Software Maintenance and Support Cost: What You Actually Pay in 2026

What software maintenance actually costs: three bands

"Maintenance" is the least standardised word in software procurement. Two vendors can quote the same product and mean completely different things, which is why the range looks absurd until you break it into shapes. Across 2,000+ delivered projects at Digital Heroes, maintenance retainers cluster into three.

Tier 1: Keep-alive. $1,200 to $3,000 per month. Security and dependency patching, uptime monitoring with alerting, production bug fixes on a best-effort basis, and a response SLA measured in business days rather than hours. Roughly 8 to 15 engineering hours a month from a shared pool. Suits an internal tool, a marketing site with some logic behind it, or a product in maintenance mode that nobody is actively selling.

What this does not buy, and you should hear it before signing: no new features, no on-call outside business hours, no dedicated engineer who knows your codebase by heart, no compliance evidence upkeep, and no guaranteed turnaround on anything. If your product going down on a Saturday costs you money, this tier is the wrong tier and the discount is not worth it.

Tier 2: Operating retainer. $3,500 to $9,000 per month. Where most funded products land. 30 to 40 engineering hours a month, a named tech lead who stays on your account, a 4 business hour response SLA on production issues, patching and dependency management, up to about six live integrations kept current as their upstream APIs change, one mobile platform kept compliant with store requirements, and a small enhancement backlog of 10 to 15 hours so minor requests do not each become a negotiation. Team is typically a lead at 20 percent, an engineer at 25 percent, and QA on demand.

Tier 3: Dedicated pod. $12,000 to $25,000 per month. Two to four people allocated to you, 24/7 on-call with a 1 hour response SLA, compliance evidence maintained continuously rather than panic-assembled before an audit, performance work as an ongoing workstream, and enough capacity that meaningful feature development happens inside the retainer instead of alongside it. This is a staffing arrangement wearing a support contract's clothes, and it is priced accordingly.

What actually drives the number

Codebase condition. Adds 30% to 50% for the first year. This is the driver nobody quotes honestly, because measuring it requires reading your code before pricing. A codebase with under 30 percent test coverage, no CI pipeline and no documentation costs 30 to 50 percent more to maintain, because every one-line fix needs manual regression testing across the whole surface. On a $5,000 retainer that is $1,500 to $2,500 a month of pure tax, paid every month, forever. A one-off stabilisation sprint at $15,000 to $30,000 to add a test suite, CI, and runbooks usually pays for itself inside a year. Ask for the code audit output in writing before you sign anything, because it tells you which conversation you are actually having.

Integration count. $250 to $600 per integration per month. Every live integration is a thing that breaks without warning when someone else ships. Upstream APIs deprecate endpoints, rotate auth schemes, change rate limits, and silently alter response shapes. Six integrations is $1,500 to $3,600 a month of your retainer before a single line of your own code gets touched. Modern documented APIs sit at the bottom of the band; on-premise systems and anything with a scheduled file drop sit at the top.

SLA depth. Doubles the price between the extremes. Next business day response is the cheapest thing on the menu. A 4 business hour SLA costs roughly 40 percent more than next-day, because someone has to actually be watching. A 1 hour 24/7 SLA roughly doubles a next-day retainer, because you are now paying for a rota across timezones, not for hours worked. Most teams buy more SLA than their product needs. The honest test: write down what an outage costs you per hour. If the answer is under a few hundred dollars, buy business hours and sleep well.

Platform count. Adds 25% to 40% per mobile platform. A web app has one runtime that changes slowly. A mobile app has two operating systems that ship breaking changes annually, two app stores with policy requirements that move without consultation, and a device matrix that grows every autumn. Each mobile platform adds 25 to 40 percent to a web-only retainer. This is not padding, it is the annual OS compatibility pass plus store resubmissions.

Compliance upkeep. $800 to $3,000 per month. SOC 2 is not a certificate you win once. Controls need evidence collected continuously, access reviews run quarterly, and vendor assessments refreshed. HIPAA adds BAA management across every subprocessor and access log review. Doing this inside a retainer costs $800 to $3,000 a month. Doing it in a panic six weeks before an audit costs several times that and produces worse evidence.

Team continuity. Worth 15% to 25%, and it is worth paying. The cheapest retainers assign whoever is free that week. That engineer spends two hours orienting before touching anything, every time, and you pay for those two hours. A named lead who has held your account for a year fixes in 30 minutes what a stranger takes a day to find. When comparing quotes, ask whether the team is named and allocated or pooled and rotating. The pooled one is cheaper on paper and more expensive in practice.

Worked example: a $120,000 build, one year on

A B2B web app with a React Native companion, five integrations, about 400 daily active users. Built for $120,000, launched 14 months ago, now on an operating retainer. Here is a representative year.

