Most software contracts end at launch. The application, however, keeps living: operating systems update, stores change their rules, dependencies publish security fixes, and one day a disk fails. The difference between two vendors rarely shows in the quote. It shows six months after launch, on the day of an incident or of a major OS update.
That is why we treat operations as half of the work, for our own products as for our clients’.
Six things an operating contract should cover
Availability. The service is monitored continuously. Incidents are communicated and logged, not discovered by your users.
Security. Patches are applied and verified without waiting for an incident to force the issue.
Data. Backups are encrypted, and restores are actually rehearsed. A backup that has never been restored is a hypothesis.
A monthly report. Availability, incidents, fixes shipped, and the decisions waiting for you.
Compliance. The privacy policy, the terms, and the account deletion and data export paths are tested, not just written.
Exit. Code, data and accounts belong to you, and the way to leave is documented and executable from the start.
Response times and coverage hours depend on the product. They belong in the contract, project by project, rather than in a promise on a website.
Three ways to entrust an application
| Question | One party responsible | Agency plus separate host | Independent developer |
|---|---|---|---|
| Who answers during an incident | The same party, from code to server | Each points at the other | When available |
| After delivery | A continuing operating contract | Usually renegotiated | Case by case |
| OS and store updates | Anticipated and included | Billed on request | Discovered when things break |
| Backups and restores | Tested, not merely configured | Delegated to the host | Variable |
| If you want to leave | Exit documented from day one | To untangle between two vendors | Depends on the relationship |
None of the three is bad in itself: an independent developer can build an excellent product. But they do not commit the same people for the same length of time.
Questions to ask before you sign
- Who is woken up when the service is down, and how do I know it was?
- When was the last restore test, and can I see its report?
- Which operating system and store updates are included, and which are billed?
- Are the repository, the store accounts and the domain names in my name?
- If I leave in two years, what exactly do I receive, and who does the handover?
If the answers are vague, the contract will be too. Talk to us about yours.
