Published
8 MIN READ
SaaS development agency: what to require
A SaaS development agency builds, and usually keeps operating, software sold by subscription. The contract changes because of that: the product isn't delivered and closed out like a website, it keeps running, storing people's data and charging cards every month. Whoever hires needs to decide this up front, not after the first paying customer.
Searching for the term returns almost nothing but service pages. An international SaaS development company, on a page updated on August 4, 2026, describes its process, industries served and technologies without saying whose name the cloud account is in at the end of the project.
At Wama, the project is transferred to the client's account and the subscription stays on the client's card. The logic is the same as when an online presence stops being a showcase, with one important difference: in a digital product, that account stays active and generating invoices after the team delivers.
What does a SaaS development agency do?
It designs, builds and launches software sold by subscription, and almost always keeps operating that software afterward. The work includes architecture, database, authentication, permissions, payment integration and the infrastructure where everything runs. Delivery doesn't end at deploy, because someone needs to respond when the product goes down.
That second half is what separates a SaaS contract from a website contract. The build is described in what building the product requires at each phase. What almost no proposal describes is the operation: who monitors, who handles tickets, who renews certificates and who pays for the cloud.
What changes when the product keeps running
A corporate website is published and starts living on the platform's plan. A SaaS has continuous operation: a cloud account, a database with third parties' data, a payment integration that fails, a certificate that expires, a library with a security flaw waiting for an update. Each of these items has an owner, written in the contract or discovered in a scare.
When the owner isn't written down, they show up at the first incident. The cloud invoice lands on the card of whoever signed up, the middle-of-the-night alert lands on whoever has access and the failed charge blocks the seller's customer. Add to that the billing machine the product needs to have, which also needs someone on call.
Whose name are the product's accounts in?
The name of the company that owns the product, always. Cloud account, domain, code repository, email provider, payment processor and monitoring dashboard go under the CNPJ, Brazil's company registration number, of whoever sells the software, with the vendor added as a user. The reverse arrangement, the account in the agency's name and the client as a guest, is what blocks the exit.
At Wama, website, domain and account are already in the client's name from delivery, so switching vendors requires no migration at all. Ownership of the source code is a separate decision, covered in code ownership, which is a different discussion.
Who is responsible for the data: controller or processor?
The company that owns the product is the controller and the hired agency is the processor. Under Law 13,709 of 2018, the LGPD, Brazil's data protection law, the controller is whoever makes the decisions about processing personal data and the processor is whoever carries out that processing on the controller's behalf. Hiring someone doesn't transfer the responsibility.
The guidance from the ANPD, Brazil's data protection authority, on processing agents, version 2.0 from April 2022, uses exactly this example: the entity that hires an outsourced company to develop software is the controller, and the hired company is the processor.
There's one exception that flips the game. Article 42 makes the processor jointly liable, on par with the controller, when it breaks the law or doesn't follow the lawful instructions of whoever hired it. An instruction that isn't written down is an instruction nobody can prove later.
The same goes for a product born inside an AI builder: the platform is one more link in the chain, and whoever decides on the processing is still the company that owns the product.
What the contract needs to state before the first screen
The ANPD guidance notes that the LGPD doesn't expressly require a contract between controller and processor, but treats the document as good practice: the clauses set limits on the processor and establish objective parameters of responsibility. The same guidance lists what should be defined there.
What to write | Why it matters |
|---|---|
Purpose, duration and scope of the processing | Defines what the vendor can do |
Types of personal data involved | Changes the level of security required |
Ownership of the accounts and the code | Defines who can leave without asking permission |
Security measures each side takes on | Article 44 holds liable whoever didn't adopt them |
Subcontractors (cloud, email, payments) | The ANPD recommends formal authorization |
What happens at the end of the contract | Avoids negotiating the exit at the worst moment |
It's the equivalent conversation when the project is a website, with two extra items: third-party data and continuous operation. At Wama, payment is 50% at the start and 50% on delivery, and revisions are unlimited within scope, which pushes the scope discussion to before signing.
Agency, freelance developer or in-house team?
It depends on how long the product will need to exist and who takes on the operation. The only decision guide in Portuguese that came up in the search was published by a freelance developer in November 2025, with a comparison table and success stories with no verifiable source, defending the side he sells.
The honest comparison isn't about hourly rates. A freelancer delivers direct contact and concentrates the risk in a single person. An agency delivers continuity and charges for it. An in-house team solves both and takes months to exist. At Wama, one person follows the project from brief to deploy, with no account management layer in between.
What to require in the proposal before signing
Whose name the cloud account, the domain and the repository are in.
Who is the controller and who is the processor of the data, written in the contract.
Which security measures each side takes on, item by item.
Who responds outside business hours and how fast.
Which subcontractors touch the data and who needs to authorize new ones.
What happens to access on the day the contract ends.
How much it costs to keep the product live per month, separate from the cost of building it.
The last question is the one that changes proposals the most. Build cost and operating cost are different budgets, and mixing the two hides the bill that will arrive every month. The build range appears in what separates a US$ 4,000 quote from a US$ 20,000 one.
What happens when you switch vendors?
If the accounts are in your name, almost nothing: you remove the old vendor's access and add the new one's. If they're in the vendor's name, the switch becomes a migration, with a downtime window, a database export, a new payment processor and customers relearning the way in. The same contract decides both scenarios.
It's worth rehearsing the exit before you need it. Ask for a full database export and a list of all access in the first quarter of operation, along with what a new customer finds when they log in for the first time, because that flow is the first to break in a botched migration.
Common mistakes when hiring whoever will operate the product
Registering the cloud on the agency's card. The account becomes hostage to whoever opened it.
Treating security as a generic technical item. The ANPD's information security guidance for small processing agents, from October 2021, calls for a written policy covering backups, passwords, access, sharing and software updates.
Leaving operation out of the budget. Cloud, monitoring and on-call exist the month after delivery.
Signing without a subcontracting clause. Your vendor's vendors touch your data.
Postponing the ownership decision. Once the product is live, the negotiation happens with no alternative.
Frequently asked questions
Who is responsible if my SaaS leaks customer data?
The company that owns the product is liable as the controller, because it decides on the processing. The vendor is jointly liable when it breaks the law or doesn't follow the contracted instructions. That's why each side's instructions and security measures need to be written down before the first customer.
Do I need to hire an agency to maintain the SaaS once it's done?
Not necessarily, but someone needs to take on the operation: cloud, monitoring, security updates and incident response. It can be the agency that built it, another vendor or an in-house team. What doesn't work is leaving the item without an owner and finding out during the first outage.
How much does it cost to develop a SaaS with an agency?
At Wama, a minimum viable product falls between US$ 4,000 and US$ 20,000, with a ceiling near US$ 40,000 depending on complexity, based on 50 to 100 quotes. The monthly operating cost is a separate budget, and depends on usage volume, integrations and the level of on-call the product requires.
What happens to the product after the agency delivers?
At Wama there's no monthly maintenance contract. What exists is training for the client's team, a warranty period with free fixes and an open channel for occasional questions. The infrastructure account stays in the client's name, and the client keeps owning everything.
Can I start with one vendor and switch later without losses?
You can, as long as the accounts, the domain and the repository are in your company's name from day one. In that arrangement, switching means removing one access and granting another. When ownership sits on the vendor's side, the switch becomes a migration project with its own cost and risk.
If you're going to hire whoever builds and operates your product and want this in writing before the design, talk to Wama and ask for a detailed proposal.
