Records Retention and Legal Hold Software: Custom Build vs Exterro, Relativity and Zasio
Buy if your data sits almost entirely in Microsoft 365, you hold the licensing that includes native preservation, and you run a handful of matters a year. That is proportionate and defensible.
On this page
Buy if your data sits almost entirely in Microsoft 365, you hold the licensing that includes native preservation, and you run a handful of matters a year. That is proportionate and defensible. Build once your business records live in systems no packaged tool connects to, your leaver process has already destroyed data under hold, or disposition has never once run.
What Exterro, Relativity and Zasio actually do well
Opposing counsel has asked when the hold was issued, to whom and what it covered, and in house counsel is looking at a spreadsheet with fourteen names on it. That is the meeting that starts this search. Before anything else, be fair about the products, because several of them are good and you may not need to build at all.
Exterro and Relativity Legal Hold are strong on the litigation side and handle notices, acknowledgements and matter linkage properly. Zasio Versatile is genuinely good at retention schedules and at the legal research behind them, which is a discipline rather than a feature. OpenText Records Management and Iron Mountain Policy Center come out of the records management tradition and show it. Microsoft Purview holds work well across mail, Teams and SharePoint if your licensing includes them, and Google Vault covers its own estate.
Buy if you run a handful of matters a year, your data lives almost entirely in Microsoft 365, and you hold the licensing that includes native preservation. Native features plus a written procedure plus a diligent paralegal is proportionate, defensible and far cheaper than a build. If you already run Relativity for review, its hold module is a sensible adjacent purchase rather than a project. We say this to general counsel who arrive asking for a quote.
Where they stop: the leaver process and the systems nobody connects to
Preservation failures almost never look like misconduct. They look like a leaver process, a migration and a scheduled job.
Two custodians on an eighteen month old hold left the company, and the standard leaver process deleted their mailboxes because it has no idea what a legal hold is. One custodian never acknowledged and there is no record a reminder was sent. The shared folder named in the hold was migrated last year and the original path no longer exists. Nobody can say whether the archive job on your enterprise resource planning (ERP) system purged the records in scope. Under Federal Rule of Civil Procedure 37(e), what happens next depends on whether reasonable steps were taken to preserve, and a spreadsheet is a poor way to demonstrate reasonable steps.
Packaged hold tools connect well to the large collaboration platforms and stop there. The systems that hold your actual business records, meaning the enterprise resource planning instance, the manufacturing execution system, the trading platform, the claims system, are yours to solve. Each has its own preservation semantics, and for some the only available mechanism is suspending a scheduled purge job and logging that suspension.
The reverse failure is quieter and just as expensive. Nothing ever gets deleted, because disposition requires trusting two facts at once: the retention period has elapsed and no hold covers the record. If either is uncertain, keeping everything is the rational choice. So you hold twenty years of mail at rising cost, every byte discoverable in the next matter, while your privacy team notes that personal data kept with no purpose is its own exposure under the storage limitation principle in Article 5 of the General Data Protection Regulation.
The arithmetic: per custodian fees against the cost to build
Reduce every quote to two units: cost per custodian under hold per year, and cost per matter. Those are what actually scale.
Suppose the quote is $95 per custodian per year and you carry 900 custodians across live matters. That is $85,500 recurring, and it rises with litigation you do not control. Add the licensing uplift some preservation mechanisms require, which is often the larger number and the one that appears after the software decision is made.
The crossover is repositories, not custodians. Below roughly 300 custodians and four or five repositories that all belong to one collaboration suite, buy. Past roughly 1,000 custodians under hold, or past six repositories where three or more are line of business systems with no preservation feature, a build wins, because every one of those systems is a connector somebody has to write regardless of which product you own.
Count repositories honestly while you are at it. People list mail, the collaboration suite and the file server, then forget the messaging tool on a plan whose export behaviour nobody has checked, the archive on a decommissioned server that legal still references, and the line of business system whose purge job runs quarterly. Those three are where preservation quietly fails, and they are also the three no product will cover for you at any price.
