Retainers
Software maintenance retainers, with the price on the page.
Most studios hand over a repository and disappear. Six months later the dependencies are stale, the AI feature is failing quietly, and nobody owns any of it. This is the service that exists so that doesn't happen.
Shark Labs offers monthly software development retainers covering monitoring, dependency and security patching, incident response, and continued feature work after launch. Three tiers are published: Keep the lights on at $900 a month for roughly 10 hours, Keep it moving at $2,500 a month for roughly 30 hours, and Dedicated from $6,000 a month for roughly 80 hours. There is no minimum term and unused hours roll over for one month.
- From $900/mo
- Published price, three tiers
- No lock-in
- 30 days' notice, cancel any time
- Same day
- Response on the top tier
Why nobody publishes retainer prices
We looked at twelve competitors while planning this site. Exactly one had a dedicated retainer page, and it carried no numbers. The reason is not really a secret: an unpriced retainer can be quoted at whatever the client seems able to pay, and a published one cannot.
The trade is that an unpriced retainer also has to be sold, on a call, every time — and buyers who would happily have paid $900 a month never get as far as the call. We would rather publish the number and spend the call on the actual work.
What the tiers actually cover
| Keep the lights on | Keep it moving | Dedicated | |
|---|---|---|---|
| Monthly price | $900 | $2,500 | From $6,000 |
| Engineering hours | ~10 | ~30 | ~80 |
| Response time | 2 working days | Next working day | Same day |
| Monitoring and alerting | Yes | Yes | Yes |
| Dependency and security patching | Yes | Yes | Yes |
| Bug fixes | Yes | Yes | Yes |
| Incident response | Best effort | Yes | Priority |
| New feature development | No | Yes | Yes |
| AI model migrations and eval upkeep | Alerts only | Yes | Yes |
| Monthly written report | Yes | Yes | Yes |
| Scheduled call | Monthly | Fortnightly | Weekly |
Unused hours roll over for one month, so a quiet January isn't money burned. They don't accumulate indefinitely — a retainer is capacity reserved for you, and capacity that is never used has still been reserved.
What actually consumes the hours
The word 'maintenance' makes this sound like watching a dial. In practice a retainer month on a live product looks like this, and the proportions shift as a system ages.
- Dependency updates, including the ones that break something. A framework major version is a day's work and it is not optional forever.
- Security patching on a real schedule, and out of band when something serious lands.
- Bugs found by users, which arrive regardless of how good the QA was.
- AI model deprecations. Providers retire model versions on their own timetable. Migrating means swapping the model, running the eval suite, and fixing whatever the diff exposes.
- Cost drift. LLM spend creeping up because usage grew or a cache stopped working. Catching this is often worth more than the retainer costs.
- Small features, on the tiers that include them — the ones too small to be a project and too valuable to never happen.
AI features need a retainer more than anything else
Ordinary software degrades slowly. An AI feature degrades on somebody else's schedule. The provider deprecates the model version you built against, changes a default, adjusts pricing, or tightens a rate limit — and your feature's behaviour changes without a single line of your code being touched.
This is the single most common reason a working AI feature quietly stops being trusted. Nobody is watching the eval scores because nobody owns them. Read why AI proofs of concept never reach production for how that plays out, and what a software retainer actually costs for the full arithmetic behind these numbers.
- 15–20%
- Of build cost per year is the industry norm
- 1 month
- Unused hours roll forward
- 30 days
- Notice to cancel — no minimum term
Does it have to be software we built?
No. Taking over someone else's codebase is a normal way for a retainer to start, and often the more interesting one. It begins with a paid audit — usually a week — that produces a written assessment of what you have, what is dangerous, what is merely untidy, and what a sensible first three months would fix.
We will tell you if the honest answer is that the codebase needs replacing rather than maintaining. That is a worse outcome for our invoice and a better one for your year.
What this is not
- Not a support desk. We're not answering your customers' questions. We're keeping the thing they use working.
- Not unlimited work at a fixed price. The hours are stated because that's the only version of this that stays honest for both sides.
- Not a lock-in. Thirty days' notice, and everything runs on your accounts and your infrastructure throughout. Leaving means telling us, not migrating.
What you get
Everything below is in the price.
Monitoring that reaches a human
Uptime, error rates, latency, and for AI features token spend and eval scores. Alerts go to us, not to a dashboard nobody opens.
Patching on a schedule
Dependencies and security advisories handled monthly, and out of band when something serious lands.
Incident response
A named response time by tier, and a written post-incident note explaining what happened and what stops it recurring.
Feature work
On the Keep it moving and Dedicated tiers, hours go into building the next thing, not just defending the last one.
A monthly written report
What was done, what broke, what the hours went on, what we'd do next. Short, honest, and forwardable to whoever signs off the invoice.
Your accounts, your keys
Everything runs on infrastructure you own. We hold access, not hostages.
