Most software contracts we see in Indonesia spend twenty pages on what gets built and half a page on what happens after launch. That half page is where the trouble starts. Six months later a library has a published security hole, the SSL certificate expires over a long weekend, or Google Play says the app can no longer receive updates. Someone has to fix it, and nobody agreed who, how fast, or for how much.
Maintenance Is Not the Same as New Features
Maintenance keeps the software you already have running, patched, and allowed on current platforms. New development changes what the software does. The two are priced differently, and many disputes start when a request for a new report is filed as a "bug". A test that works in practice: if the system used to do it and now does not, it is a bug. If it never did it, it is a change request.
Small changes such as editing a label or adding a column to an Excel export usually fit under maintenance, up to a number of hours a month. Anything that needs design work, a new database table, or a new integration gets its own quote. Write the threshold down, for example "changes estimated under 4 hours each".
What Maintenance Actually Includes
- Security updates for the whole stack: the server OS, the runtime (PHP, Node.js, the JVM), the framework (Laravel, Next.js, Django), and every library in the lockfile. Ubuntu 20.04 left standard support in May 2025 and Node.js 20 reached end of life in April 2026, so a system built four years ago is probably already running on something unsupported.
- Bug fixes for defects found after the warranty period ends.
- Monitoring and backups: uptime checks, error tracking with a tool such as Sentry, disk and database alerts, and a backup that someone test-restores every few months.
- Renewals: domains (.com, .co.id), SSL certificates, the Apple Developer Program at USD 99 a year, and API keys that expire. Public SSL certificate lifetimes are being shortened in stages, so renewal has to be automated rather than done by hand once a year.
- Platform changes forced from outside. Every year Google Play raises the minimum target API level for new apps and updates, and apps that fall too far behind stop being offered to users on newer Android versions. Apple requires uploads to be built with a recent Xcode and SDK. Payment gateways retire old API versions too.
Clients underestimate the last item most. Even with zero new features, the app needs work every year because the ground under it keeps moving.
How Vendors Price Maintenance
The most common model is a monthly retainer: a fixed fee for monitoring, updates, and support, plus a block of hours for fixes and small changes, often 10 or 20. Extra hours are billed at an agreed rate. It is the easiest to budget and the only model where an SLA really means something. Software house rates in Indonesia sit roughly between Rp150,000 and Rp400,000 per hour, and they vary a lot between vendors.
Per incident means you pay only when something breaks. It looks cheaper for a website that rarely changes. The catch is that nobody watches the system in between, updates pile up, and when something breaks the vendor may have no free capacity that week.
The third approach is a percentage of the build cost per year. The commonly cited figure is 15 to 20 percent, a reasonable first estimate rather than a rule. A Rp300 million system at 15 percent comes to Rp45 million a year, about Rp3.75 million a month. Many integrations or strict uptime targets push it up. A stable internal tool with thirty users may need less.
Indicative Monthly Costs in Indonesia
These ranges cover the maintenance fee only. Servers, third-party usage such as WhatsApp messages or SMS OTP, and store fees come on top. Prices vary widely between vendors and with how fast you need a response.
A company profile website on WordPress: roughly Rp500,000 to Rp2.5 million a month for core and plugin updates, backups, uptime checks, and a few content edits. A small web app, such as an internal ordering or stock system with an admin panel and one or two integrations: roughly Rp3 million to Rp12 million a month. A mobile app with its own backend and admin panel: roughly Rp6 million to Rp25 million a month, and more if there are several apps or support around the clock.
An honest note for the smallest case. If your website is a five-page company profile with a contact form, you probably do not need a maintenance contract with an SLA. Pick a managed host that patches WordPress, turn on automatic updates, keep one backup off the server, and pay someone by the hour when you need a change.
SLA Terms in Plain Language
An SLA, or service level agreement, says how fast the vendor reacts and how available the system should be. Response time is how long until a person acknowledges the problem and starts on it. Resolution time is how long until it is fixed or worked around. Many SLAs only promise response time, which is cheap to meet.
Support hours decide when the clock runs. Business hours usually means Monday to Friday, 09:00 to 17:00 WIB, excluding public holidays. A four-hour response for a ticket raised at 16:30 on the Friday before the Lebaran break can technically mean a reply a week later. If you take orders during Lebaran or Harbolnas, pay for extended hours on those dates.
