Software Maintenance Contracts in Australia: Scope, Response Times and What to Ask
What a software maintenance contract in Australia should cover: scope, support hours, response times, security updates, backups, exclusions and handover.
What should a software maintenance contract include?
A good software maintenance contract defines what maintenance includes and excludes, when support is available and in which time zone, how issues are classified and how fast they are acknowledged and resolved, how security updates, backups and monitoring are handled, how fees work, who owns code and accounts, and how the relationship ends. In Australia, check how consumer guarantees and unfair contract terms rules may apply to your agreement.
This guide is for businesses buying ongoing support for custom software, web applications, mobile apps or ecommerce stores. It explains what to ask a prospective provider and how to compare offers. It does not describe ZSpace Labs' own terms or pricing, which depend on each engagement.
For what maintenance work involves technically, see mobile app maintenance, website maintenance and the Shopify maintenance checklist. Nothing here is legal advice.
Key takeaways
- Define maintenance scope precisely, and how new features are quoted.
- Agree severity levels with response and resolution targets, and what happens if they are missed.
- State support hours, the time zone and public holiday handling.
- Include security updates, dependency upgrades, backups with tested restores and monitoring.
- Make sure your business owns code, accounts and data, and the exit plan is written.
- Check consumer guarantees and unfair contract terms with a lawyer.
- Hold regular service reviews with real data.
Scope: what is and is not maintenance
| Usually included | Usually excluded or quoted separately |
|---|---|
| Bug fixes against agreed behaviour | New features and redesigns |
| Security patches and dependency updates | Major framework or platform upgrades (sometimes) |
| OS, browser and app store requirement updates | Third-party outages outside the provider's control |
| Monitoring and responding to alerts | Issues caused by changes made by others |
| Backups and restore tests | Data entry, content changes and training (unless agreed) |
| Minor changes within an hours bank | Work beyond the hours bank |
Severity levels, response and resolution
Define severity by business impact, not by the provider's convenience. A common structure is critical (system down or data at risk), high (major function broken, no workaround), normal (limited impact or workaround available) and low (minor or cosmetic). For each, agree a response target and a resolution or workaround target, during and outside support hours, and how issues are reported.
Ask what happens when targets are missed: service credits, escalation, or the right to end the contract. Be wary of agreements that define only response times and make every issue 'normal' by default.
Support hours and time zones
State the time zone for support hours. Australia has several, and New South Wales, Victoria, the ACT, Tasmania and South Australia observe daylight saving while Queensland, the Northern Territory and Western Australia do not. If your provider is offshore, check the overlap: India, for example, is 4.5 hours behind Sydney during AEST and 5.5 hours during AEDT. Agree how public holidays (Australian and the provider's) are handled and how after-hours critical incidents are covered and priced.
Security, backups and monitoring
- Timeframes for applying critical security patches.
- Regular dependency and framework updates, not only when something breaks.
- Backups with stated frequency, retention, separation from production, and tested restores.
- Monitoring of availability, errors and key journeys, with alerts to agreed contacts; see application monitoring.
- Cooperation during security incidents, including access to logs and timely notification.
- Access control: provider accounts with least privilege, MFA, and prompt removal when people leave.
Pro tip
Our recommendation: ask the provider to show you a recent restore test and a sample monthly report before you sign. Both reveal more about the quality of maintenance than the contract wording.
Pricing models
| Model | Suits | Watch for |
|---|---|---|
| Monthly retainer | Software that changes regularly and needs fast response | What the retainer actually includes |
| Hours bank | Variable but predictable work | Rollover rules and rates for extra hours |
| Pay as you go | Stable software with little change | Slower response; no reserved capacity |
| Fixed fee per release cycle | Apps with predictable store and OS updates | Scope of each cycle |
Australian legal considerations
Consumer guarantees. Under the Australian Consumer Law, a business can be a 'consumer' when it acquires goods or services costing up to $100,000, a threshold that applies from 1 July 2021, subject to exclusions such as goods acquired for resupply (Russell Kennedy). Where the guarantees apply, services must be provided with due care and skill, and contract terms cannot exclude them.
Unfair contract terms. Since 9 November 2023, unfair terms in standard form contracts with small businesses can attract penalties, not just be void (ACCC). Watch for one-sided variation rights, broad limitations of liability, automatic renewals and termination terms. Have a lawyer review the agreement.
Privacy and data. If the provider accesses personal information, the contract should cover security, breach notification and overseas access (APP 8). See cyber incident response planning.
Ownership, handover and exit
- Your business owns repositories, cloud accounts, domains, app store accounts and data.
- Written IP assignment for code, in line with Australian copyright rules; see custom software development in Australia.
- Up-to-date documentation: architecture, deployment, environments, runbooks.
- On exit: transfer of code, credentials and data in usable formats within a set period.
- Reasonable transition support, with rates agreed upfront.
- A handover rehearsal: another developer can build and deploy from the documentation.
Service reviews
Hold a review monthly or quarterly with real data (the same supplier checks in choosing a web development company apply at renewal): incidents and their resolution times, updates applied, backup and restore results, security issues, hours used, upcoming platform deadlines and recommended improvements. Use reviews to adjust scope and priorities, and to raise concerns before they become disputes.
Questions to ask a prospective provider
- What exactly does the monthly fee include, and what is quoted separately?
- How do you classify severity, and what are your response and resolution targets?
- Which hours and time zone do you support, and how are after-hours incidents handled?
- How quickly do you apply critical security patches?
- How often do you test restores, and can we see the last result?
- What monitoring do you run, and who receives alerts?
- What will you report each month?
- Who owns code, accounts and data, and what happens if we end the contract?
- What happens if you miss targets?
Common mistakes
- Signing a build contract without pricing maintenance; see mobile app development cost for lifecycle budgeting.
- Response times with no definition of severity.
- No time zone stated for support hours.
- Backups that are never restored.
- Provider-owned accounts and repositories.
- No exit plan until the relationship breaks down.
Sources
Russell Kennedy, the $100,000 question; ACCC, unfair contract terms; OAIC, APP 8.
Legal points come from regulator and law-firm summaries; get advice for your agreement. Tables and checklists are ours. No ZSpace Labs pricing or commitments are described here.
Conclusion
A maintenance contract is where long-term software quality is decided. Define scope, severity, hours and security commitments clearly, insist on tested backups and useful reporting, keep ownership with your business, write the exit plan upfront, and have the agreement reviewed against Australian consumer and unfair contract terms rules. If you are changing suppliers, see the software vendor handover checklist.
Comparing maintenance offers?
ZSpace Labs is an India-based, remote-first technology studio working with Australian and international businesses on ongoing web application, mobile app and Shopify maintenance. We are happy to answer the questions above in writing for your software.
Common questions.
Scope (what counts as maintenance versus new work), support hours and time zone, severity definitions with response and resolution targets, security and dependency updates, backups and restore testing, monitoring, reporting, pricing model, exclusions, ownership of code and accounts, handover and exit, and regular service reviews.