Quick answer
A software maintenance contract should define included activities such as bug fixes, security patches, dependency and platform updates, hosting management, backups and monitoring; severity levels with response and resolution targets; support hours and channels; how change requests are estimated and charged; reporting; access and credential ownership; and exit and handover terms.
Key takeaways
- Separate maintenance from new feature development.
- Define severity levels and realistic response targets.
- Security and dependency updates must be explicitly included.
- Ensure you own code, credentials and documentation.
Who this guide is for
Business owners and managers buying or renewing support for custom software, websites or mobile apps.
Understand what maintenance means
Maintenance typically includes corrective work such as fixing defects, preventive work such as security patches and dependency updates, adaptive work for new operating system or browser versions, and operational tasks such as monitoring and backups. New features and significant changes are usually separate. Make the boundaries explicit to avoid disputes.
Define severity and response targets
Agree severity levels, for example critical when the system is down for all users, high when a major function fails, medium and low for lesser issues. For each, define response time, update frequency and target resolution or workaround time, and whether they apply during business hours or around the clock. Only agree targets the provider can actually staff.
Include security and updates
Frameworks, libraries, plugins and servers need regular updates to stay secure. Specify how often updates are reviewed and applied, how critical vulnerabilities are handled and how updates are tested. Unmaintained dependencies are a common source of security incidents in business software. Ask for a regular report listing outdated components and known vulnerabilities, so you can see the security status rather than assuming updates are happening.
Cover hosting, backups and monitoring
Clarify who manages hosting, SSL certificates, domains and email delivery settings, who monitors uptime and errors and how backups are taken and tested. If the provider does not manage hosting, define the hand-offs. Test that backups can actually be restored at agreed intervals. Specify where monitoring alerts go and who acts on them out of hours, so a down notification does not sit unread in an inbox overnight.
Handle change requests transparently
Small changes are inevitable. Some contracts include a monthly allowance of hours; others estimate each request. Define how requests are submitted, estimated, approved and prioritized, and whether unused hours carry over. Transparency here prevents frustration on both sides. A shared request board where both sides can see status, estimates and approvals reduces back-and-forth by email and makes monthly reviews quicker. It also gives you a clear record of what was delivered for the fees paid.
Protect ownership and access
Ensure you own the source code, have access to repositories, hosting accounts, domains and third-party services in your organization’s name, and receive updated documentation. Credentials should not be held only by the provider. These terms protect you if the relationship ends. Use a shared password manager or identity system owned by your organization, so access can be granted and revoked without depending on individuals.
Agree reporting and exit terms
Request periodic reports covering incidents, changes, updates applied and hours used. Define notice periods and a handover process, including documentation and knowledge transfer, at the end of the contract. Pricing is commonly a fixed monthly fee, an hours bank or a combination; compare offers against the same scope.
Scope checklist
- Which activities are included and excluded?
- What are severity levels and response targets?
- How are security and dependency updates handled?
- Who owns code, accounts and credentials?
- What are the handover terms if the contract ends?
Frequently asked questions
How much does software maintenance cost per year?
It depends on system size, complexity, hosting responsibility, support hours and change volume. Ask for itemized offers with clear inclusions rather than relying on a general percentage of build cost.
What is an SLA in a software maintenance contract?
A service level agreement defines response and resolution targets for issues by severity, along with support hours and reporting.
Should bug fixes be free after launch?
Many contracts include a warranty period for defects in delivered scope. After that, fixes are usually part of a maintenance agreement.
Prepared with AI assistance as an engineering decision guide. Examples are illustrative unless explicitly labelled as an internal implementation. No independent expert review or customer outcome is claimed.
Concerned about an existing system?
Share what the system does, who maintains it today and what is going wrong. Scope, access, dependencies and commercial terms are agreed before delivery. Do not submit passwords, API keys or confidential records.
