App and Software Maintenance Costs: What Drives Them

The short answer

App and software maintenance usually costs between 15 and 25 percent of what the system cost to build, every year. That is the rule of thumb quoted across the industry, and it is a fair starting point for a budget. It is also a blunt one, because two systems that cost the same to build can need very different care.

The real number is set by the system itself: how many people rely on it, whether money moves through it, how many other systems it talks to, whether it holds personal information, and how far behind on updates it already is. A mobile app usually costs more to keep running than a web system of the same size, because Apple and Google both set deadlines you do not choose.

The rest of this guide covers what drives that number, the three things worth judging a provider on before you compare prices, what changes when the work goes offshore, and the Australian data security rules that apply either way.

What drives the cost of maintenance

Maintenance is not paid for the code changing. It is paid for everything underneath the code changing: the language it is written in, the database, the browsers, the phone operating systems and every system it connects to. These are the things that decide how much of that work your system needs.

• How many people depend on it every day. A tool three people use for an hour a week is a different risk from a system forty field staff cannot raise a job without.
• Whether money moves through it. Anything that takes payments, issues invoices or feeds your accounts is watched harder, because an error there is a wrong number in your books.
• How many systems it connects to. Every link to Xero, MYOB, a payment gateway or a customer relationship system is a moving part somebody else controls. Each one adds checks and, eventually, a rebuild when the platform retires the old connection.
• Whether it holds personal or health information. Customer records raise the standard of care and the speed patches have to go on. More on that in the data security section below.
• How far behind it already is. A system running on versions that are out of support needs catching up before it can be maintained. That first catch-up is often the largest single cost.
• What an hour of downtime costs you. If the honest answer is very little, cover can be light. If a shop cannot take orders, out of hours cover earns its place.

Here is what that looks like in practice. A booking app for a Perth physiotherapy group, used by patients on both phone platforms, holding health information and connected to a practice system, needs far more than an internal stock report used by two people in a Brisbane warehouse. Both might have cost a similar amount to build.

App maintenance costs and software maintenance costs compared

People search for these as one thing, and much of the work is shared. But a mobile app carries costs a web system does not.

What a mobile app adds. Apple and Google each release a major operating system every year, and an app has to be tested against both. Google Play requires apps to target a recent Android version or it stops offering them to new users. Apple requires updates to be built with a recent version of its tools. Signing certificates, push notification keys and developer accounts all expire on their own dates. Miss one of these and the app does not slowly degrade. It disappears from the store or stops sending notifications.

What every system needs, app or not. The server and database behind it need security patches. The language it is written in has a published end of support date. The connections to other systems need watching. The backups need testing. This is the core of both app maintenance and software maintenance, and it is usually the larger share of the work.

So when an app quote comes in higher than a web system quote of a similar size, that is usually why. Ask the provider to show you which parts of the quote are app specific, so you can see the difference rather than take it on faith.

Three things to judge a maintenance provider on

Price is the easiest thing to compare and the least useful on its own. Two quotes are only comparable when they describe the same work, and the cheapest one is often cheaper because it quietly covers less. Before you look at the number, look at these three things.

1. What is included

A maintenance agreement is a list of work. The list matters more than the price on the front.

• It is the only way to compare quotes fairly. One provider includes security patching, error monitoring, tested backups and integration checks. Another includes "support as needed". They are not the same product at different prices. They are different products.
• The exclusions are where surprise invoices come from. When Xero or MYOB retires the connection your system uses, is the rebuild included or quoted on top? What about a phone operating system update that breaks a screen? Ask before you sign, not on the day it happens.
• Included hours decide whether small fixes ever get done. If every minor change needs its own quote, staff stop asking. The small annoyances pile up until the system feels old long before it is.

2. Reporting

Maintenance done well looks exactly like nothing happening. That is the point of it, and also why it is hard to know whether you are getting it.

• It is your proof the work is being done. A short monthly report in plain language tells you what was patched, what errors came up, what the backup test showed and what is coming up. Without it you are paying for a promise.
• It shows problems while they are still small. A disk filling a little each week, a nightly sync that has started failing, a security certificate due in three weeks. A report surfaces these months before they become an outage.
• It is the record you need when someone asks. An insurer, an auditor, a buyer of your business or the privacy regulator after a data breach will all ask what you did to keep the system safe. A run of monthly reports answers that in one email.

