Build, buy or subscribe? Six questions settle it.

Imagine a physiotherapy clinic in Ohio that needs a way to handle bookings, reminders and patient notes. It has three routes.

• Subscribe. Pay a monthly fee for a hosted product. Fast to start, someone else maintains it, and you rent rather than own.
• Buy. Pay for a licence to software you install and run. You control more, and you also look after updates and hosting.
• Build. Pay a team to create software designed for you. You can get exactly what you need, and you take on the cost of running it for as long as you use it.

Many businesses end up with a mix: subscriptions for everyday tools, and custom software only where it matters. That is usually the right instinct.

This framework is our own, built from the evidence below. Answer each for the software you are considering.

1. 1. EdgeDoes this software make you different from competitors, or is it a commodity need such as accounts, email or scheduling? Edge leans toward building. Commodity leans toward buying or subscribing.
2. 2. FitDoes an existing product do at least 80 percent of what you need? If so, adapt your process before you pay for something custom.
3. 3. ConnectionsHow many other systems must it talk to? Okta reports that its customers use an average of 101 apps. That is a vendor figure drawn from its own, mostly larger customers, but it shows how fast tools pile up. Every connection is something to maintain.
4. 4. DataCan you get all your data out, in a usable format, whenever you want?
5. 5. ExitWhat happens if the vendor raises prices, is sold or disappears? What does leaving cost?
6. 6. Ownership costWho will keep it secure and working in year three? Budget for that, not only the build.

We looked for a clean figure on how much of a software product's lifetime cost is maintenance and could not find one from a primary source, so we will not quote one. What we can show is what governments report when they audit their own IT spending:

• The US Government Accountability Office (GAO) reported in 2025 that agencies typically spend about 80% of their IT budget on operating and maintaining existing systems, including legacy ones. In 2016 it reported about 75%.
• The UK National Audit Office reported that Defra estimated maintaining its ageing digital systems takes 76% of its total digital, data and technology spending, and that 30% of its legacy applications are unsupported by the developer, so they get no updates or security patches.

These are shares of public-sector budgets, not a rule for your project. But they carry a clear message: the first invoice is the smaller one.

And builds often cost more than planned

Researchers Bent Flyvbjerg and Alexander Budzier studied 1,471 IT projects. The average cost overrun was 27%, but about one project in six was a "black swan" that overran its cost by around 200% and its schedule by almost 70%. The lesson is to run builds in small stages with a hard check at each one.

Plan the exit on day one, while you still have leverage.

• Data portability is narrower than people think. GDPR Article 20 lets individuals receive the personal data they provided, in a structured, commonly used and machine-readable format, and pass it to another provider. It applies where processing is based on consent or a contract. It covers personal data about individuals, not your company's own commercial records, so ask the vendor about your business data in writing.
• EU switching rules. Under the EU Data Act, providers of data processing services may not impose switching charges from 12 January 2027, and the Act defines these to include data egress charges. Between 11 January 2024 and 12 January 2027 they may charge reduced fees that do not exceed their costs. It applies to the services it covers, so check whether yours is one.
• Cancelling should be as easy as signing up. In the US, the FTC's 2024 click-to-cancel rule was vacated by the Eighth Circuit in July 2025 on procedural grounds, and the agency restarted rulemaking in March 2026, asking for public comment. We found no new rule in force. Consumer and state auto-renewal laws can still apply, so read the renewal and cancellation terms.
• Custom code: get the source and the rights. If you build, the contract should assign the code to you. If you rely on a supplier's custom product, ask about source-code escrow, a three-party arrangement where the code is held by an independent agent and released under conditions such as the supplier's insolvency. UK government supplier listings show it is a commonly bought service, and one public contract schedule grants a usable licence to the source code on release. Escrow needs a lawyer to set up.

If your supplier is overseas, see our guide to hiring a team abroad for ownership and contract basics.

• Independent security evidenceAsk for a SOC 2 report or ISO 27001 certification. AICPA describes SOC 2 as an examination of controls relevant to security, availability, processing integrity, confidentiality or privacy. ISO says ISO 27001 sets requirements for an information security management system, and that certification by an accredited body adds confidence but is optional. Read the report's scope: does it cover the product you are buying?
• A patch policyHow fast do they fix serious flaws, and how do they tell you? CISA's Secure by Design guidance, aimed at software makers, urges them to take ownership of customer security outcomes and to be transparent. It is voluntary, but a good question to put to any vendor.
• If you run it yourself, check what is being exploitedCISA's Known Exploited Vulnerabilities catalog lists flaws known to be used by attackers. Compare it with your software.
• An export testBefore signing, ask for a sample export of your data and open it.
• The renewal and cancellation termsNotice periods, price rises and what happens to your data on exit.

A word on open source

Open source can save a lot, and it carries conditions. An open source licence approved by the Open Source Initiative must allow free redistribution and commercial use. But some licences attach duties. The Free Software Foundation's FAQ says GPL software can be sold only under GPL terms, and that you cannot incorporate GPL-covered software in a proprietary system. Its AGPL goes further: section 13 says that if you modify the program, you must offer the source to all users who interact with it remotely through a network. So an AGPL component, modified and offered as a web service, can trigger a source-sharing duty without you distributing a single copy. Ask your developers which licences are in your product, and have a lawyer review any copyleft ones.

One more tip: the survey data on small firms is mixed. The UK government's 2026 Business Data Survey found 31% of businesses handling digitised data use a public cloud provider, and 27% use on-premises servers, so there is no single "normal" setup. Choose what suits your size and risk.