IoT Application Development Cost: What It Really Takes

What an IoT application actually costs: three honest bands

Across 2,000+ delivered projects at Digital Heroes, IoT work clusters into three shapes. The single biggest reason quotes for "an IoT app" range from $30,000 to $400,000 is that the phrase covers all three, and most buyers do not know which one they are describing.

Tier 1: Connected monitoring MVP. $45,000 to $75,000. 10 to 14 weeks. One device type, one protocol (usually MQTT to a managed broker), a cloud ingestion pipeline, a time-series store, and a web dashboard showing live plus historical readings with basic threshold alerts by email or SMS. Team: one backend engineer, one frontend engineer, a part-time cloud or data engineer, a designer for roughly three weeks, a QA engineer part-time, and a project lead. Assumes your device already exists and already speaks a documented protocol.

What falls out of scope at this tier, and you should hear this stated plainly before you sign: no native mobile apps (responsive web only), no offline device buffering logic, no over-the-air firmware updates, no multi-tenant org structure (one company, one flat user list), no role permissions beyond admin and viewer, no ERP (Enterprise Resource Planning) or CRM (Customer Relationship Management) integration, no device provisioning UI (devices get registered by a script), and no formal compliance evidence. Any vendor quoting $45,000 with all of that included is either misunderstanding you or planning to bill it later as change requests.

Tier 2: Production multi-device platform. $85,000 to $150,000. 4 to 6 months. Two to four device types, device provisioning and lifecycle management, multi-tenancy with role-based access, native iOS and Android apps or a well-built React Native app, configurable alert rules with escalation, OTA update orchestration, one or two business system integrations, and an admin console. Team: two backend engineers, one frontend, one mobile, a cloud or data engineer, a designer, a QA engineer, and a delivery lead. This is where the majority of funded IoT products land.

Tier 3: Regulated or fleet-scale platform. $150,000 to $220,000+. 6 to 10 months. Thousands to tens of thousands of devices, edge processing, sub-second control paths, high-availability architecture, audit logging, SOC 2 or HIPAA or IEC 62443 evidence, migration off an existing system, and three or more integrations. Add a security engineer, a second data engineer, and a compliance-aware architect. Past 30,000 devices or hard real-time control loops, the number stops being a range and starts being a per-project estimate.

One more line item people forget: if the hardware side is yours to build, firmware and device-side work is $25,000 to $60,000 depending on the chipset, power budget, and certification path. It is a separate discipline and a separate engineer. It is not included in any band above.

What actually drives the number

Integration count. $6,000 to $18,000 each. The cheap end is a modern REST API with real docs and a sandbox: Stripe, HubSpot, Twilio. The expensive end is an on-premise ERP, a SCADA historian, or a legacy Modbus gateway with no test environment, where you spend two weeks getting VPN access before writing a line of code. Rule of thumb: a documented cloud API is $6,000 to $9,000, an undocumented or on-prem system is $12,000 to $18,000. Four integrations is $24,000 to $72,000 of a build. This single driver explains more quote variance than anything else.

Real-time and offline requirements. Adds 15% to 30%. "Show me the reading within a minute" is a polling dashboard and costs nothing extra. "Show it within 200 milliseconds and let me actuate the device from the app" means WebSockets or a bidirectional MQTT session, connection state handling, command acknowledgement, retry semantics, and an idempotency story. Offline device buffering plus conflict resolution on reconnect adds another 10% to 15% on top. On a $120,000 build that pair is $18,000 to $54,000, and it is almost never in the cheapest quote.

Compliance. $15,000 to $45,000. HIPAA on an IoT platform means encrypted transport and at rest, audit trails on every data access, signed BAAs, and a documented access review: roughly $15,000 to $25,000 in engineering plus the auditor's separate fee. SOC 2 Type II adds control implementation and a 3 to 6 month observation window. IEC 62443 for industrial systems, or FDA pathways for medical devices, sits at the top of that band and lengthens the timeline more than it inflates the price. If nobody asked you about compliance during scoping, the quote does not include it.

Mobile plus web. Adds 40% to 60% over web alone. A React Native app sharing an API with the web dashboard is $28,000 to $45,000 for a standard feature set. Separate native Swift and Kotlin apps roughly double that. Add BLE provisioning (pairing a device from the phone) and you are looking at another $8,000 to $15,000, because BLE is where mobile timelines go to die: platform quirks, permission flows, and physical device testing.

Data migration and history. $8,000 to $30,000. Moving two years of readings out of an old system is not a script. It is schema archaeology, unit reconciliation, gap detection, dual-write during cutover, and a rollback plan. Clean CSV exports with a documented schema sit at the bottom of the band. A live production system you cannot take down, with inconsistent device IDs, sits at the top.

Design depth. $6,000 to $35,000. A component library like MUI or shadcn with sensible layout is $6,000 to $12,000 and looks fine. Custom design with a real system, motion, and operator-tested dashboard density is $25,000 to $35,000. For an internal ops tool, take the cheap end. For a product you sell to customers who compare you to competitors on a screenshot, do not.

Scale. Adds 10% to 25% past roughly 10,000 devices. A thousand devices reporting every 5 minutes is a single Postgres instance with TimescaleDB and a normal API. Fifty thousand devices reporting every 10 seconds is a partitioned time-series store, a message queue with backpressure, downsampling and retention policies, and load testing as a real workstream. The architecture changes, so the price changes.

Worked example: a fleet monitoring platform for an HVAC service company

Real shape of a project we quote often. 3,500 rooftop units across commercial buildings, existing controllers speaking Modbus through a cellular gateway, technicians in the field, dispatchers at a desk.