Severity levels sort incidents by impact, usually P1 to P4. Adjust these typical examples to your business.
| Severity | Example | Typical response | Typical resolution target |
|---|---|---|---|
| P1 Critical | System down, payments failing, suspected data breach | 30 to 60 minutes, 24/7 if you pay for it | Workaround within 4 hours |
| P2 High | Main feature broken for many users, such as invoices not generating | 2 to 4 hours | 1 business day |
| P3 Medium | Feature broken but with a workaround, such as one wrong report filter | 1 business day | 5 business days or the next release |
| P4 Low | Cosmetic issue, typo, question, or small change request | 2 business days | Scheduled into monthly work |
Agree in writing who decides severity. Clients mark everything P1, vendors downgrade. A rule that holds up: P1 means money or data is being lost right now.
What Uptime Percentages Mean in Minutes
A 30-day month has 43,200 minutes. At 99.5 percent you are allowed about 216 minutes of downtime, roughly 3.6 hours. At 99.9 percent it is about 43 minutes. Going from 99.5 to 99.9 sounds like rounding, but it means redundant servers, a database with failover, deployments without downtime, and someone on call at night. That can double the infrastructure and support bill.
Read what the number excludes, usually scheduled maintenance and cloud provider outages, and what you get when it is missed. Typically that is a few percent off next month, which will not cover lost sales. Our honest view is that most internal systems are fine at 99.5 percent during business hours, and the extra money is better spent on backups and a tested restore.
What Happens When You Skip Maintenance
Nothing, for a while. That is the problem. Then several things land in the same month. A WordPress plugin with a known hole fills your site with online gambling spam pages, which happens to Indonesian company and campus sites all the time. The app falls behind the Play target API level just when you need an urgent fix. The PHP version is so old that upgrading the framework means jumping three major versions, and a two-day job becomes a two-month project.
Skipping maintenance does not save the money. It moves the bill to a worse month, with interest.
When we take over systems nobody has touched for two or three years, the first quote is almost always for catching up, and it often costs more than a year of steady upkeep would have.
What to Put in the Contract
- 1Scope: list every component covered, such as the web app, API, admin panel, mobile apps, and servers. Anything not on the list is out.
- 2Hours and rollover: monthly hours, the rate for extra hours, and whether unused hours carry over. One month of rollover is a fair compromise.
- 3Exclusions: new features, third-party outages, content entry, and problems caused by your staff or another vendor. Write them down so nobody argues in month seven.
- 4SLA table: severity definitions, response and resolution targets, support hours, the reporting channel (a ticketing system beats a busy WhatsApp group), and escalation contacts.
- 5Reporting: a monthly report of hours used, updates applied, incidents, and the result of the last backup restore test.
- 6Access and ownership: source code in a GitHub or GitLab organisation owned by your company, and the server, cloud, domain, and developer accounts held by you, with the vendor added as a user.
- 7Exit and handover: a notice period of 30 to 90 days and a duty to hand over code, documentation, credentials, and a walkthrough for the next team. It costs nothing to sign and saves months later.
In-House or Vendor
An in-house developer costs more than the salary: add benefits, THR, a laptop, and the risk that one person holds all the knowledge. One developer also cannot cover backend, mobile, servers, and security, or take two weeks of leave without leaving the system unattended. For one or two business systems, a vendor retainer is usually cheaper.
In-house makes sense when the software is core to how you make money and changes every week. Then the setup that works is an in-house lead who owns the roadmap and the accounts, with a vendor or dedicated team for capacity and on-call cover.
At Salamun Teknologi we run maintenance for systems we built and systems we take over, starting with an audit of what is out of date. If you have a maintenance quote and want a second opinion, we are happy to read it with you.
Key takeaways
- Maintenance keeps existing software patched, monitored, and allowed on current platforms. New features are change requests with their own price.
- Even an app with no new features needs yearly work, because OS, runtime, framework, and store requirements keep changing.
- As a first estimate, budget 15 to 20 percent of the build cost per year, or roughly Rp3 to 12 million a month for a small web app.
- Read SLAs for response versus resolution time, support hours, and who sets severity. 99.5 percent uptime allows about 3.6 hours down a month, 99.9 percent about 43 minutes.
- Make sure the contract gives you the source code, the credentials, and a handover duty if the vendor leaves.
