What the software you own actually costs to run

The short answer

Bespoke software runs on the same managed services a software product runs on. The difference is that the accounts are in your name and the bill is for usage, not for seats. At version-one scale that bill is about £800 a year at list prices, and it stays there until the system is genuinely busy.

That is the whole of the compulsory bill. Two things sit outside it by choice: support after launch, which is a fixed monthly fee scoped with the build and optional, and new features, which are always scoped and priced before the work. The rest of this guide is the itemised list, what changes as you grow, and why the number is so far below the rule everyone quotes.

The bill, itemised

Every line below is a service you can look up, at the price on the vendor’s own page on the date shown. Every account is opened in your name from the first week and you pay the provider directly, so nothing is routed through us or marked up. If we disappeared tomorrow, the invoices would not change.

Payment processing is not on the list because it is a percentage of what you take, set by the provider, and it is the same whether the software is bespoke or bought. A support fee is not on it because it is a decision, and it has its own section below.

What grows with use, and what never does

Nothing on the list is priced per seat. A portal with two hundred client logins costs the same to run as one with twenty, and the same again at two thousand. What the services meter instead is real use: active users, data stored, traffic served, emails sent and errors recorded, each with an allowance that a version one rarely reaches.

• Active usersThe database plan includes 100,000 monthly active users, then $0.00325 for each one beyond that2. A system with five thousand users is a twentieth of the way to paying more.
• Data and files8 GB of database disk and 100 GB of file storage are included, then $0.125 and $0.0213 a gigabyte a month2. Three years of a professional-services firm’s documents fit comfortably in the allowance.
• TrafficHosting includes 1 TB of data transfer a month, then from $0.15 a gigabyte1. A business application does not approach that; a public site with video might.
• Email50,000 emails a month on the $20 plan, 100,000 for $35, and the next tier starts at $903. A notification-driven system sends a few thousand.
• Errors50,000 recorded errors a month on the $26 plan4. A healthy system records a handful; a noisy one is a bug to fix, not a bill to pay.

The one line that does scale with people is hosting, at $20 a month per developer seat1: the people who deploy the software, not the people who use it. A version one has one, and it can be yours.

Three years, added up

Here is the same list over the period most people plan on, converted at the European Central Bank reference rate the cost guide uses, £1 to $1.357, and rounded. The build is the own or rent guide’s example, a first-band system at £18,000, so the two guides describe one purchase.

The gap is not an accounting trick. It is the difference between a rule written for one kind of system and a bill from another, and the next two sections explain each side of it.

What maintenance actually is, on this stack

Software does not wear out, but everything around it moves: the browsers people use, the phones they carry, the libraries the code is built from, and the security advisories that arrive for those libraries. Maintenance is keeping pace with that movement, and on a standard, managed stack it is a short and regular list.

• Security updatesThe libraries a system depends on publish fixes continually. Applying them is routine work, a few times a quarter, and skipping it is how an owned system quietly becomes a liability.
• One framework version a yearNext.js has shipped a major version each October since 202214. Moving up is a planned job once a year, not a rebuild, and the years in between are quiet.
• The services underneathDatabase engine versions, hosting runtimes and email providers change on their own schedules. On managed services most of that is done for you; the rest is a settings change with a test.
• Backups and the restore drillThe database plan takes a daily backup and keeps seven days2. The work is not the backup; it is restoring one on purpose, once, so the day it matters is not the first time.
• MonitoringError monitoring reports the problem before a user does4. Someone has to read the report; that is the part of maintenance that is a person, not a service.

Who does this is your choice, and the stack is chosen so the choice is real: Next.js, TypeScript, Supabase, PostgreSQL and Vercel are widely used and widely taught. Your own developer can do it, any developer you hire can do it, or our support does it for a fixed monthly fee scoped with the build.

Where the 15 to 25 per cent rule came from

Ask most agencies what software costs to maintain and you will hear a percentage of the build: “between 15% and 25% of the original development cost annually”12, or “15% to 25% of the original development budget”13. Neither page names where the figure comes from. The nearest thing to a source is a body of research on what maintenance costs over the whole life of large systems.

Those figures are real, and they describe something specific: large systems, kept for decades, inside organisations with their own engineering departments. Spread over a long life, a build that cost a year’s budget and then cost that again several times over does come out near a fifth of the build every year. The rule of thumb is a rounding of that.

The part that gets lost is what those studies counted. Lientz and Swanson found about 65% of maintenance was perfective, meaning improvements, and later work put enhancements at about three quarters of all maintenance cost11. In other words, most of what the rule calls maintenance is new features. On a Clientflow build, new features are scoped and priced before the work, and they are never in the running cost.

When the rule is right

1. The system is large, has many integrations that shift underneath it, and is genuinely being extended every month. Then the rule is describing a development budget, and it should be called one.
2. It runs on servers you operate rather than on managed services, so patching, backups, certificates and capacity are your labour.
3. It was built on an in-house framework or an unusual stack, so every change needs the people who built it.
4. It sits inside a regulated change process where every release needs testing, sign-off and documentation, and the labour of that process is the cost.

None of those describes a version one on a standard stack in your own accounts, which is why the bill on this page and the rule everyone quotes are both true, about different things.

If a supplier quotes you a percentage of the build, ask what they counted. The honest answer is usually a retainer for new features, and that is worth paying for on its own terms rather than as a fee for keeping the lights on.

The costs people forget

The services bill is the predictable part. Three other items belong in the plan, and one of them is not money.

• The ICO feeAlmost every UK organisation that processes personal data pays it yearly: £52 or £78 for most, £3,763 for the largest8. It is owed whether the software is bespoke or bought, and it is often the line that surprises a first-time buyer.
• Certification, if a customer asksCyber Essentials starts at £320 plus VAT by organisation size9, and a penetration test before launch for anything holding payment, health or sensitive data runs from about £3,750 for a web application10. Neither is a running cost of the software; both are costs of the business that runs it.
• Someone who owns the accountsThe accounts are in your name, which means someone in your business holds the logins, sees the invoices and decides. That is an hour a quarter, and it is the cost that stops a system becoming the one nobody can get into.
• Not maintaining itThe most expensive running cost is the one that was skipped. A system nobody updates keeps working for a year or two, and then a library it depends on has a published vulnerability and nobody has the context to fix it quickly. Budget the few hours a quarter, or the support fee, and it never arrives.

Questions people ask about running costs