Low-code vs. custom development: how to choose

The market research firm Forrester probably coined the term in 2014. Researchers at the University of Duisburg-Essen in Germany studied 10 such platforms (Bock and Frank, 2021). All of them came with a tool for the data model, a designer for screens and support for basic rules. Almost all also offered roles and user rights, plus help with deploying the finished app. According to the authors, these building blocks have existed for decades. A low-code platform brings them together in one system.

The study found that very different products are sold under the low-code label. It distinguished four rough categories:

• simple data management platforms
• classic workflow management systems
• extended development environments centered on user interfaces and data
• complex multi-purpose platforms for configuring, integrating and developing business applications

Vendors draw the line between low-code and no-code differently, and some use both terms for the same product (ICB Research Report 70, Dec 2021). Even so, almost all platforms allow traditional code at some level (Bock and Frank). Our article What is vibe coding? explains how no-code differs from software an AI writes from plain-language prompts.

The Digital Office Index 2022 by Germany’s digital industry association Bitkom shows how widespread the approach is. Of companies in Germany with 20 or more employees that automated processes with software, 35% used low-code or no-code approaches (Bitkom, 2022).

Strictly speaking, a low-code app is custom software too. The German business dictionary Gabler Wirtschaftslexikon defines custom software as software developed for one particular business, in-house or by a contractor (Gabler, Feb 19, 2018). In this comparison, custom software therefore means software written in code. A development team builds it with common programming languages and components, and you can run it with any provider you choose. Our build vs. buy comparison shows how it differs from off-the-shelf software. Many low-code platforms are rented as a cloud service. Our guide to SaaS explains what that means.

The numbers in the “Sources” column refer to the source list at the end of this article.

Strengths: The platform comes with the database, screens, roles and deployment. Researchers Bock and Frank of the University of Duisburg-Essen see the productivity gain mainly in less routine work on projects of low to moderate complexity. People from the business side can contribute directly and check early on whether the process is right. A Riga Technical University review of 42 articles names closer collaboration between IT and business teams as a benefit (Rokis and Kirikova, 2023). If the platform runs as a cloud service, the vendor manages the network, servers, operating systems and storage underneath (NIST, SP 800-145). For back-office tools on your existing data, our page on internal tools compares low-code platforms with a custom build.

Limits: The license is an ongoing cost, and every additional user costs more. Anything the platform doesn’t provide for takes a lot of effort. The app stays tied to the platform.

Use case: approval workflows, checklists and inspection records, simple data entry forms and reports on existing data. Practitioners on developer forums favor low-code especially where processes and workflows need to be automated (Luo et al., ESEM 2021). Low-code also fits apps you’ll need only for a short period, and prototypes that help you clarify requirements. Some office software subscriptions already include a low-code plan. Our how-to on digitizing business processes shows how to map a process before you choose a tool.

Strengths: You pay no per-user license for your own software, although third-party services it uses have their own prices. The data model, rules and user interface follow your process. You decide where the software runs. Testing and version control run on standard tools. For low-code, the literature review from Riga Technical University names both as typical weak spots (Rokis and Kirikova). With the source code and documentation, another team can carry on the work.

Limits: It takes longer to reach a first version, and development costs money up front. You need a development team, in-house or at a service provider, plus a budget for maintenance every year. If the source code, documentation and access credentials aren’t in your hands, you depend on the team that built the software. What to put in writing before the project starts is covered in our how-to on developer lock-in.

Use case: customer portals where many external users check status updates, documents and invoices. Core processes with rules of your own, such as cost estimating or staff scheduling. Apps with large data volumes or many integrations. Software you want to sell to customers yourself, and apps you’ll use for 10 years or more.

Cloud services can be billed by features, usage period and number of users, according to Germany’s Federal Office for Information Security (BSI, IT-Grundschutz module OPS.2.2). An analysis of 301 posts from developer forums lists high prices as a drawback, especially with many users (Luo et al.). Vendors’ pricing pages show further cost items:

• Free to build, paid to use: Several platforms let you build and test apps at no cost. Licenses are required once employees use the app in day-to-day operations.
• External users: Some platforms count guests and customers just like your own users. Others have separate pricing for portals or don’t charge for anonymous visitors.
• Data and computing capacity: Extra database storage is billed per gigabyte per month. At one large vendor, the computing resources needed to run the apps aren’t included in the license price.
• Plan limits: Plans cap things like records, storage or API calls, the requests other programs send to the platform. If you need more, you move up to a bigger plan or buy add-ons.

Calculation: users × 60 months × price per user per month. The price levels are illustrative, and the amounts exclude VAT.

Our cost guide How much does custom software development cost? covers market prices for developing your own app. To compare all costs of both routes over the same period, see our five-year cost comparison. Our own packages are listed on our custom business software page.

Information systems researchers Bock and Frank of the University of Duisburg-Essen draw a clear line. Low-code can raise productivity if all of a project’s requirements fit within a platform’s “predefined, immutable framework.” The Riga literature review lists typical hurdles: implementing business logic, extensibility, scalability, performance, testing and version control (Rokis and Kirikova). On developer forums, practitioners report that complex cases still need code and that some platforms are slow to load and publish (Luo et al.).

For data volumes, the limit is often set by the plan. Plans cap records per database or per user, storage and API calls. Check these values in the plan before you commit, and compare them with your data volumes in five years.

In our view, these are warning signs: your team is back to keeping its own lists alongside the app. Special cases run through scripts outside the platform. Or you keep hitting the limits of your plan.

