Taking Over an Orphaned Web App: Support Contract and SLA Pricing 2026

The verdict in three sentences

Taking over an orphaned application starts with a takeover audit of 2 to 4 weeks, before you sign any support contract. Serious application maintenance and support costs around 900 to 4,500 USD a month, roughly 15 to 20 % of the original build cost per year, with a response time on critical incidents of 2 to 4 hours. An exit and handover clause must be negotiated on day one so you never end up in the same position again.

The risks of an app with no vendor

The story is common: the agency or freelance developer who built the tool closes shop, pivots to other clients or simply stops answering. The app still runs, but nobody really knows how. Risks pile up quickly:

• Outdated dependencies: a framework or runtime with no security patches for 12 to 24 months.
• Lost access: hosting, domain registrar or code repository credentials held by the former vendor.
• No documentation: no database schema, no deployment procedure.
• Unhandled incidents: a billing bug or a Monday morning outage with nobody to call.

Before pricing support, the new team must understand what it is taking on. That is the purpose of the audit. For US companies with SOC 2 or cyber insurance commitments, an unpatched orphaned app can also put renewals at risk.

The takeover audit: what to check

The audit runs 2 to 4 weeks and typically costs 3,500 to 10,000 USD depending on the size of the app. It covers recovering access, the technical inventory, code quality, security and the ability to redeploy. You come out with a risk rating, a list of urgent fixes and a realistic support proposal.

SLA tiers, scope and pricing

A support contract is structured in service levels. The figures below are 2026 ballpark rates observed in the United States for a mid-sized business application.

A simple sanity check: an app that cost 130,000 USD to build calls for 19,500 to 26,000 USD of support a year, about 1,600 to 2,200 USD a month. A quote far below that usually hides a narrow scope or unrealistic response times.

Incident priorities

A clear contract defines priorities. P1 means the app is down or a critical function is blocked for every user. P2 is an important function degraded with a workaround, handled within 1 business day. P3 covers minor defects, fixed in the next release. Response time is not resolution time: ask for both in writing.

Exit and handover: negotiate it at signing

The exit clause guarantees you can switch vendors without depending on them. It should state that the code repository, hosting and third-party accounts are in the client's name, that documentation is updated every quarter, and that 1 to 3 months of transition support is owed if the contract ends, at a rate fixed in advance. That is exactly what was missing with the previous vendor.

Mini case study

Daniel, owner of an equipment rental company in Denver, has used a contract management app since 2019 that cost 105,000 USD to build. The freelance developer shut down his business early this year.

• Takeover audit: 7,000 USD over 3 weeks, revealing 14 critical vulnerabilities and an unsupported framework version.
• Urgent upgrade: 12 days at 750 USD, so 9,000 USD.
• Standard support: 2,000 USD a month, so 24,000 USD a year.

First year: 7,000 + 9,000 + 24,000 = 40,000 USD. Daniel weighs that against the cost of an outage: the app supports 4,500 USD of revenue per business day, and 5 days of downtime would cost 22,500 USD, before any data breach exposure. He signs, with a 2-month handover clause.

FAQ

How much does support cost for a mid-sized app?

Expect 900 to 4,500 USD a month depending on the service level, or 15 to 20 % of the build cost per year. Beyond 1-hour 24/7 response, pricing is quoted case by case.

Can we take over an app without the source code?

It is very hard. If the code is not accessible, first check the original contract and IP assignment. Without code, a rewrite often costs 70 to 100 % of the original budget.

How long until a new vendor is operational?

Plan 2 to 4 weeks of audit, then 2 to 6 weeks of ramp-up. During that period an Essential tier at least covers security updates.

Should we rewrite rather than maintain?

Not necessarily. If the audit shows reasonable code and dependencies that can be modernised in under 20 days, support remains cheaper. A rewrite makes sense when the upgrade exceeds 40 % of the cost of a new version.

What belongs in the exit clause?

Account ownership in the client's name, documentation updated every quarter and 1 to 3 months of transition support at a pre-agreed rate. Without those three points, the clause is only on paper.

For security features to add during the takeover, see our piece on SAML, OIDC and SCIM readiness, and to modernise usability, our guide to internal tool usability testing. See also our custom web applications.

Let's scope your project. Give us the outline of your app and what you know about its access: we will run a 2 to 4 week takeover audit, then propose the right support tier. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.