Build vs Buy
Decide whether to build a capability in-house or use a managed service / SaaS, based on total cost and strategic value.
Why
Building everything in-house feels like control but means you're maintaining 10 things that aren't your product. Buying everything feels like speed but means you've outsourced your differentiators and you're one vendor price hike from unprofitable. The build-vs-buy decision is about focusing engineering time on what's strategic (build) and buying what's commodity (auth, email, payments, observability). Getting it wrong in either direction is expensive: building auth wastes 6 months on a non-differentiator; buying your core algorithm means you can't out-innovate competitors. The decision must be explicit per capability.
When
For every new capability, before implementation. Takes 2-4 hours per decision. Revisit if the vendor landscape or your strategy shifts.
How
1. Is this capability a differentiator? (Would a competitor doing it better hurt us?) - Yes → lean toward build (or buy + wrap with proprietary logic) - No → lean toward buy (it's commodity) 2. Is a mature managed/SaaS option available? - Yes, with good API + pricing → buy - No, or vendor lock-in is severe → build 3. Compute TCO of each (see tco-analysis) over 3 years 4. Assess switching cost: if we buy and the vendor doubles price, how hard is leaving? 5. Assess time-to-market: buy is usually 3-6 months faster 6. Decide; document the reasoning in an ADR (it will be questioned later) 7. If buy, negotiate price + data portability up front; if build, staff it fully
Example
Capability: user authentication (login, OAuth, MFA) Differentiator? No — every app has it, users don't choose us for it. Mature options: Auth0, Cognito, WorkOS — good APIs, reasonable pricing. TCO build: 6 eng-months + ongoing (MFA, SSO, compliance) ≈ $200k + $40k/yr TCO buy (Auth0): $24k/yr, 1 eng-week to integrate Switching cost: moderate (standard JWT/OIDC, portable) Time-to-market: buy saves 5 months Decision: BUY (Auth0). Reasoning saved in ADR-014. Exception: if we need a custom auth flow that's a differentiator, build that part.
Common Problems
- ⚠Building the commodity, buying the differentiator — the most expensive mistake; engineers build auth (fun, non-strategic) and buy the recommendation engine (boring, strategic).
Best Practices
- ✓Revisit the decision annually — a capability that was strategic last year may be commodity now (e.g. vector search went from build to buy in 2024).
- ✓If you buy, keep a thin abstraction layer so you can swap vendors — it costs 10% more but saves you from lock-in.