s scoped, and what is in flight vs. shipping today — plain HTML answers, no JavaScript required to read.
Does VeraStream connect to NetSuite live?
Yes — NetSuite is a Growth-tier connector. SuiteTalk REST reads from a designated read-only role; the vendor master, posted vendor bills, and payment-header events stream continuously, and new rows hit the same eight production detectors within seconds of posting. The same eight production detectors — evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment, detectGhostEmployee — run on every streamed transaction. See /pricing for the connector-breadth enumeration (the Growth connector row in FEATURE_MATRIX[erp-integrations]).
What does live SAP integration look like?
The SAP connector pulls from a designated read-only S-user via OData + IDoc — controlling-area scoped, with no SAP-issued writes beyond the standard connector reads. The same eight production detectors — evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment, detectGhostEmployee — run against every posted AP row from the SAP pull. SAP is part of the Enterprise-tier connector list (FEATURE_MATRIX[erp-integrations] on /pricing: Enterprise ships NetSuite, SAP, Coupa, Workday).
Does VeraStream support Oracle / Fusion ERP?
Yes — the Oracle / Fusion ERP connector is in flight. BIP (BI Publisher) report pull plus the Fusion REST API from a designated read-only AP-scoped role is the connector shape. No fabricated go-live date — Oracle lands later as the Enterprise tier rollout expands; for the current per-tier connector enumeration, /pricing's FEATURE_MATRIX[erp-integrations] is the source of truth (as of today Enterprise ships NetSuite, SAP, Coupa, Workday).
What about Workday — approver cross-check?
Workday is the HRIS row in the connector table — Enterprise tier. SCIM 2.0 + Workday RaaS pull the supervised worker roster and the current approver chain. The same eight production detectors — evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment, detectGhostEmployee — run against the AP receipt and the approver identity simultaneously. The SOD / ghost-employee detectors lean on this approver cross-check most.
Why corporate-card streaming — Brex / Ramp / Expensify / Concur?
Cardholder identity is the same identity-as-approver surface used by detectExpenseAnomalies (one cardholder / two closenames is a split-conduit indicator), detectVendorRisk (shell-vendor heuristic on the card channel), and detectRoundDollar (round-dollar disbursements to a near-new vendor). Streaming the card transaction — public APIs (Brex, Ramp) and OAuth connectors (Expensify, Concur) — gives those detectors a real-time pull rather than the weekly CSV drop the cards industry ships. The same eight production detectors — evaluatePolicy, findDuplicateInvoices, detectExpenseAnomalies, detectVendorRisk, detectThresholdGaming, detectRoundDollar, detectDuplicatePayment, detectGhostEmployee — run on every posted card transaction. These are available on request as the Enterprise tier rollout expands.
Why are integrations rolling out progressively — and what is the schedule?
Honest framing — each connector ships under a tier rule, not a fabricated go-live date. Growth ships the first two connectors in production — NetSuite + QuickBooks (from FEATURE_MATRIX[erp-integrations] on /pricing: Growth = 'NetSuite + QuickBooks'). Enterprise ships the broader connector list — NetSuite, SAP, Coupa, Workday — with Oracle (Fusion) and the Brex / Ramp / Expensify / Concur corporate-card streams available on request as the rollout scope expands. /pricing is the source of truth for the current per-tier connector enumeration.
Demand signal · Later-tier connectors
Get notified when live streaming ships for your ERP
Connectors land under tier rules — not on a fabricated calendar. Drop your work email and tell us which ERP you run. The connector team uses this list to sequence the “Later” rollout before any engineering commitment, so your row is the signal, not a marketing nudge.
What you’re signing up for
- A direct line to the connectors team. We’ll email you when your ERP’s live connector clears its tier gate — not when a marketing cycle decides to.
- Real demand, not vanity signups. Each row lists the ERP + an optional note, so the “Later” sequencing is driven by signal, not by a vendor-side roadmap guess.
- No spam, no resell. One email per connector milestone for your ERP. Unsubscribe any time.
Want the rest of the connector list on the live spend tier? See /pricing for the per-tier enumeration.
Get notified when live NetSuite / SAP / Oracle streaming ships
Connectors land under tier rules — not on a fabricated calendar. Drop your work email and tell us which ERP you run; the connector team uses this list to sequence the “Later” rollout before any engineering commitment, so your row is the signal, not a marketing nudge.
See the connectors on your own data
Streaming, not periodic — the connector target list lives here.
Drop a CSV of your AP ledger at /audit — the same eight detectors run in the browser against your data, no integration required. Use /pricing to launch the connector list continuously against your live spend tier.