The verdict in three sentences
In New York, maintaining a custom internal web app is usually bought either as a monthly retainer (roughly USD 3,000 to 15,000 a month) or hourly at USD 150 to 220 an hour, and a sustainable annual budget sits around 15 to 20% of the original build cost. Retainers win when the workload is steady and you need guaranteed response times; hourly wins when changes come in bursts and you have a product owner who manages the backlog tightly. For enterprise-facing apps, what you really pay for is the SLA, a clean exit path and the evidence your clients' SOC 2-minded security teams will ask for.
What maintenance actually covers
Disputes almost always come from contracts that lump everything together. Separate these four buckets explicitly:
- Corrective: fixing defects within agreed response and resolution times.
- Preventive and technical: framework and dependency upgrades, security patches, backup checks, uptime monitoring.
- Enhancements: new features, screens, reports and integrations.
- Level 2 support for questions your internal help desk cannot answer.
Treat the 15 to 20% rule as a 2026 estimate to adjust for the app's age and stability. An app that cost USD 300,000 to build typically needs USD 45,000 to 60,000 a year to stay healthy. Spend less than 10% and technical debt piles up, pulling a full rebuild years earlier.
Retainer versus hourly: the numbers
| Criterion | Monthly retainer | Hourly (time and materials) |
|---|---|---|
| 2026 market ballpark, New York | USD 3,000 to 15,000 per month | USD 150 to 220 per hour |
| What is included | Fixes, patching, a block of enhancement hours (often 10 to 40) | Whatever you request, hour by hour |
| Budget predictability | High | Low unless the backlog is capped |
| Response commitment | Contractual SLA | Often best effort unless written in |
| Main risk for the buyer | Paying for unused hours | Hours creeping up month after month |
| Best fit | Stable app with regular small changes | Large one-off projects, strong in-house product team |
| Service credits | Common | Rare |
A hybrid works well for many mid-market firms: a base retainer covering fixes, security and a small enhancement block, plus larger projects quoted separately at a fixed price or capped hours.
The SLA and the security evidence enterprise clients expect
| Severity | Example | Response | Fix or workaround |
|---|---|---|---|
| Critical | App down, data loss | 1 business hour | 4 business hours |
| High | Key function blocked for a team | 4 business hours | 2 business days |
| Medium | Defect with an easy workaround | 1 business day | Next release |
| Security | Published vulnerability in a dependency | 1 business day | Based on severity, within 5 business days |
| Enhancement | New report | Estimate within 5 business days | Agreed schedule |
If your company sells to US enterprises, their vendor security reviews will often ask whether your critical systems and the vendors maintaining them align with SOC 2 criteria. Your maintenance partner does not always need its own SOC 2 report, but the contract should give you what auditors look for: named people with access, quarterly access reviews, MFA on code and hosting accounts, change logs tied to tickets, and documented incident handling. Ask for these as monthly or quarterly deliverables.
Also insist on an exit clause: code in your own repository, up-to-date runbooks and an agreed number of handover hours priced in advance.
For smaller apps and websites, Kolonell's monthly maintenance prices are EUR 53 (Basic), EUR 114 (Standard) and EUR 183 (Premium), or 35,000 to 120,000 FCFA, covering updates, backups and monitoring from a nearshore team in Dakar. Enhancements on a 120-user enterprise app are quoted separately.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Illustrative example: Dana, head of IT at a 300-person insurance brokerage in Midtown Manhattan, is renewing maintenance on a claims-tracking app used by 120 staff, built for USD 280,000.
- Target budget at 15 to 20% of build: USD 42,000 to 56,000 a year.
- Retainer: USD 3,800 a month including 15 enhancement hours = USD 45,600, plus a USD 6,000 feature project: USD 51,600.
- Hourly: last year's 270 hours × USD 185 = USD 49,950, with no uptime commitment.
- One full-day critical outage idles 120 staff: 120 × 7 hours × USD 55 = USD 46,200 of lost productivity.
Dana picks the retainer with a 4-hour critical SLA and quarterly access-review reports for client audits.
FAQ
How much notice do we need to switch providers?
Ninety days is common. Add 30 to 60 days of overlap where the outgoing team supports the new one, with handover hours fixed in the contract.
How do we know a retainer is oversized?
Ask for 12 months of ticket and hours data. If less than 60% of the enhancement block is used, shrink the base or move part of it to hourly.
Is USD 150 to 220 an hour negotiable?
Rates depend on seniority and commitment. A yearly commitment of 300 hours or more often unlocks a modest volume discount.
Do internal apps really need an SLA?
Yes, once the app drives billing, claims or payroll. A 4-hour critical SLA typically adds 10 to 20% to the monthly fee, which is small next to one day of downtime for 120 users.
Is security patching included?
It should be: dependency updates at least monthly and critical patches within days. An annual penetration test is usually a separate line item.
Let's scope your project. Share your app's scope, ticket history and current contract and we will propose a retainer, hourly or hybrid model with a costed SLA. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
