Library · Questions

Straight answers to common build questions.

Each answer starts with the short version, then the detail, the sources and a tool to check it for your own case.

Questions

Start with the answer.

ContractsWho owns the code when you hire a software agency? Whoever the contract says. In the US, code written by an outside contractor usually belongs to the contractor unless there is a signed, written assignment, because software rarely qualifies as a work made for hire when the author is not your employee. Make sure your contract assigns the code and IP to you, and that you hold the accounts it runs on.
LLM costsHow do I reduce LLM API costs? Measure first, then cut where the tokens are. Most savings come from caching the repeated start of your prompts, sending less context, capping output, moving non-urgent work to batch jobs and routing easy requests to a smaller model. Check each change with evals so quality does not drop.
HIPAADoes my app need to be HIPAA compliant? Only if it creates, receives, keeps or sends protected health information as a HIPAA covered entity or on behalf of one. If you build software that clinics, health plans or their vendors use to handle patient data, you are almost certainly a business associate and HIPAA applies. A consumer health app people sign up for on their own is often outside HIPAA, but other rules can still apply.
EU AI ActIs my AI system high-risk under the EU AI Act? It is high-risk if it is a safety component of a product covered by the EU laws in Annex I that needs a third-party conformity assessment, or if it is used in one of the areas listed in Annex III, such as hiring, credit, education or essential services, unless a narrow exemption applies. After the 2026 Digital Omnibus, the high-risk rules apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
PricingShould I pay fixed price or hourly for software? Pay a fixed price when the scope is small, clear and unlikely to change; pay hourly, also called time and materials, when you expect to learn and change course as you build. Many projects mix the two: a fixed price per milestone for well-defined pieces and hourly work for the rest.
TimelinesHow long does it take to build an app? It depends on scope more than anything else: the number of user types, screens, integrations and rules, plus any compliance work. You get a real number by fixing the scope first, usually with a clickable prototype, and then estimating the production build against it.
PricingHow much does an MVP cost? An MVP costs the design and engineering hours it needs multiplied by the rate, so the real driver is how much you put into it. Keep it to the one workflow that proves the idea, and the cost stays small; add every feature on the wish list and it becomes a full product.
PricingHow much does a fintech app cost? Fintech apps cost more than similar-looking apps because the hard parts are hidden: a correct ledger, identity checks, payment and banking partners, audit trails and the compliance each brings. The build cost is engineering hours times the rate, and on top of it come per-use fees for checks and payments and the cost of compliance work.
PricingHow much does a telehealth app cost? A telehealth app's cost depends on how much of the care workflow it covers: video visits, scheduling, intake forms, notes, prescriptions, payments and links to health records. Because it handles PHI, HIPAA safeguards and a BAA with every vendor in the data path add to both the build and the running costs.
PricingHow much does a marketplace app cost? A marketplace costs more than a single-seller store because you build for two sides: buyers who search, book and pay, and sellers who list, get paid and manage orders. Split payments and payouts, search, messaging, reviews and dispute handling are the main drivers, plus the admin tools you need to run it.
PricingWhat does software maintenance cost? Maintenance is the cost of keeping software running, safe and current after launch: hosting and services, dependency and security updates, monitoring, bug fixes and small changes. It depends on how much the system does, how many outside services it relies on and how much it changes, so budget for it from the start as part of the total cost of ownership.
ContractsWho pays for hosting after launch? Normally the client, because the software and its data are the client's. The cleanest setup is for the hosting, domains and third-party services to be on accounts in the client's name, billed to the client, with the vendor added as a user. Agree this in the contract before the build starts.
ContractsHow do I avoid vendor lock-in? Own the code, the accounts and the data, keep everything documented, and prefer common, portable tools over proprietary ones unless the proprietary one clearly earns its place. Lock-in is not always bad; the goal is to choose it on purpose and know what leaving would cost.