There is a third number worth putting on the same page. Ask your infrastructure team what you spend annually storing data that is past every retention period on your schedule. In enterprises we have worked with, that figure alone has exceeded the build cost of the disposition workflow that would have removed it.
What a custom build actually costs
From Digital Heroes delivery experience, a focused first release covering matters and holds, custodians bound to directory identity with lifecycle interception, notices with acknowledgement and escalation, scope definition and a full audit trail runs $80,000 to $160,000 and ships in 12 to 18 weeks. That alone closes the most dangerous gap, which is the leaver whose mailbox disappears. A full platform adding the retention schedule engine with triggers and jurisdictions, repository connectors for preservation and disposition, the disposition review workflow with certificates, physical records handling and reporting for outside counsel runs $200,000 to $450,000 phased over 7 to 12 months.
Data migration runs 10 to 25 percent of build cost, and it is unusual here because most of it is legal work rather than engineering. Loading an existing retention schedule means checking each record class, jurisdiction, citation, retention period and trigger event, and your counsel has to sign off on the result. Loading historic holds means reconstructing who was on which hold when, which is often impossible and should instead be recorded honestly as a known gap.
Year two runs 15 to 20 percent of build cost annually, dominated by connector maintenance. Repositories change their application programming interfaces, your estate acquires new systems, and each acquisition brings a schedule you have to merge.
What pushes the number up: repository count, licensing constraints that make a technically simple preservation commercially expensive, multinational schedules where each jurisdiction adds classes and citations needing legal input, physical warehouse boxes if they are in scope, and any migration running in parallel with the build.
The four situations where building wins
Regulatory fit comes first and it is the strongest of the four. If you are a broker dealer under Securities and Exchange Commission Rule 17a-4 with its records preservation requirements, or carrying Sarbanes-Oxley Section 802 obligations on audit records, or holding safety and clinical records with their own statutory periods, the schedule is not a preference. It is a citation per record class per jurisdiction, and it has to be enforced by a system rather than described in a policy.
Scale economics is the repository count above. Six or more repositories means six connectors, and you pay for them once in a build or every year in a subscription that still does not cover the awkward three.
Third is the workflow that is genuinely your competitive advantage, and in this category it is the interlock. Evaluating every disposition candidate against active holds at record level, capturing approval from the record owner and legal, executing deletion through the connector and writing an immutable certificate of destruction is what turns twenty years of hoarding into routine disposition. Nobody deletes anything until they trust that interlock, so the interlock is the product.
Fourth is integration sprawl. Directory, mail, collaboration, file shares, at least one line of business system and a physical records vendor is six sources feeding one register. At that point you are the integrator whatever you buy.
How to decide in a week: run the spoliation drill
Pick a hold that has been live for at least a year. Ask your team to produce, by Friday, the full custodian population as it stood on three specific dates, the acknowledgement record for each person, the reminders sent, and evidence that preservation was actually in force in each named repository on each of those dates.
Note every answer that arrives as somebody's recollection. Note every repository where the honest answer is that nobody knows. Then check whether anyone on that list has left the company, and whether their data still exists. That single check has decided more of these projects than any feature comparison, and it takes an afternoon.
If the drill comes back clean, buy, document the procedure and move on. If it does not, run a paid discovery phase before committing a build budget. Ours produces a signed product requirements document covering the connector contract per repository, the schedule model, the interlock rules, permissions and acceptance criteria, and you keep it whether you build with us or hand it to another firm. Digital Heroes builds and runs its own products, including Section Vault, so the people designing your audit trail live with those decisions themselves. We hold India LLP, United States LLC and United Kingdom LTD entities so intellectual property assigns under your own law, you meet the named team before signing, and the record is checkable on Clutch, Trustpilot, Fiverr Vetted Pro and our D-U-N-S listing.
We are the wrong firm for you if you want an ediscovery platform. Collection, processing and review are a different problem with mature products, building your own is a poor idea, and we will tell you to integrate rather than compete there.