• Discovery, protocol audit, architecture, and data model: $9,000
• Ingestion pipeline: MQTT broker, gateway auth, Modbus register mapping, validation, dead-letter queue: $21,000
• Time-series storage plus downsampling and retention: $11,000
• Backend API, multi-tenancy, roles (admin, dispatcher, technician), device lifecycle: $19,000
• Alert rules engine with thresholds, escalation, and SMS or email delivery: $13,000
• Web dashboard: fleet map, unit detail, historical charts, alert queue: $22,000
• React Native technician app: assigned units, live readings, service log, photo upload: $31,000
• Two integrations: ServiceTitan work orders and Twilio: $16,000
• Design system and UX for dashboard plus app: $14,000
• Migration of 18 months of readings from the incumbent portal: $12,000
• QA, load test to 5,000 simulated devices, UAT: $15,000
• Deployment, IaC, monitoring, runbook, handover: $9,000
• Project management across 5 months at roughly 10%: $19,000

Total: $201,000 over 22 weeks. Strip the technician mobile app ($31,000) and one integration ($8,000) and you are at $162,000. Strip migration ($12,000) and alert escalation (roughly $5,000 of the alerts line) as well and you are at $145,000 with a working platform that a dispatcher can actually use. Those are the tradeoffs worth having in scoping, while they are still cheap to make.

The ongoing costs nobody puts in the quote

Cloud hosting: $400 to $3,500 per month for most IoT platforms in this range. AWS IoT Core publishes connectivity at $0.08 per million minutes and messaging at $1.00 per million messages for the first billion, which sounds like nothing until 3,500 devices publish every 10 seconds and you are at roughly 900 million messages a month. Time-series storage and egress, not compute, is usually the line that grows.

Cellular connectivity: $2 to $8 per device per month if your devices are not on customer WiFi. At 3,500 devices that is $7,000 to $28,000 a month, dwarfing every other running cost. Model this before you pick a connectivity strategy, not after.

Third-party services: $300 to $1,500 per month. Twilio publishes US SMS at $0.0079 per message, so an alert-heavy month is real money. Add error tracking, log retention, and a maps provider.

Maintenance: 15% to 20% of build cost per year. On a $150,000 build that is $22,500 to $30,000 annually. It buys dependency and security patches, cloud provider deprecations, OS and store compliance updates for the mobile app, certificate rotation, incident response, and the small breakages nobody predicted. Skipping it for two years does not save $50,000. It creates a $60,000 remediation project.

Year one change requests: budget 25% to 40% of the build. Every IoT platform meets reality in the field and reality wins. A new device model appears. A customer wants an export format. A threshold rule needs a time window. On a $150,000 build, reserve $40,000 to $60,000 for the first 12 months. Teams that budget this ship confidently. Teams that do not spend year one negotiating.

How to not get burned on price

The cheapest quote is usually the most expensive project, for a dull reason: it is cheap because it is smaller. A $60,000 bid against a $130,000 bid is not more efficient, it has silently dropped offline handling, device provisioning, and the second integration. You discover this in month three, when the leverage has moved. Those items come back as change requests at premium rates because you have no alternative vendor. Before comparing two quotes, list what is in the expensive one and absent from the cheap one. If the gap is real scope, the cheap quote is fiction.

What a change request should cost. A blended rate, agreed in the contract, applied to a written estimate you approve before work starts. Not a "small change, we will sort it out" and not a mystery invoice. If a vendor will not name a rate for post-contract work, they are planning to name it later, when you cannot say no.

Contract terms that protect the number. Fixed scope with a signed specification, so both sides know what a change actually is. IP transfers on payment, in writing, per milestone, not at final delivery, because a dispute at 80% complete should not cost you the whole codebase. Source code in your repository from day one, with your organization owning the account and CI running in your infrastructure. Cloud accounts in your name, with the vendor granted access. Milestone payments tied to demonstrable outcomes, never calendar dates. A named exit clause with a defined handover deliverable: runbook, architecture doc, credentials, and two weeks of transition support. Vendors who build well agree to all of this in a single call. Hesitation on any one of them tells you something the proposal will not.

How to brief a vendor so the quotes come back comparable

Send every vendor the same one page and the numbers become an apples-to-apples comparison instead of a guessing game. Include:

Device reality. How many devices at launch, how many at 24 months, what hardware, what protocol, what reporting interval, and whether firmware is in scope. Say if the hardware does not exist yet.

The named integrations. Not "integrates with our systems." Write "ServiceTitan (cloud API, we have credentials) and our on-prem SQL Server historian (VPN access, no sandbox)." That single line moves quotes by $20,000.

The latency and offline requirement, in numbers. "Readings visible within 60 seconds, no remote control" prices very differently from "sub-second, with actuation from mobile." Say which. Say what happens when a device loses connectivity for six hours.

Users and roles. How many, what kinds, which need mobile versus web, and whether one login sees multiple customer organizations.

Compliance and data residency. Name the standard or say "none required." Say where data must live.

Existing data. How much history, in what system, and whether it must come across.

Budget band and hard date. Give a range. Withholding it does not get you a better price, it gets you three quotes optimized for different assumptions and no way to compare them. A good vendor uses your band to tell you what fits and what does not, which is the most valuable thing they can do before any code exists.

Then ask each vendor for the same three artifacts: a line-item breakdown, an explicit out-of-scope list, and a named team with roles and allocation. The out-of-scope list is the one that separates them, because writing it requires having thought about your project specifically.