BuyingHow do I choose a software agency? Pick on evidence, not pitches: similar work they can show, the actual people who will build yours, how they handle scope changes, and a contract that gives you the code and accounts. Then start with a small, paid first step, such as a prototype, before you commit to the full build.
BuyingHow do I write a software RFP? Describe the problem and the users, not a finished solution: what the software must do, the constraints it must meet, your budget range and timeline, and exactly how you will score the answers. Clear, scored questions get comparable proposals; vague ones get sales copy.
ContractsWhat goes in a statement of work? A statement of work (SOW) says what will be delivered, by when, how it will be accepted and how it will be paid for. For software that means scope and deliverables, milestones, acceptance criteria, who does what on each side, the pricing model and how changes are handled.
ProcessWhat is a clickable prototype for? A clickable prototype lets people click through the product before any production code exists, so you can test the flows with real users, agree the scope and get a more accurate estimate. It is the cheapest point to find out that a screen, a step or a whole feature is wrong.
EngineeringHow do I handle technical debt? Make it visible, rank it by how much it slows you down or puts you at risk, and pay it down steadily alongside feature work instead of waiting for a big rewrite. Some technical debt is a fair trade for speed; the problem is debt nobody tracks.
EngineeringShould I build native or cross-platform? For most business and consumer apps, cross-platform frameworks such as React Native or Flutter are the better default: one codebase for iOS and Android, one team and faster changes. Go native when the app depends on heavy graphics, deep hardware access or the newest OS features on day one.
BuyingShould I build or buy software? Buy when the problem is common and an existing product fits your process well enough, such as accounting, email or a standard CRM. Build when the workflow is what makes you different, when no product fits without heavy workarounds, or when per-seat or per-use fees grow faster than the cost of owning it.
TeamHow many developers do I need? Fewer than most people expect. A small team that covers design, frontend, backend and testing, with one person making product decisions, ships most new products faster than a large one. Add people only when the work splits into parts that can be built in parallel without constant coordination.
ContractsHow do I hand over a software project? Move four things on purpose: access (code, hosting, domains, third-party accounts and secrets), documentation (architecture, setup, deployment, runbooks), knowledge (walkthroughs with the people who built it) and open work (bugs, debt and plans). Plan the handover with time where both teams overlap, not as a single file dump.
EngineeringHow do I migrate off no-code? Treat it as a planned migration, not a rewrite from memory: export and map the data, write down every workflow and rule the no-code app runs, rebuild the most painful part first, and move users over in stages with both systems running for a while. Data and hidden automations are where migrations go wrong.
ProcessHow do I plan a discovery phase? Plan it around the decisions you need to make: who the users are, which workflows matter, what the system must connect to, which rules apply, and what is in the first release. End it with concrete outputs, usually a clickable prototype, a prioritised scope and an estimate you can act on.
PricingHow do I price a SaaS product? Start from the value customers get, pick a pricing metric that grows as they get more of it (seats, usage or outcomes), and build a few tiers that match your customer segments. Then check that your costs per customer, including hosting and any AI usage, leave a healthy margin at every tier.
ContractsWhat is a reasonable SLA? One that matches what the business really needs and what the system is built and paid for. Each extra nine of uptime costs more in architecture, monitoring and on-call staff, so set targets per service, and pair uptime with clear response times, maintenance windows and remedies.
LLM costsDoes prompt caching save money? Yes, when many requests start with the same long block of text, such as instructions, tool definitions or a shared document. Cached input is billed at a fraction of the normal input price: at Anthropic and on OpenAI's newer models, cache reads cost 0.1 times the base input rate or less. Writes to the cache can cost more than normal input, so savings depend on how often the prefix is reused.
LLM costsHow do I estimate LLM costs? Multiply the number of requests by the tokens per request and the price per token, and do it separately for fresh input, cached input and output, because each has its own price. Then add retries, agent loops and growth, and check the estimate against real logs as soon as you have them.
LLM costsWhich LLM API is cheapest? There is no single answer: the cheapest model depends on your mix of fresh input, cached input and output tokens, and on the cheapest model that still passes your quality bar. Prices also change often, so compare current prices on your own workload rather than trusting a ranking.