Book a 30-minute call with Digital Heroes and get a written plan and a fixed quote within 48 hours.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- In PMI's 2014 Pulse of the Profession report on requirements management, inaccurate requirements management is cited as a leading cause of project failure, with 47% of unsuccessful projects failing to meet goals due to poor requirements management. Source: Project Management Institute (PMI) (2014) →
- Retailers improving Core Web Vitals saw measurable gains: Vodafone improved LCP by 31% for 8% more sales, Lazada saw a 16.9% mobile conversion increase, and Cdiscount saw a 6% Black Friday revenue uplift. Source: web.dev (Google Chrome team) (2021) →
- In the Flexera 2025 State of ITAM report, respondents reported roughly 33% of SaaS spend is wasted, underscoring how paying for off-the-shelf seats and tiers that go unused erodes the supposed cost advantage of generic SaaS. Source: Flexera (2025) →
- SHRM's 2025 benchmarking data puts the average cost-per-hire at $5,475 for nonexecutive roles and $35,879 for executive roles - executive hires are on average nearly 7x more expensive than nonexecutive hires. Source: SHRM (Society for Human Resource Management) (2025) →
Frequently asked questions
How much does custom legal hold and records retention software cost?
A focused first release covering matters, holds, custodian binding to directory identity, notices with acknowledgement and a full audit trail runs $80,000 to $160,000. A full platform adding the retention schedule engine, repository connectors, disposition workflow and certificates runs $200,000 to $450,000. Repository count is the main driver, since the awkward connectors are always line of business systems rather than collaboration suites.
What happens to preservation when a custodian leaves the company?
In most organisations, their mailbox and account are deleted on schedule, because the leaver process has no visibility of the hold register. The fix is to bind custodians to directory identities and subscribe to lifecycle events, so a leaver flag blocks the deletion path and raises a preservation task before anything is touched. Ask any vendor this question first.
How do we prove a hold notice was received and understood?
Treat each notice as a versioned document, each issuance as a delivery record with a timestamp, each acknowledgement as an attestation captured against a verified identity, and each reminder as a scheduled event with defined escalation. Email alone proves a message was sent, not that a named person read it, understood the scope or was reminded when the scope later changed.
How long does it take to build a legal hold and retention platform?
Twelve to eighteen weeks for the hold and custodian release, and seven to twelve months for the full platform. The schedule risk is your retention schedule rather than the software: every record class needs a jurisdiction, a citation, a period and a trigger event confirmed by counsel, and that review runs at the pace of legal availability rather than development.
Who owns the audit trail and the code if an agency builds this?
You should own the repository, the infrastructure accounts, the data and the right to hire another firm, agreed in writing before kickoff. At Digital Heroes the client owns the code from the first commit. It matters more here than almost anywhere, because the audit trail this system produces will be relied on in litigation for years and must sit somewhere you control absolutely.
What is the difference between a legal hold system and an ediscovery platform?
A hold system governs preservation: who is under hold, what is in scope, whether preservation is actually in force, and when it is released. An ediscovery platform handles collection, processing, review and production once litigation is underway. They connect, they are not the same purchase, and building your own review platform is a poor use of money when mature products exist.
Can this handle physical records in a warehouse as well as digital ones?
Yes, and it should if boxes are in scope. Physical records carry a box level inventory, a location, a schedule entry and a destruction date executed by a vendor. The same interlock applies: a box cannot be destroyed while a hold covers its contents, and the destruction certificate is the evidence you produce when a regulator asks why a record no longer exists.
What happens if preservation cannot be technically enforced in a system?
The system must say so explicitly. An unsupported state with a recorded compensating control, such as a suspended purge job with the suspension logged, is defensible. A green tick that means nothing is worse than a known gap, because counsel will rely on it in a certification. Any developer comfortable showing false assurance should be disqualified on that answer alone.
Can we start with holds and add the retention schedule later?
Yes, and it is usually the right sequence. The exposure concentrates in holds, particularly the leaver interception, and that release is the smaller half of the project. Retention and disposition depend on trusting the hold data anyway, so nobody will authorise a first deletion until the hold side has run cleanly for a couple of quarters. Phase it deliberately.
We run four matters a year and everything is in Microsoft 365. Should we build?
