Build, Buy, or Vibe Code? The 2026 Total Cost of Ownership Calculator for a Typical Business App

Three ways to build the same customer portal. Three wildly different cost profiles. This article gives you a transparent three-year TCO model you can copy, edit, and argue with. The numbers that follow are sourced where possible and labelled where they're not. The conclusion isn't written in advance.

---

The App

A mid-size B2B services firm, roughly 100 employees and 200 customer organisations, needs a customer project portal. Here's the spec, pinned down so the cost assumptions mean something.

Users and access. 200 external customer users (one login per organisation, typically), 20 internal staff with admin or account-manager roles. Authentication is email and password. No SAML or SSO. Role-based permissions: customers see only their own projects and messages; internal staff see everything.

Features. Each customer sees a dashboard of their active projects with milestone tracking. They can upload and download documents (PDFs, spreadsheets, images; roughly 50 uploads per day across all users, averaging 2 MB each), exchange messages with their account team (roughly 200 messages per day), and receive automated email notifications when milestones change or new documents arrive. Internal staff manage projects, users, and permissions through an admin panel. A simple reporting dashboard shows aggregate project status, overdue milestones, and document activity across all customers.

Data and integrations. The app talks to the firm's existing CRM via a REST API (five endpoints: pull customer records, push project status updates). File storage starts at roughly 50 GB and grows at approximately 2 GB per month. Database volume is modest: 500 active projects, roughly 2,000 documents, message history for two years.

Operations. The firm expects 99.5% uptime and business-hours support (Monday to Friday, 9am to 6pm UK time). Data sensitivity is moderate. B2B project and commercial data, not healthcare records, not payment card data, not subject to PCI DSS or HIPAA. No regulatory requirement for the firm itself to hold a SOC 2 report, though the business is security-conscious and wants a penetration test before go-live.

---

What This Model Includes and Excludes

Every cost category below is marked [sourced] (backed by a publicly verifiable price or data point) or [editorial] (the author's estimate, clearly stated so you can substitute your own).

The model covers a full three-year horizon from discovery through to operations. It includes:

• Discovery and scoping before build starts
• Build labour
• Platform or tool subscriptions (annual)
• Hosting infrastructure
• QA and user acceptance testing
• Training and handover to the internal team
• Data migration from existing systems
• A pre-launch penetration test
• Ongoing maintenance (bug fixes, dependency updates, minor features)
• Incident response (time spent diagnosing and fixing production issues)
• Backups, monitoring, and routine administration
• End-user and internal support
• A Year 3 exit/contingency provision (applied identically across all paths)

It does not include: the cost of the firm's existing CRM, major feature additions beyond maintenance scope, marketing or customer acquisition, legal or procurement overhead, or the opportunity cost of internal staff time spent on the project rather than their day jobs.

---

The Assumptions: Base Case

These are the central estimates. Where a number is marked [editorial], the model treats it as a dial you can turn. Where it's marked [sourced], a live public page is the reference point. Each line below shows three figures in order: custom development, governed no-code (Bubble), then vibe coding (Bolt + API).

• Discovery & scoping: custom 40 hrs × $100/hr = $4,000; no-code 20 hrs × $85/hr = $1,700; vibe coding 30 hrs × $60/hr = $1,800. Editorial.
• Build labour: custom 500 hrs × $100/hr = $50,000; no-code 200 hrs × $85/hr = $17,000; vibe coding 300 hrs × $60/hr = $18,000. Hours editorial; rates sourced.
• QA & UAT: custom 40 hrs × $100/hr = $4,000; no-code 20 hrs × $85/hr = $1,700; vibe coding 40 hrs × $60/hr = $2,400. Editorial.
• Training & handover: custom 20 hrs × $100/hr = $2,000; no-code 15 hrs × $85/hr = $1,275; vibe coding 10 hrs × $60/hr = $600. Editorial.
• Data migration: custom 20 hrs × $100/hr = $2,000; no-code 10 hrs × $85/hr = $850; vibe coding 15 hrs × $60/hr = $900. Editorial.
• Platform / tooling: custom none; no-code Bubble Team $349/mo = $4,188/yr; vibe coding Bolt Pro $25/mo + API est. $175/mo = $2,400/yr. Sourced.
• Hosting: custom Railway Pro $20/mo + DB est. $100/mo = $1,440/yr; no-code included; vibe coding Vercel Pro $20/mo + DB est. $80/mo = $1,200/yr. Platforms sourced; DB editorial.
• Pentest (year 1 only): $10,000 on all three paths. Sourced.
• Maintenance (annual, yr 2-3): custom 20% of $50,000 = $10,000/yr; no-code 10% of $17,000 = $1,700/yr; vibe coding 25 hrs/mo × $60/hr = $18,000/yr. Percentage sourced for custom; editorial for others.
• Incident response (annual): custom $600; no-code $600; vibe coding $1,200. Editorial.
• Backups & monitoring (annual): custom $600; no-code included; vibe coding $600. Editorial.
• Support (annual): custom $1,200; no-code $600; vibe coding $2,400. Editorial.
• Exit / contingency (year 3): $5,000 on all three paths. Editorial.

