What it costs to keep a system or app live in 2026

Almost every software quote I see ends on launch day. There's the price of design, the price of development and the delivery date. What happens the next month is left out, as if the system, once done, stayed done forever.

It doesn't. A live system runs on servers that bill every month, depends on third-party services that change prices and rules, and sits on top of phones, browsers and app stores that change every year. In this guide I show what goes into the cost of keeping a system or app live, with numbers from public sources, how to build the monthly budget and what a maintenance contract needs.

What you pay every month to keep a system live

The cost of maintaining a digital product splits into two parts.

Fixed costs, which arrive as bills:

• hosting for the system and the database;
• third-party services: email, SMS, maps, payment gateway, file storage;
• app store fees, for apps;
• domain and certificates.

Labor costs, which depend on people:

• updates required by Apple, Google, browsers and libraries;
• security fixes;
• bug fixes;
• support for your team and your customers;
• evolution: what doesn't exist yet and the business now needs.

The first part is easy to predict and is usually the smaller one. The second is what catches founders by surprise, because it doesn't show up on any bill until the day something breaks.

Hosting and third-party services: the bill that arrives

The most widely used hosting platforms today charge by plan and by usage. Two examples of public pricing, in October 2026:

• Vercel, widely used for websites and web systems, charges US$20 a month on the Pro plan, with US$20 of usage credit included and 1 TB of transfer per month;
• Supabase, used for database and login, charges from US$25 a month on the Pro plan, with 8 GB of disk per project and 100,000 monthly active users.

Two details matter more than the price. First: above what's included, everything is billed by usage. More customers, more files and more traffic raise the bill. Second: a free plan is not a production plan. Vercel's Hobby plan is, in the company's own words, “for personal, non-commercial use.” And free Supabase projects are paused after a week of inactivity.

Add to that the services the system uses underneath: email delivery, SMS for login, maps, invoicing, payments. Each has its own plan, limit and price. And many charge in dollars, so exchange rate swings hit your bill every month.

App stores, phones and browsers change without asking

If your product is an app, there are fixed fees, which also factor into how much it costs to build an app. Apple charges US$99 a year for the Apple Developer Program. Google Play charges a one-time US$25 at signup.

The expensive part is keeping up with the rules. Two examples from 2026:

• Apple: since April 28, 2026, according to Apple's requirements page, every app submitted to the App Store must be built with Xcode 26 and the iOS 26 SDK or later. The rule applies to every submission: the next update to an app that's already published also has to make the switch.
• Google: starting August 31, 2026, new apps and updates on Google Play must target Android 16, according to the Android documentation. Apps targeting older versions stop showing up for new users on newer phones. You can request an extension, until November 1, 2026.

Web systems have a calendar too. The technologies underneath them have expiration dates. The LTS version of Node.js, one of the most used for running web systems, gets critical fixes for about 30 months, according to the official site. Version 20 has already reached end of life. A system running on an unsupported version no longer gets security fixes.

None of these changes is optional, and none happens on its own. Someone has to update, test and publish.

Security: what not updating costs

This is the item most people cut and the one that costs the most when it's missing. Verizon's 2026 Data Breach Investigations Report, one of the most cited security studies in the world, shows that 31% of data breaches start by exploiting software flaws. For the first time, that route overtook stolen credentials as the main way in.

The same report, according to Help Net Security, shows that companies take a median of 43 days to fully apply a security fix. The year before it was 32. And only 26% of the flaws in the known exploited vulnerabilities catalog of CISA, the US cybersecurity agency, were fully fixed.

In Brazil, the cost of a breach is high. According to the IBM report released on July 30, 2025, the average cost reached R$7.19 million. Breaches that started by exploiting vulnerabilities were 13% of cases, with an average cost of R$7.61 million.

Updating libraries and applying patches is invisible to the end customer. That's why it's the first thing cut when the budget gets tight. And it's the thing that protects the business most.

How to build the monthly budget

Do the math in four lines. It works for web systems, SaaS and apps.

1. Infrastructure. List every service the system uses, with the plan, the price and the included limit. Calculate the cost at today's usage and at twice the users. Convert anything billed in dollars with a margin for the exchange rate.
2. Updates and security. Reserve fixed hours every month to update libraries, apply patches and keep up with Apple and Google requirements. That time can't depend on whatever is left over.
3. Fixes and support. Define who responds when something breaks, how fast and during which hours. A payment error on a Friday night needs a name and a phone number.
4. Evolution. Set aside a budget for what's new: screens, integrations, reports. Without this line, every improvement becomes an emergency and fights fixes for the same hours.

If your product was built with AI tools, the maintenance line is usually bigger than it looks. I wrote about this in the maintenance cost of vibe coding. And if you're still budgeting the project, read how much a custom web system costs to put both numbers side by side.

What a maintenance contract needs to cover

A vague maintenance contract turns into an argument at the first problem. Before you sign, check that it answers in writing:

• What's included: updates, security patches, bug fixes, monitoring, backups.
• What's not included: new features are usually evolution, billed separately. This needs to be clear.
• Response time: how long until work starts on a critical error, and how long for a minor one.
• Monthly hours: how many, what happens to unused ones and what an extra hour costs.
• Store and platform requirements: who tracks the deadlines from Apple, Google and vendors, and who tells you.
• Accounts and access: hosting, domain, store accounts and code repository in your company's name.
• Report: what was done that month, in language you understand.
• Exit: how you get everything if you decide to switch vendors.

If the contract says nothing about accounts and exit, you're not buying maintenance. You're becoming dependent.

How we do it at the Studio

At the Studio, the cost of running the product comes up before launch, during discovery. The price is fixed after that discovery, and the deadline is written into the contract. The code, files and access stay in the client's name, including the store and hosting accounts. We have our in-house dev team, and we use Claude Code and Figma for design and build.

Every system we deliver ships with an AI agent that runs every day, flags failures, suggests improvements and checks that the data makes sense. It's the part of maintenance that usually has no owner: looking at the system every day, before the customer finds the problem.

One case shows why this matters for the bill. LCX, a travel company operating in more than 10 countries in South America, had one system per country. We merged everything into a single system, live in 29 days. Fewer systems means fewer servers, fewer updates and fewer places for a failure to hide.

If your system is already live and you don't know what it costs to maintain, or who takes care of it today, that's the work of our system maintenance and evolution service.