Software Maintenance Contracts: What to Ask For and What to Skip

Software does not wear out like a machine, yet it still decays. Libraries release security fixes, browsers and phones change, payment and courier providers alter their interfaces, and your own business develops new needs. A system left alone gradually becomes slower, riskier and harder to change.

The question is not whether to maintain it but who will, and on what terms. Without an arrangement, problems get fixed in a panic by whoever answers the phone, often at the worst moment, such as during a seasonal sales peak.

Look for routine security updates, scheduled backups and a tested way to restore them, uptime and error monitoring, bug fixes for defects in the delivered work, and help with hosting issues. Each of these should be named, because anything unnamed is open to argument when something breaks.

Clarify what is excluded. New features, redesigns, content changes and problems caused by third-party services are commonly outside a basic arrangement. That is acceptable if you know it and have a clear way to request such work separately.

Agree how problems are reported, who answers, during which hours, and how quickly an acknowledgement is expected for urgent and routine issues. Put the language of severity in writing: what counts as an emergency, such as checkout being down, and what counts as a cosmetic annoyance.

Ask for a short regular report showing what was done, what was found and what is recommended. A contract without visible activity makes it impossible to judge value, and it removes your ability to challenge charges.

Common structures are a recurring retainer for defined tasks, a pool of hours used as needed, or pay per incident. A retainer gives predictability and priority; a pool of hours suits changing needs; pay per incident works for small, stable systems, though response may be slower.

Whichever you choose, ask how unused time is treated, how extra work is estimated and approved, and how to end the arrangement. Avoid long lock-ins before you have seen the vendor perform.

Keep ownership of hosting, domains, repositories and admin logins, so that maintenance is a service you can change rather than a dependency you cannot escape. Ask for documentation so another team can step in if needed.

Review the contract yearly. Systems and needs evolve, and so should the scope. Where personal data is involved, make sure the arrangement covers secure handling and breach reporting, and seek legal advice on obligations that apply to your business.