Sourced rate notes

• Bubble Team plan: $349/month on annual billing, 500,000 workload units, 5 editor seats, no per-end-user charges. bubble.io/pricing
• Bolt Pro: $25/month, 10 million tokens/month, custom domains, no daily token limit. The older "Pro 200" tier no longer exists. bolt.new/pricing
• Railway Pro: $20/month platform fee. Compute billed per second: roughly $20/vCPU-month and $10/GB-RAM-month. A moderate PostgreSQL instance plus app server runs roughly $100-120/month total. railway.com/pricing
• Vercel Pro: $20/month with $20 usage credit. Includes 1 TB Fast Data Transfer and 10M Edge Requests. vercel.com/pricing
• Developer rates: Arc.dev's 2026 data puts full-stack freelancer averages at $61-80/hr. A senior developer building a production business app fetches $100+/hr. arc.dev/freelance-developer-rates/full-stack
• Pentest pricing: Published ranges for a medium business web application from Blaze InfoSec ($8,999-$20,000), BSG Tech ($5,000-$25,000), and Redfox Sec ($6,000-$15,000) cluster around $6,000-$20,000 for a manual grey-box test. I'm using $10,000 as a midpoint for a competent boutique firm. blazeinfosec.com, bsg.tech, redfoxsec.com
• Maintenance percentage: The 15-25% of initial build cost per year for custom software is widely cited by development consultancies including SaviBM and Adeva. I'm using 20% for the base case. For no-code maintenance, I'm estimating 10% of build cost annually because the platform handles infrastructure patching, framework upgrades, and database management. For vibe coding, maintenance is modelled as hourly time rather than a percentage because the cost driver is debugging and re-prompting, not structured upkeep.
• Bubble SOC 2: Bubble holds a SOC 2 Type II report covering its own platform infrastructure ("hosting, database, security, and deployment"). It does not confer SOC 2 compliance on applications built on the platform. bubble.io/blog/what-is-soc-2-compliance. For this model, the buying firm does not need its own SOC 2 report, so this is noted for completeness rather than costed.

---

Base Case Totals

Custom development

Year 1: $4,000 + $50,000 + $4,000 + $2,000 + $2,000 + $0 + $1,440 + $10,000 + $600 + $600 + $1,200 = $75,840

Year 2: $10,000 + $1,440 + $600 + $600 + $1,200 = $13,840

Year 3: $10,000 + $1,440 + $600 + $600 + $1,200 + $5,000 = $18,840

Three-year total: $108,520

Governed no-code (Bubble)

Year 1: $1,700 + $17,000 + $1,700 + $1,275 + $850 + $4,188 + $0 + $10,000 + $600 + $0 + $600 = $37,913

Year 2: $1,700 + $4,188 + $600 + $0 + $600 = $7,088

Year 3: $1,700 + $4,188 + $600 + $0 + $600 + $5,000 = $12,088

Three-year total: $57,089

Vibe coding (Bolt + API)

Year 1: $1,800 + $18,000 + $2,400 + $600 + $900 + $2,400 + $1,200 + $10,000 + $1,200 + $600 + $2,400 = $41,500

Year 2: $18,000 + $2,400 + $1,200 + $1,200 + $600 + $2,400 = $25,800

Year 3: $18,000 + $2,400 + $1,200 + $1,200 + $600 + $2,400 + $5,000 = $30,800

Three-year total: $98,100

Under the base case, governed no-code lands at roughly $57,000 over three years, custom development at roughly $109,000, and vibe coding around $98,000. No-code leads primarily because platform subscriptions replace separate hosting, monitoring, and a chunk of maintenance labour, not because the build hours alone are lower.

---

The Scenarios: What Moves the Ranking

Every number in the base case marked [editorial] is a variable. Here is how the ranking changes under different assumptions.

Custom dev: what if you go cheap?

Replace the $100/hr senior freelancer with a mid-level developer at $61/hr (Arc.dev average low). Reduce build to 400 hours. Maintenance drops to 15% of build.

Year 1: $2,440 + $24,400 + $2,440 + $1,220 + $1,220 + $0 + $1,440 + $10,000 + $600 + $600 + $1,200 = $45,560

Year 2-3 total: ($3,660 maint + $1,440 hosting + $1,800 ops × 2) + $5,000 exit = $18,800

Three-year total: $64,360

Suddenly custom dev is competitive with the no-code base case.

No-code: what if the platform costs more than you thought?

