What's actually going on
The invoice arrives, the tool renews, and the part of the job it was meant to cover is still finished by you, in a spreadsheet, on the side. That's a normal place to be. Most small businesses pay for several tools that each do most of a job, and a person fills the gaps. Nobody planned it; it accumulated. The vendors say as much: Xero's own notice to Australian customers on 1 July 2024 said some on older plans would pay more when moved, with those increases held until July 2025 (Xero, 1 July 2024).
So wanting to own the thing instead, something that does your job your way and never sends a renewal notice, is reasonable, not naive. It's a far more common thought lately, because people who know their own work can now get plain tools built quickly. The worry that follows is fair too: a home-made tool nobody looks after can be a bigger problem than the invoice. So answer that worry first.
The questions to answer before anyone builds anything
Whether it's built by you, a friend, or someone you pay, the tool is only as safe as these answers, written on one page before it exists.
- Who maintains it: a named person, not "whoever's free"? What happens the week they're away?
- What does "support" cover, what does it cost, and what's not included? Upkeep exists for all software. The honest version is written down and priced, not hidden in a fee that quietly grows.
- How would you leave? Your data comes out in a format another tool can read, and the code is yours to hand on. If either answer is fuzzy, that's lock-in, not ownership.
- What rules does it follow? If the logic won't fit on one page, only the person who built it can maintain it.
Then the four security basics for any small app. They're what the Australian Cyber Security Centre tells small businesses to do first, and the categories that turn up year after year in OWASP's list of the most common web application risks: access control, authentication, out-of-date components.
- Real logins. One account per person, multi-factor authentication on, no shared password on a sticky note. The Centre's guide puts MFA first and names password reuse as a common way in.
- Backups you've tested restoring. A backup nobody has restored from is a hope, not a backup. Same guide, same top three.
- Updates someone owns. The libraries under a small app age like anything else; patching is two of the Essential Eight. Name who does it and how often.
- Least data. Don't store what you don't need. A tool that never held a customer's date of birth can't leak it.
If those four are handled, the "riddled with vulnerabilities" fear is mostly answered. If not, no clever feature makes up for it.
Keep, clean, connect, or convert, applied to building your own
Keep the tool if it does the job and the gap is a habit, or a setting nobody switched on. A renewal invoice is annoying, not evidence.
Clean the spreadsheet that fills the gap. Often the real cost isn't the subscription but the copying and reconciling around it. Tidy that first, and time it.
Connect the two tools before replacing either. Most "build our own" moments are really "these two should talk to each other", and sometimes the answer is an integration that already exists.
Convert, meaning build your own, only when three things are true at once: the manual gap is stable (it has looked the same for months), it's written down (the rules fit on a page), and the price you pay is mostly for features you don't use. Then build small: one workflow, the questions above answered first.
What "done" looks like
Done is measured, not felt. Pick a date. Write down the renewal you didn't pay and the hours the gap used to take each week. Read both on that date. If the hours are down and the four basics still hold, it worked. If not, that's useful too: it says which of keep, clean or connect you skipped.