Build or buy? A decision guide for digital platforms

Begin by separating commodity capability from behaviour that genuinely differentiates the business. Authentication, payroll and transactional email are rarely places where bespoke ownership creates an advantage. A scheduling model, pricing engine or fulfilment workflow that embodies how the company serves customers might be.

This distinction prevents a common mistake: treating software ownership as strategic by default. Owning code creates obligations, security patches, incident response, compatibility work and product decisions. Those obligations are justified only when control of the underlying behaviour is valuable enough to repay them.

Write down the users, critical jobs, constraints and outcomes before looking at products. Separate requirements that are legally or operationally mandatory from preferences that could change. Without this work, demonstrations steer the decision toward whatever a vendor presents best rather than what the organisation needs to operate.

Use real scenarios instead of long feature lists. Ask each option to complete the same representative tasks with realistic data, roles and exceptions. A product can technically include a feature while making the everyday workflow slow, fragile or dependent on manual workarounds.

Licence price and initial build cost are incomplete numbers. Include implementation, migration, integrations, training, support, security reviews, vendor change and the cost of delayed learning.

Model at least three years and make uncertainty visible. A custom build may have a lower recurring licence cost but require product, engineering and operational capacity throughout its life. A purchased platform may begin quickly but become expensive as users, transactions, storage or premium modules grow.

Buying transfers some delivery responsibility but not accountability. Review the supplier's financial stability, security controls, service history, roadmap, support model and approach to data export. Contract terms matter most around renewal, price changes, breach notification, service levels and assistance when leaving.

Building replaces supplier concentration with internal concentration. Knowledge may sit with a small team, while maintenance competes with visible roadmap work. Reduce that risk through documented architecture, automated tests, supported dependencies, observable operations and more than one person able to release and recover the system.

Many effective platforms combine dependable managed services with a focused custom layer. The business avoids rebuilding solved infrastructure while retaining control of the customer experience and its differentiating logic.

Document the boundaries explicitly. A hybrid architecture is only flexible when data ownership, integration contracts and operational responsibility are clear.

Do not begin a custom programme by building the easiest screens or choose a vendor from a polished demonstration. Test the area most likely to invalidate the option: a complex permission model, a legacy integration, peak-volume processing, migration quality or the workflow that must remain distinctive.

A time-boxed proof should produce evidence and a decision, not quietly become production. Define success criteria, representative data and what will be discarded. Include operational users and security reviewers early enough that their findings can still change the direction.

Write down the assumptions behind the choice and the conditions that would trigger a review. Preserve data ownership, insist on documented interfaces and avoid coupling ordinary business rules to proprietary features without a clear benefit. Switching will never be free; reversibility means the cost can be understood and the move can be executed without reconstructing the business from an opaque export.

The answer can change as volume, regulation and the product mature. Buy when proven capability and time to value matter more than differentiation. Build when a narrow capability creates defensible value and there is a team prepared to operate it for years. In practice, the strongest platform is often assembled: managed foundations underneath, deliberate custom software at the points where control actually matters.