In this guide · 8 sections
Short answer
Write a one- to two-page spec of who uses it and what they do, test the idea in no-code tools first, then ask for a fixed-price quote against that spec. Make sure the contract assigns the code and accounts to you, names a security baseline such as the OWASP Top 10, and sets support terms.
When a custom web app is worth it
Custom software costs more upfront and needs looking after, so be sure it is the right answer. It is usually worth it when at least two of these are true:
- Staff spend hours a week copying data between tools that do not talk to each other
- Off-the-shelf software covers most of the need, but the missing part is your core process
- Customers or partners need a login to see their own orders, files or bookings
- A spreadsheet has become the system of record and keeps breaking
- You pay for several subscriptions where one small tool would do
Typical prices for different kinds of builds are in our custom software cost guide.
Test with no-code tools first
Before paying for code, try to run the process for two to four weeks with no-code tools. A shared Airtable base or Google Sheet, a form, and a few Zapier or Make automations will show you which steps matter, which fields people actually fill in, and where it breaks. Our Zapier vs Make comparison helps choose the automation tool.
Sometimes the test is the answer and you never need custom code. When it is not, you now have a working prototype, real data and a list of pain points, which makes the spec far better and the quote more accurate.
How to write the brief: a one-page spec
Developers quote on what you write. Vague briefs get vague quotes and disputes later. A good spec describes people and tasks, not technology.
Describe the problem in three sentences
What happens today, what goes wrong, and what it costs in time or errors.
List the users and what each does
For example: sales staff create quotes; the manager approves; customers view and accept. Note how many of each.
Walk through the main tasks step by step
Five to ten tasks, each as 'user does X, system shows Y'. Mark which are must-have for version one.
List the data and where it comes from
Fields you store, which are personal data, and which systems it must connect to, such as Xero or Microsoft 365.
State the non-functional basics
Who hosts it, expected users, mobile use, languages, and that the OWASP Top 10 must be addressed.
Say what is out of scope
Features you do not want in version one. This keeps quotes comparable and the first release small.
Fixed price vs time and materials
You will usually see one of two pricing models. Neither is better in general; each fits a different situation.
Fixed price suits you when
- The first version is clearly specified
- You need a firm budget for approval
- Changes go through a written change request
- Acceptance criteria are agreed upfront
Time and materials suits you when
- Requirements will change as you learn
- You want ongoing improvements after launch
- You can review progress every week or two
- There is a monthly cap or budget alert
A common pattern is a fixed price for version one against the spec, then a monthly retainer or hourly rate for changes. Ask for the day or hourly rate up front so change requests are predictable.
Who owns the code, accounts and data
This is the part most small firms get wrong. Under Singapore's Copyright Act 2021, the creator of a work is by default its first owner unless they are an employee or a contract says otherwise. The Ministry of Law's summary of the Act sets out these default ownership rules. Software written by an outside developer therefore belongs to them unless your contract assigns it to you.
Ownership checklist
Source code escrow, where a third party holds the code in case the developer disappears, matters for large systems. For a small business, having the repository in your own account does the same job for free.
Security, PDPA and hosting baseline
Write the security baseline into the contract. The OWASP Top 10 is the standard awareness list for web application risks; its 2025 edition puts Broken Access Control first, followed by Security Misconfiguration and Software Supply Chain Failures. Asking the developer to address it, and to show how, is a simple and widely understood requirement.
If the app holds personal data, the PDPA applies to you, not just the developer. The PDPC's Data Protection by Design guide asks organisations to build data protection in from the start: collect only what you need, control access, and plan retention and deletion. Put a data processing clause in the contract; our guide to data processor agreements explains what to include.
- Role-based access: each user sees only what their role allows
- MFA for admin accounts, and passwords hashed, never stored in plain text
- Daily backups with a tested restore
- Dependencies kept up to date, with a named person responsible
- Logs of logins and key actions, kept for an agreed period
Do it yourself or get help?
Writing the spec and running a no-code test is work you should do yourself; nobody knows the process better. The build, security and hosting are where a developer earns their fee. Ask every developer the same questions: who owns the code, where is it hosted, how is access controlled, what happens after launch, and what does a change cost. If you are comparing automation instead, see our workflow automation cost guide.
Our Custom Tool or Dashboard service (from S$1,990) starts with a free written scope and a fixed quote, builds in your own accounts, hands over the source code and includes 30 days of bug fixes. For a security-focused build, the Custom Security Dashboard (from S$1,900) pulls MFA, device, backup and licence data from the tools you already use into one screen.
Frequently asked questions
It depends on users, screens, integrations and security needs. A small internal tool with one or two user types costs far less than a customer portal with payments and several integrations. Write a short spec first and ask two or three developers for fixed quotes against it, so the prices are comparable.
Under Singapore's Copyright Act 2021, the creator of a work is by default its first owner unless they are an employee or a contract says otherwise. An outside developer therefore owns the code unless the contract assigns it to you. Make the assignment explicit and keep the repository in your company's account.
Choose fixed price when the first version is clearly specified and you need a firm budget. Choose time and materials when requirements will change and you can review progress regularly. Many projects combine both: a fixed price for version one, then an agreed rate for later changes.
Ask them to address the OWASP Top 10, the standard list of web application risks, and to show how. Include role-based access, MFA for admins, hashed passwords, backups with tested restores, dependency updates and activity logs. If personal data is involved, add a data processing clause covering PDPA duties.
Often, yes. Airtable, Google Sheets, forms and automation tools can run many internal processes for a small team. Try that first for a few weeks. If you hit limits on permissions, performance or customer logins, the no-code version becomes a useful prototype for a custom build.