Researchers Bock and Frank of the University of Duisburg-Essen see this as the central risk. In most cases, what one platform generates can’t be used in another. That puts your investment at risk if a vendor stops supporting a platform. One large vendor did exactly that in early 2021. The apps on its platform stopped working, and only the data remained.

How far an export goes varies widely. In the Duisburg-Essen study of 10 platforms, several could export only the stored data, for example as CSV or spreadsheet files. One platform exported entire apps, but in its own format that only the same platform could import. Another handed over the source code, but without its own program libraries (ICB Research Report 70). These findings date from 2021, so check the current situation for your platform.

For every cloud service, Germany’s Federal Office for Information Security recommends clear contracts (BSI, OPS.2.2). They should set out how to end the relationship in an orderly way, how your data will be deleted and when you can terminate. Where protection needs are higher, the BSI also recommends testing regularly whether you can move the service and data to another provider or in-house. According to the BSI, vendors could also exploit that dependence to push through price increases. So ask before you sign:

• In which formats can you get all your data out, including attachments and links between records?
• Can the app itself be exported, and what can it do without the platform?
• What notice period applies if you cancel, and how far in advance does the vendor announce price and product changes?
• What happens to your data after the contract ends?

Try the export once during the trial. Open-source platforms that you host yourself reduce the lock-in. The authors of the developer forum analysis recommend them as a way to keep the code (Luo et al.). Operations and updates are then up to you.

Germany’s digital industry association Bitkom notes that external low-code platforms are often built for the cloud (Bitkom, low-code and ERP paper, Feb 2023). Some platforms, by contrast, are installed on a web server of your own (Bock and Frank).

Germany’s Federal Office for Information Security (BSI) advises cloud customers to specify the service location in the contract. Providers should also disclose all subcontractors. Companies should have providers regularly prove their security, for example based on ISO/IEC 27001 or the BSI’s C5 cloud criteria catalog (BSI, OPS.2.2). The BSI also points out that providers are often subject to other countries’ laws, for example on third-party access to information.

Connectors, meaning ready-made links to other services, are a second route for data. According to the OWASP Foundation, data leaks occur when information leaves its intended storage location or the company’s control. OWASP recommends limiting connectors to an approved list of services (OWASP, CD-SEC-04).

Ask your data protection advisor which contracts you need when a vendor processes personal data on your behalf.

A discussion paper by Bitkom, Germany’s digital industry association, sees low-code as a chance to shift part of development to business teams. But it adds a caveat: in practice, non-IT staff usually need an IT professional at their side. For external platforms, Bitkom calls release management a critical point, meaning who approves new versions. If business teams build without IT oversight, app sprawl quickly sets in and soon becomes hard to rein in. Developer forums also mention a learning curve (Luo et al.).

The OWASP Foundation describes the consequences: apps from business teams are “prone to being forgotten or abandoned while remaining active and functional.” They keep running without updates and without anyone responsible. OWASP recommends assigning an owner to every app and keeping an inventory of apps and users (OWASP, CD-SEC-09). Conversely, a centrally managed platform can reduce the risk of shadow IT, meaning solutions used without IT’s approval (Rokis and Kirikova).

Skilled people are scarce for both routes. In 2024, 16% of companies in Germany with 10–49 employees had their own specialists in information and communication technology (ICT). The EU average was 14%. Among companies with 50–249 employees, the shares were 48% in Germany and 43% across the EU (Eurostat, as of Jun 15, 2026). According to Bitkom, Germany is short of 79,000 IT specialists, and 97% of companies with IT positions struggle to fill them (Bitkom, Sep 3, 2026).

With low-code, the vendor and your company share the maintenance. If the platform runs as a cloud service, you control your apps. The vendor controls the network, servers and operating systems underneath, as defined by the US standards agency NIST. So the vendor decides when the platform changes. With custom software, all maintenance is up to you or your service provider, from component updates to new features. For what that costs, see our cost guide How much does software maintenance cost?

A Bitkom discussion paper describes this pattern for enterprise resource planning (ERP) systems, a company’s central planning software. An external platform extends an existing ERP system through APIs instead of replacing it. An API (application programming interface) is a defined way for two programs to exchange data. Keep your important data in the system you plan to use the longest. That keeps a later switch of platform manageable.

A prototype on a platform can help you clarify requirements before you commission development. But expect your custom software to be built from scratch afterward, because what a platform generates can rarely be transferred (Bock and Frank). To put your requirements in writing, see our how-to on the software requirements specification.

1. Who will use the app? Count the users today and in five years, internal and external. Many or external users drive up license costs.
2. How long should it run? A short or uncertain lifespan points to low-code, a long one to custom software.
3. Do your rules, data volumes and integrations fit the platform? During the trial, rebuild the hardest cases in your process. Compare your data volumes with the limits of the plan.
4. Where does the data have to be stored? Clarify location, subcontractors and proof of security before you load personal data.
5. How do you get out again? During the trial, export all your data and check whether you can read it without the platform. Write down the cancellation notice period and how far in advance price changes are announced.
6. Who builds and maintains the app? Name an owner, and decide who from IT will support the business team.
7. What does each option cost over the same period? Add up licenses, setup, maintenance and exit for both options over the same period, as the IEEE’s SWEBOK Guide calls for. The next section shows one way to calculate it.

Questions 4 and 5 follow the requirements of Germany’s BSI for cloud services (BSI, OPS.2.2), and question 6 follows OWASP’s recommendations. The order and weighting are our recommendation.

If you’d rather not do this alone, consider our process check. We map your process and assess whether off-the-shelf software is enough.