Build vs Buy: The Four Numbers That Decide It

Build the thing that makes you defensible. Buy everything else. That rule is right often enough to be the default, and it is not the interesting part of the decision, because everybody already agrees with it and teams still build auth.

The interesting part is what “buy” actually costs, in dollars, this year. Below is what we pay, what the vendors publish, and the one place where the standard advice is wrong.

Auth: buy, and it is not close

Clerk’s free tier covers 50,000 monthly retained users. Above that, Pro is $25 a month and additional users are two cents each.[1] Auth0 gives you 25,000 monthly active users free.[2]

So for most pre-Series-A products, bought authentication costs nothing. The build-vs-buy question is not “is $25 worth it” - it is whether you would rather own the list of things you now have to get right. OWASP’s identification and authentication failures category maps 22 weakness types across 132,195 recorded occurrences and 3,897 CVEs.[3] Credential stuffing, brute force protection, password reset flows, credential storage, MFA, session invalidation on logout, session fixation. Each of those is a Tuesday for a vendor and a distraction for you.

The cost of buying, stated honestly: the pricing model can bite in a shape you did not plan for. Auth0’s B2B entry tier is $150 a month for 500 MAUs against $35 for B2C at the same count.[2] If you sell to companies, the variable that decides your auth bill is your customer shape, not your user count, and it is worth checking that before you are locked in. Clerk charges the same way for the features B2B needs: organisations are a $100/month add-on and each enterprise SSO connection is $75.[1]

Also worth knowing before you model anything: Clerk bills retained users, who only count if they come back at least 24 hours after signing up.[1] That is not the same number as your MAU and it is usually smaller.

Payments: buy, and the reason is not the code

Stripe takes 2.9% plus 30 cents on a domestic card, 1.5% more for international cards, and another 1% if a currency conversion happens.[4] Those are real percentages and on a large enough business they eventually justify a conversation about alternatives.

They do not justify building. The reason is scope, not effort.

PCI DSS Self-Assessment Questionnaire A - the short one - applies only to merchants with “account data functions completely outsourced to PCI DSS validated and compliant third parties”, who “do not electronically store, process, or transmit any account data” on their own systems.[5] The moment a card number touches your server, you are not eligible for SAQ A, and you are answering a materially larger questionnaire against the full standard rather than the seven requirements SAQ A covers.

That is the whole argument. You are not choosing between writing a charge endpoint and importing one. You are choosing your compliance scope for the life of the company.

The cost of buying: disputes are $15 each regardless of outcome,[4] and you inherit the vendor’s risk decisions. If Stripe freezes your account you have no revenue and no leverage. Have a second processor integrated behind an interface before you need one, not after.

Email: buy, and stop thinking about it

Resend is free to 3,000 emails a month and $20 for 50,000.[6] That is the entire analysis. Deliverability is a reputation game played over years across mailbox providers who will not tell you the rules, and your IP has no reputation.

Storage: buy, but the default vendor is probably wrong

This is the one where the standard advice fails, and it is not a build-vs-buy question at all. It is a buy-which question, and most teams answer it by reflex.

Cloudflare R2 charges $0.015 per GB-month and nothing for egress. Their documentation is unambiguous: “There are no charges for egress bandwidth for any storage class.”[7]

S3 charges for data transfer out. AWS’s own pricing page gives $0.09 per GB in Europe (Ireland), above a 100GB monthly free allowance.[8]

Run it. A product serving 5TB of media a month - a modest video, audio or image-heavy app - is 5,120 GB, less the 100GB allowance, at $0.09: about $452 a month in egress alone, and zero on R2. The storage itself is a rounding error next to that. If you are serving files to users rather than warehousing them, egress is the bill, and defaulting to S3 because it is the one you have heard of is a five-figure annual decision made by habit.

Where our own confidence ends: we could not verify AWS’s egress rate for US East from the pricing page. The tables are rendered in JavaScript and the $0.09 figure above is Ireland, taken from a worked example in AWS’s own copy. The US number is probably lower. Check your region before you quote this arithmetic to anyone, including us.

Search: buy first, and expect to revisit it

Algolia is free to 10,000 search requests and 50,000 records a month, then $0.50 per additional thousand requests.[9]

Search is the one commodity component where buy genuinely can flip to build. The pricing scales on two axes at once - how much you have indexed and how often people search it - so a product that grows its corpus and its traffic together compounds against you. Start with the vendor, because you do not yet know what your users search for and you cannot design an index around a guess. Put a date in the calendar to re-run the numbers rather than a vague intention to revisit.

Postgres full-text search covers more cases than people expect and costs a database you already run.

The question that actually decides it

Not “can we build this”. You can build any of it. The question is what you are willing to still be maintaining in three years, because none of these are projects - they are all permanent staff.

A useful test before you commit either way: if this component breaks at 2am, who gets paged, and is that a good use of them? For auth, payments and email the honest answer is that it should be somebody whose entire company depends on that thing working. For your core product, the honest answer is you, which is exactly why that is the part worth building.

Wrap whatever you buy behind an interface. It takes an hour and it turns “we are locked into this vendor” into a scheduled piece of work.

Where we land

Buy auth, payments and email without a meeting. Buy storage, but check egress before you pick the vendor. Buy search and diarise a review. Build your product.

And if the component you are debating is the one your customers would describe when explaining what your product does - build it, and do not let anybody talk you out of it on cost.