3. Trust

A maintenance provider has the keys to your business. That is not a figure of speech. They hold administrator access to the system and, in most cases, to the customer data inside it.

• They can see your data. Customer names, addresses, invoices, sometimes health records. You need to know who exactly has that access, where they are, and how it is removed when they leave.
• You depend on them on your worst day. A response time on paper is only as good as the person who picks up the phone at seven on a Saturday when the system is down. Ask who that person is, by name.
• You should be able to leave. The code, the passwords, the hosting account and the domain should all be in your business's name. A provider you can walk away from is one you can trust to stay for the right reasons.

Outsource offshore or keep it local

Offshore maintenance is cheaper by the hour, and for some work it is a sensible choice. Here is how it compares with an Australian provider on the things that drive the total cost, not just the hourly rate.

Why it matters

• The hourly rate is not the cost. A cheaper hour that needs a longer brief, a second round of fixes and a day's wait for a reply is often the more expensive month. Count the time your own team spends managing the work.
• Your legal accountability does not move offshore with the work. If your business is covered by the Privacy Act and an overseas provider mishandles your customers' personal information, the law generally treats it as your breach. You also carry the duty to notify.
• Downtime is measured in your hours, not theirs. When a system staff need fails at nine in the morning in Melbourne, a provider who starts work at nine at night has already cost you a full working day.

If you do outsource offshore, keep personal data out of what they can reach where you can, put the Privacy Act obligations in the contract, and keep the code and the hosting in your name.

Data security requirements in Australia

Maintenance is not only a technical choice. For many Australian businesses it is part of meeting the law. These are the rules that most often apply to a business system and the provider who looks after it.

The Privacy Act 1988 and the Australian Privacy Principles. The Act covers businesses with an annual turnover over $3 million, and every business that provides a health service, whatever its size, along with a few others such as businesses that trade in personal information. It sets out thirteen Australian Privacy Principles. Principle 11 requires you to take reasonable steps to protect personal information from misuse, loss and unauthorised access. Keeping software patched and access controlled is a large part of what reasonable steps means in practice.

Sending data overseas. Principle 8 covers disclosing personal information to someone outside Australia, which includes an offshore provider who can see it. Before that happens you must take reasonable steps to make sure they handle it to the Australian standard, and in most cases your business is held accountable for what they do with it.

The Notifiable Data Breaches scheme. If a data breach is likely to cause serious harm to the people involved, you must notify them and the Office of the Australian Information Commissioner. If you only suspect a breach, you have 30 days to assess it. Good monitoring and logs are what make that assessment possible. Without them you cannot say what was taken, or when.

Stronger privacy rights from 2025. Changes passed in 2024 gave the regulator new powers and penalties, and from June 2025 individuals can take legal action for a serious invasion of their privacy. The cost of getting this wrong has gone up.

Ransomware payment reporting. Under the Cyber Security Act 2024, a business with turnover above the same threshold that makes a ransomware payment must report it to the Australian Signals Directorate within 72 hours.

The Essential Eight. The Australian Signals Directorate publishes eight baseline security measures, and several are maintenance work: patching applications, patching operating systems, restricting administrator access and keeping regular backups. At the first maturity level, patches for internet-facing systems are expected within two weeks of release, or within 48 hours where a working exploit exists. It is not law for most private businesses, but insurers and larger customers increasingly ask about it.

Health information. Health records carry extra rules, including state laws in Victoria, New South Wales and the Australian Capital Territory, and systems that connect to My Health Record carry their own requirements, including limits on holding that data outside Australia. If your system holds health information, tell your provider at the start.

The practical point for maintenance: if your business is covered by these rules, a provider who patches on a schedule, controls and logs access, tests backups and reports in writing is not a luxury. It is how you show you took reasonable steps.

Questions to ask before you sign

If you are weighing up cover for your own app or system, our software and app maintenance service page shows what we watch and how a package is shaped around the system.