• Base retainer: 35 hours a month at a $110 blended rate, 12 months: $46,200
• Onboarding and code audit, one-off at the start: $4,500
• Stabilisation sprint (test suite to 60 percent coverage, CI pipeline, runbooks): $18,000
• Cloud hosting at roughly $1,400 a month: $16,800
• Third-party services (error tracking, monitoring, transactional email, hosting platform seats): $7,200
• Apple Developer Program: $99
• Change requests across the year (four small, one integration): $21,000

Total year one: $113,799. Against a $120,000 build, that is roughly 95 percent of the original cost spent in the first year of running it, and the number surprises people every time.

The important part is which lines are structural and which are one-off. Strip the stabilisation sprint ($18,000) and the onboarding audit ($4,500), and year two runs about $91,300 assuming similar change volume. Strip the change requests too and the pure cost of keeping the thing alive and correct is $70,300, or 59 percent of build. The retainer itself, at $46,200, is 39 percent of build cost, which is well above the 15 to 20 percent rule of thumb, because the rule of thumb covers the retainer on a healthy codebase and this one needed work. That is exactly what the stabilisation sprint buys down.

The costs that sit outside the retainer

Cloud hosting: $800 to $3,500 a month for a mid-sized product. Vendors quote maintenance and clients hear "everything", then get a separate AWS bill. Ask explicitly whether infrastructure is inside or outside the number.

Third-party services: $300 to $1,200 a month. Sentry Team starts at $26 a month at published list price. Datadog Pro publishes at $15 per host per month. Vercel Pro is $20 per user per month. The Apple Developer Program is $99 a year. None of these are large alone, and together they are a line item you should see written down.

Payment processing. If you take money, your processor takes a percentage. It is not maintenance, but it belongs in the same budget conversation, because it scales with success rather than with engineering.

Change requests: 25% to 40% of build cost in year one. On a $120,000 build, that is $30,000 to $48,000. The business always asks for things that were not in the original scope, because the original scope was written before anyone used the product. Budget it as a line rather than treating each request as an unwelcome surprise.

How to not get burned on price

Maintenance is where the leverage sits with the vendor, and both sides know it. Your code is on their machines, their engineer is the only one who remembers why that module works the way it does, and moving vendors costs you a month of onboarding. A retainer priced attractively in month one can be repriced at renewal, and your alternative is expensive. This is not villainy, it is structure, and you fix it with contract terms rather than trust.

The cheap retainer usually buys fewer hours against the same expectations. A $2,000 quote and a $6,000 quote for the same product are not the same service at different margins. One has 10 hours and a next-day SLA, the other has 35 hours and a 4 hour SLA with a named lead. Ask both to state hours, SLA, integration count and named team, and the comparison resolves itself.

What a change request should cost. Quoted in hours at the blended rate you agreed at signature, not as a lump sum. A small change (a new field, a report tweak, a copy change with logic behind it) is $600 to $2,000. A new third-party integration is $4,000 to $12,000 depending on documentation quality. If a vendor gives you a number without the hour breakdown behind it, that is the warning sign, not the number itself.

Contract terms that protect the number. Four matter more than the rest. A scope schedule listing included hours, integrations, SLA and explicit exclusions, so "is that covered" has a written answer. IP assignment on payment rather than at engagement end. Source code in your own repository and cloud account with the vendor added as a collaborator, never the reverse. A 30 day exit with a zero-cost handover clause covering documentation and a live walkthrough. If the vendor holds the repository keys, your renewal is not a negotiation, it is an invoice.

How to brief vendors so the quotes compare

Maintenance quotes are less comparable than build quotes, because the deliverable is availability rather than an artifact. Send everyone the same page.

The stack and the codebase, honestly. Languages, frameworks, hosting, test coverage if you know it, and whether CI exists. Understating the mess gets you a quote that gets revised upward in month two.

The integrations, named. "Five integrations" is not a spec. List them, and say which are documented cloud APIs and which are on-premise or file-based.

Your real SLA need, with the reasoning. Say "4 business hours, because our users are US business hours only and an outage costs us roughly $2,000 an hour." A vendor can price that. "We need great support" gets priced defensively.

Included development hours. Decide whether you want zero (pure keep-alive) or a monthly allowance. This single line moves quotes more than anything else.

Platforms and users. Web only or web plus mobile, how many users, and their timezone spread.

Compliance obligations. Name the standard or say none. Say whether an audit is scheduled.

Then ask each vendor for three things: hours included per month with the blended rate, the exclusions list, and whether the team is named or pooled. Every meaningful difference between two maintenance quotes lives in those three answers.