Bubble's Team plan includes 500,000 workload units. This spec (200 users, 50 document uploads per day, 200 messages) could burn through those WUs faster than expected depending on workflow design. If the app needs an additional WU tier ($100/month for another 100K WUs) and you use a pricier no-code developer at $150/hr, the three-year total climbs to roughly $78,000. Still cheaper than custom dev's base case, but the gap narrows to roughly $30,000 over three years instead of $50,000.

Vibe coding: the maintenance wildcard

The 25 hours per month estimate in the base case is the central assumption about how much time a non-developer spends debugging, re-prompting, and fixing an AI-built codebase after launch. If you're skilled enough that maintenance settles at 10 hours per month, the three-year total drops to roughly $63,000. That beats the custom dev base case and is competitive with no-code. If maintenance drifts to 40 hours per month, the three-year total reaches roughly $137,000, making it the most expensive path by a wide margin.

The range ($63,000 to $137,000 depending on a single variable) is the defining problem with costing vibe coding for production applications. The build estimate is relatively contained. The maintenance estimate is not, and there is no reliable way to forecast it before you start.

---

All Three Scenarios, Side by Side

Each path with its low, base, and high three-year estimates:

• Custom development: low $64,360; base $108,520; high $151,600 (agency at $175/hr).
• Governed no-code: low $43,700 (Softr + $61/hr dev); base $57,089; high $78,000 (Bubble + WU overage + $150/hr dev).
• Vibe coding: low $63,000 (10 hrs/mo maint); base $98,100; high $137,000 (40 hrs/mo maint).

The no-code path is cheapest in every scenario. But custom dev can beat vibe coding depending on maintenance assumptions, and vibe coding can beat custom dev depending on developer rates. The ranking between those two flips based on choices the buyer only partly controls.

---

The Calculator

If you want to substitute your own numbers, here are the editable inputs and the formulas they feed. Copy these into a spreadsheet.

Editable inputs (cells A1 through A12):

• A1: Custom dev hourly rate ($)
• A2: Custom dev build hours
• A3: No-code dev hourly rate ($)
• A4: No-code build hours
• A5: Vibe coding hourly rate ($)
• A6: Vibe coding build hours
• A7: No-code platform monthly cost ($)
• A8: Vibe coding tool monthly cost ($)
• A9: Hosting monthly cost, custom & vibe ($)
• A10: Pentest cost, one-off ($)
• A11: Custom maintenance % of build
• A12: Vibe coding maintenance hours per month

Formulas (custom dev three-year total):

• = (A1*A2*0.08) + (A1*A2) + (A1*A2*0.08) + (A1*A2*0.04) + (A1*A2*0.04) + (A9*12) + A10 + 600 + 600 + 1200
• + (A1*A2*A11) + (A9*12) + 600 + 600 + 1200
• + (A1*A2*A11) + (A9*12) + 600 + 600 + 1200 + 5000

Where 0.08 = discovery + QA as fraction of build hours, 0.04 = training and migration each, and the flat $600 / $1,200 figures represent incident response, backups, and support.

Formulas (no-code three-year total):

• = (A3*A4*0.10) + (A3*A4) + (A3*A4*0.10) + (A3*A4*0.075) + (A3*A4*0.05) + (A7*12) + A10 + 600 + 0 + 600
• + (A3*A4*0.10) + (A7*12) + 600 + 0 + 600
• + (A3*A4*0.10) + (A7*12) + 600 + 0 + 600 + 5000

Formulas (vibe coding three-year total):

• = (A5*A6*0.10) + (A5*A6) + (A5*A6*0.133) + (A5*A6*0.033) + (A5*A6*0.05) + (A8*12) + (A9*12) + A10 + 1200 + 600 + 2400
• + (A5*A12*12) + (A8*12) + (A9*12) + 1200 + 600 + 2400
• + (A5*A12*12) + (A8*12) + (A9*12) + 1200 + 600 + 2400 + 5000

---

Where This Leaves You

Governed no-code is the lowest-cost path for this application under every scenario tested. Not because the build is faster (though it is) but because the operational costs fall onto the platform rather than your budget. The platform subscription replaces separate line items for hosting, monitoring, backup infrastructure, and a slice of maintenance labour.

Vibe coding's total cost is dominated by post-launch maintenance. Keep that to 10 hours per month and the three-year cost is roughly $63,000, entirely reasonable and competitive with no-code. At 40 hours per month, which is not an unusual outcome for a production AI-built codebase maintained by a non-developer, the approach becomes the most expensive of the three. The spread is $74,000, and nobody can tell you in advance where your app will land.

Custom development is the most expensive path in the base case but the most predictable. You know what you're getting. The maintenance curve is well-understood. The codebase belongs to you and conforms to whatever architectural standards you enforce. If you have an existing development team or a trusted agency relationship, the premium may be worth the certainty.

The three approaches cost different amounts not because one technology is inherently cheaper but because each shifts the maintenance burden to a different place: custom dev puts it on the developer you retain, no-code puts it on the platform vendor, and vibe coding puts it on you.