How it runs
From first call to shipped.
$900 / $2,500 / from $6,000 per month
Three tiers at roughly 10, 30 and 80 engineering hours a month, with response times of two days, one day and same day. Unused hours roll over one month. Thirty days' notice, no minimum term.
Full pricing breakdown- 01
Handover review — free, 45 minutes
What the system is, what's already broken, what worries you at 3am. If we built it, this is a formality; if we didn't, it's where we work out whether an audit is needed first.
- 02
Audit — one week, if we didn't build it
A written assessment of the codebase, its dependencies, its infrastructure and its risks, with a recommended first ninety days. $900–1,800, credited against the first two months.
- 03
Month one — stabilise
Monitoring wired up, alerting tuned, the worst dependency debt cleared. This month is deliberately unglamorous.
- 04
Ongoing — a rhythm, not a queue
A scheduled call at your tier's cadence, a written report every month, and a shared backlog you can reprioritise at any time.
- 05
Change tier whenever
Up for a busy quarter, down for a quiet one, out with thirty days' notice. No renegotiation, no penalty.
Stack
The specific things we build with.
Monitoring
Sentry
Vercel and Cloudflare analytics- Uptime and synthetic checks
- Custom LLM cost and eval dashboards
Maintenance
- Dependency automation
- Security advisory triage
- Database migration review
- Backup and restore verification
AI upkeep
- Model deprecation migrations
- Eval suite maintenance
- Token spend monitoring
- Prompt and retrieval regression testing
Working with you
- Shared backlog you control
- Monthly written report
- Scheduled calls by tier
- Your repos, your cloud accounts
FAQ
Questions people actually ask
What's included in a software maintenance retainer?
At Shark Labs, every tier includes monitoring and alerting, dependency and security patching, bug fixes, a monthly written report and a scheduled call. The $2,500 and $6,000 tiers add new feature development, AI model migrations and eval maintenance, and faster response times. Hours are stated per tier rather than described as unlimited, because unlimited is never true.
How much should a software maintenance retainer cost?
The common industry rule is 15–20% of the original build cost per year, and published agency retainers generally sit between $1,200 and $25,000 a month depending on hours. Shark Labs publishes three tiers — $900, $2,500 and from $6,000 a month — for roughly 10, 30 and 80 engineering hours. If a quote doesn't state hours, it isn't a price, it's an opening position.
How many hours should a retainer include?
For a live product with real users, ten hours a month is enough to keep it patched, monitored and not degrading — but not enough to improve it. Thirty hours covers maintenance plus a steady trickle of small features. Eighty is effectively a part-time engineer embedded in your team. Pick by what you want to happen, not by what you think will go wrong.
Is a retainer better than hiring a full-time developer?
Below about thirty hours a month, a retainer is cheaper and you get a team's range instead of one person's. Above roughly eighty hours a month, hiring wins on cost and on context — a full-time engineer who lives in your codebase will always know it better than we will. The awkward middle is real, and we'll tell you when you've reached it rather than waiting for you to notice.
Do you take over software you didn't build?
Yes, and it's a common way for a retainer to start. It begins with a week-long paid audit — $900–1,800, credited against the first two months — that assesses the codebase, dependencies and infrastructure and proposes a first ninety days. If the honest recommendation is to rebuild rather than maintain, we'll say so.
What happens to unused hours?
They roll over for one month. They don't accumulate beyond that: a retainer reserves capacity for you whether or not you use it, and a bank of thirty unused hours would eventually mean promising a month of work that was never staffed for.
Is there a minimum term?
No. Thirty days' notice, cancel any time. Everything runs on your own accounts and infrastructure throughout, so leaving means sending an email rather than planning a migration. A retainer that needs a twelve-month lock-in to be worth having isn't worth having.
Why do AI features need ongoing maintenance at all?
Because their behaviour can change without your code changing. Providers deprecate model versions, adjust defaults and revise pricing on their own schedule, and your data drifts underneath the prompts. An eval suite that passed in March can be failing by September while every test in your CI still goes green. Somebody has to be watching that, and after launch it's usually nobody.
Keep reading
Related work and reading
Service
AI integration
LLM features, retrieval and agents wired into the systems you already run — with evals, guardrails and a cost model that survives contact with real traffic.
Service
Web development
Fast, accessible, search-visible sites and web apps on Next.js — built so your team can edit them without calling us.
Article
What a software maintenance retainer actually costs
Most agencies won't put a number on a retainer. Here are ours, the industry ranges we checked them against, and the arithmetic for deciding when hiring someone is cheaper.
Article
Why your AI proof of concept never shipped
The demo worked. Four months later it's still a demo. Here are the six things that actually block the gap, in the order they usually bite.
Next step
Who owns your software on a Tuesday afternoon?
If the answer is nobody in particular, that's the problem this fixes. Tell us what you're running and we'll tell you which tier fits — including when the answer is that you don't need one yet.