No. Use the native preservation features, write the procedure down, and give one named person responsibility for issuing, tracking and releasing holds. Revisit the decision when business records move into a system Purview cannot reach, when you operate across jurisdictions with different schedules, or when counsel tells you your preservation cannot be demonstrated on request.
How do I vet a software development agency before signing a contract?
Ask to speak with two past clients whose projects resemble yours in size and industry, and ask exactly who will write your code, since some agencies sell senior faces and deliver junior or subcontracted hands. Demand a written specification with acceptance criteria before any fixed price, and check that their portfolio links to products that are actually live. An instant quote given without questions about your workflows is the clearest warning sign there is.
What happens to my software if the agency shuts down or we stop working together?
Nothing dramatic, if the engagement was set up correctly: the code sits in your repository, hosting runs on your cloud account, and a handover document explains how to deploy and operate the system. Any competent replacement team can then take over in days rather than months. If the agency controls the repo, the servers, or the domain, fix that now, because renegotiating access during a dispute is the most expensive place to discover the problem.
How do I make sure custom software is secure and compliant with rules like HIPAA?
Start with the baseline every business system should have: encryption in transit and at rest, role-based access control, and audit logs. If HIPAA applies, the hosting provider must sign a Business Associate Agreement, which AWS, Azure, and Google Cloud all offer, and access controls have to be designed in from day one, not bolted on. SOC 2 certifies a company's operating practices, not a codebase, so ask vendors what they have shipped in your regulated domain rather than which logos are on their website.
What should I prepare before contacting a software development agency?
A one-page brief beats a 40-page requirements document: the business problem in plain words, who will use the system, the 5 to 10 workflows it must handle, the tools it must connect to, and your budget range and deadline driver. You do not need wireframes, a specification, or technical vocabulary; producing those is the agency's job during discovery. Stating a budget range up front is the single best move, because it gets you honest scoping instead of a quote engineered to win the meeting.
How long does it take to build a custom web or mobile app from scratch?
Plan on 8 to 16 weeks for a focused first version and 4 to 9 months for a larger platform, which is the typical spread across Digital Heroes builds. The first 2 to 3 weeks go to discovery and design before any production code ships. The two things that stretch timelines most are integrations with legacy systems and slow feedback from your side, not developer speed.
Is it cheaper to customize Salesforce than to build a custom CRM from scratch?
If you use less than a third of what Salesforce does, a custom CRM is often cheaper by year three. Salesforce Enterprise lists at $165 per user per month, so 25 seats cost about $49,500 a year before admin and consultant fees, while a focused custom CRM runs $60,000 to $100,000 once plus 15 to 20% a year in maintenance. If you genuinely need Salesforce's ecosystem, reporting, and app marketplace, customizing it beats rebuilding it; the mistake is paying enterprise prices to use it as a glorified contact list.
Couldn't I just build my app in Bubble or another no-code tool instead of hiring an agency?
For validating an idea with real users, yes, and we tell clients that honestly. The walls come later: Bubble apps cannot be exported as code to run anywhere else, performance drops on complex data operations, and usage-based pricing climbs as you grow. A meaningful share of Digital Heroes custom builds are rebuilds of no-code MVPs that proved the business worked, which is the system operating as intended: validate cheap, then build the version that scales.
If an agency builds my software, who actually owns the code?
You should own everything, assigned in writing: the contract transfers full IP to you on final payment, the code lives in your GitHub organization, and hosting runs in cloud accounts you control. The red flag is a proposal that mentions the agency's proprietary platform or framework, which usually means you are renting, not buying. Digital Heroes structures every build this way precisely so a client can fire us and lose nothing but the relationship.
What does a $50,000 custom software budget actually buy?
One core workflow done properly: 10 to 15 screens, two or three user roles, a couple of integrations, an admin panel, and automated tests, delivered in roughly 12 to 14 weeks. What it does not buy is that workflow plus a mobile app plus AI features plus five more integrations. The discipline of picking the one workflow that matters is what separates $50,000 projects that ship from $50,000 projects that stall at 70% complete.
Who can build a custom software system?
Digital Heroes builds custom software systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other software companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.
Related guides
Published · Last updated .