AIHow much does an AI agent cost? Two costs: building it and running it. The build is mostly integrations, tools, guardrails, evals and review screens, priced as engineering hours. Running costs are per task: every model call, tool call and human review, which add up quickly when an agent takes many steps.
AIHow do I measure AI ROI? Measure the task before and after, not the AI on its own: time per task, cost per task, error rate and volume, compared with a baseline taken before launch. Then subtract the full cost of the AI, including build, model and tool fees, monitoring and the human review it still needs.
AIShould I use RAG or fine-tuning? Use RAG when the model needs to know your facts, documents or data, especially if they change. Use fine-tuning when you need to change how the model behaves, such as a consistent format, tone or a narrow task, and prompting is not enough. Most teams should start with prompting and RAG.
HIPAACan I send PHI to an LLM? Yes, but only if the LLM provider signs a BAA with you that covers the exact service and endpoint you call, and you treat it like any other vendor that handles PHI. Without a BAA, send only properly de-identified data, or keep the model inside an environment you already cover.
HIPAAWhat is a BAA? A BAA (business associate agreement) is the written contract HIPAA requires before a vendor creates, receives, keeps or sends PHI for a covered entity or for another business associate. It limits how the vendor may use the data and binds it to safeguards, breach reporting and the same rules for its own subcontractors.
SOC 2Do I need SOC 2? No law requires SOC 2. You need it when your customers ask for it, which usually happens once you sell software to larger companies that will trust you with their data. If deals are stalling on security reviews, start preparing; if nobody has asked yet, build the controls now and get the report when a buyer needs it.
GDPRDoes GDPR apply to US companies? Yes, in two cases: when a US company offers goods or services to people who are in the EU, paid or free, or when it monitors their behaviour in the EU, such as tracking or profiling. It also applies to any processing done in the context of an EU office or branch.
AccessibilityDoes the European Accessibility Act apply to me? It applies if you place certain products on the EU market or provide certain services to consumers in the EU after 28 June 2025, including e-commerce, consumer banking, e-books, electronic communications and parts of passenger transport. Microenterprises providing services, meaning fewer than 10 staff and annual turnover or balance sheet of EUR 2 million or less, are exempt.
AccessibilityWhat is WCAG 2.2 AA? WCAG 2.2 AA means a page meets every Level A and Level AA success criterion in version 2.2 of the W3C's Web Content Accessibility Guidelines. It is the level most laws, contracts and accessibility policies point to, because AAA cannot be met for all content.
EU AI ActWhen do the EU AI Act rules apply? In stages. Bans on prohibited practices and AI literacy duties apply from 2 February 2025, general-purpose AI model rules from 2 August 2025, and most other rules, including transparency duties, from 2 August 2026. After the 2026 Digital Omnibus, the high-risk rules apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
PCI DSSWhen do I need PCI DSS? Whenever your business stores, processes or transmits payment card data, or runs systems that could affect the security of that data. Almost every business that takes card payments has some PCI DSS duty; the question is how much, and good design can make it small.
FintechWhat is the difference between KYC and KYB? KYC (know your customer) checks that an individual is who they say they are. KYB (know your business) checks a company: that it exists and is registered, what it does, and who owns and controls it, which then means running KYC on those people too.
ISO 27001What does ISO 27001 involve? ISO/IEC 27001 involves setting up and running an information security management system (ISMS): you assess your security risks, choose controls to treat them, write a Statement of Applicability, and keep the system running with internal audits and management reviews. Certification then comes from an accredited certification body that audits you.
DORAWhat is DORA for fintech? DORA, the Digital Operational Resilience Act, is Regulation (EU) 2022/2554, and it has applied since 17 January 2025. It requires EU financial entities, including payment and e-money institutions, investment firms and crypto-asset service providers, to manage ICT risk, report major ICT incidents, test their resilience and control the risk from their technology suppliers.

Comparisons

Which one should you use?

Glossary

Terms used in these answers.

See the full glossary.

Tools

Check it for your case.

Your question not here? Ask us.

Tell us what you are planning and an OceanLab engineer will reply by email.