How to Hire an Identity Governance and Access Certification Development Company
Rank your applications by risk, then ask three firms how they would integrate your three worst ones by name. Expect $100,000 to $200,000 for a first release covering the identity model, HR feed, top risk connectors, the campaign engine and revocation.
On this page
Rank your applications by risk, then ask three firms how they would integrate your three worst ones by name. Expect $100,000 to $200,000 for a first release covering the identity model, HR (Human Resources) feed, top risk connectors, the campaign engine and revocation. If your estate is essentially Microsoft or Okta, buy the native product and skip the build.
Commissioning identity governance software is like paying someone to inventory every key ever cut for a building where nobody kept the log. The locksmith can show you a beautiful register. What decides whether it is worth anything is the fire door on the loading bay that a contractor had rekeyed in 2019, and whether the person doing the inventory even knows it exists.
That is the shape of the buying problem. Every demo you sit through runs against systems with a standard connector, where identity data flows in cleanly and a campaign renders in seconds. It runs against none of the applications where your actual risk lives: the core system from the 1990s, the vendor hosted platform whose access is defined by a local administrator, the clinical or trading application whose supplier will not discuss its schema. Two thirds of your exposure sits there, and the part of the product that handles it is the part nobody demonstrates. The campaign engine is the cheap half. Getting trustworthy data into it is the expensive half, and buyers routinely price the wrong one.
What an identity governance development company actually does
The certification campaign is the visible artefact. Building it is a few weeks. Everything that determines whether the campaign proves anything sits underneath.
Start with the identity and entitlement data model: a person, their accounts across every system, the entitlements attached to each account, and a lineage back to the collection that produced the record. Then the HR feed, because joiner, mover and leaver events are the continuous control and a quarterly campaign is only a backstop. Then connectors, ranked by risk rather than by ease, with an honest handling path for systems where no automated route exists.
Then the part almost every implementation skips: making the reviewer's question answerable. Every entitlement needs a plain language description written by its application owner, a risk rating, a privileged flag, any segregation of duties conflicts it participates in, and a last used date. A row reading FIN_GL_JE_POST_ALL is not a question a manager with fourteen reports and a day job can answer, which is why campaigns come back at ninety eight percent approval. Finally, revocation has to be as cheap as approval, executed automatically where a write path exists, tracked to a named owner where it does not, and verified on the next collection cycle rather than assumed.
What it really costs in 2026
These bands come from Digital Heroes delivery experience on internal systems work, not a market study.
| Project tier | Cost | Timeline |
|---|---|---|
| Paid discovery: risk ranking and integration survey across your top applications | $15,000 to $30,000 | 3 to 4 weeks |
| First release: identity and entitlement model, HR feed, connectors for highest risk systems, campaign engine, revocation workflow | $100,000 to $200,000 | 14 to 20 weeks |
| Full build: long tail connectors, segregation of duties policy, mover and leaver automation, usage collection, privileged access, audit evidence | $280,000 to $650,000 | 9 to 18 months |
| Each additional connector to a system hostile to integration | $6,000 to $25,000 | 1 to 4 weeks each |
| Support and connector maintenance | 15 to 20 percent of build per year | Retainer |
Two line items vanish from nearly every quote. The first is entitlement description capture. Somebody has to sit with the application owner for the payroll system and write, in English, what each role permits and who should hold it. That is business time from people with other jobs, it is the single largest schedule risk in this category, and no engineering estimate contains it. Firms that have done this before will tell you so unprompted.
The second is usage data. Last used dates change reviewer behaviour more than any other field on the screen, and collecting them means pulling authentication events or application logs per system, which roughly doubles the integration work for every application. It is quietly dropped from proposals because dropping it makes the number look competitive, and its absence is precisely why campaigns stay theatre.
Signals of a strong partner
- They ask for your application inventory ranked by risk before quoting. Connector count and integration hostility dominate this budget, so a quote produced without that list is fiction.
- They propose an attested manual feed where nothing automated exists. The application owner uploads a signed extract on a schedule, the system records who and when, and the record visibly ages. That is honest engineering.
- They ask who will write entitlement descriptions. And when, and who chases the application owners who go quiet. A database column is easy. The process is the project.
- Revocation is verified, not assumed. Automatic de-provisioning where possible, a tracked task with an owner where not, and confirmation on the next collection that the entitlement is actually gone.
- Movers are an explicit event. A department, manager or job code change in the HR feed generates a targeted review routed to the new manager with the old one copied, on a deadline.
- They ask about legal entities and approval hierarchies. A group with several entities and different sign off rules per entity is a materially different build, and good firms establish that in the first hour.
- Ownership agreed before kickoff. Repository, cloud accounts and the entitlement data, with the right to hire anyone else to continue.
Red flags
- A per identity licence attached to something described as custom. If you are funding the build, you should not then rent it back by headcount. That structure means you never really own the system.
- Connectors quoted at one flat rate per application. A SCIM endpoint and a mainframe report an administrator runs by hand are not the same job, and averaging them means the hard ones get skimped.
- Nothing in the proposal about de-provisioning failures. A review producing revocation decisions nobody carries out is worse than no review, because it creates documented evidence that you knew.
- The campaign engine is presented as the product. That is the commodity. If the pitch never reaches entitlement semantics or usage data, they are selling you the spreadsheet you already have with better styling.
- They promise interface automation against a vendor hosted system with no caveats. It can be the right answer as a last resort, but only with a named owner and a plan for the day the supplier changes a screen.
Questions to ask on the first call
- Here are our three worst applications by name. Describe how you would collect entitlements from each.
- What do you do when an application has no API, no export and no willing vendor?
- Who writes the description for an entitlement like FIN_GL_JE_POST_ALL, and how is it kept current?
- How do we collect last used dates, and what does that add per application?
- What happens when de-provisioning fails silently on one system, and how do we find out?
- How is a mover detected from the HR feed, and who signs the resulting review?
- How do you surface orphaned accounts with no matching active employee?
- How does approval routing work when the reviewer sits in a different legal entity?
- Who owns the repository, the cloud accounts and the entitlement data, and from what date?
A simple way to decide
Buy a paid discovery phase before you buy a build. Three to four weeks, priced openly, ending in a written specification: your applications ranked by risk, an integration approach and cost band for each of the top twenty, the entitlement description process with named owners, the campaign and revocation design, and a fixed quote for the first release. Run that exercise with two firms rather than collecting five proposals, because the document is the deliverable and it is yours regardless of who builds.
Digital Heroes works specification first and runs its own products, including ShopScore, HeroCheckout and Section Vault, so the people choosing your architecture live with those decisions on their own revenue. More than 2,000 projects delivered, fifty plus people, Fiverr Vetted Pro, verifiable through D-U-N-S, Clutch and Trustpilot. If the honest answer for your estate is to buy Entra ID Governance instead, we will say so on the call.
Book a 30-minute call with Digital Heroes and get a written plan and a fixed quote within 48 hours.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- A study (led by Prof. Pak-Lok Poon, published in Frontiers of Computer Science, 2024) reviewing decades of spreadsheet-quality research found that about 94% of spreadsheets used in business decision-making contain errors, illustrating the hidden risk of manual spreadsheet workarounds that custom software is built to replace. Source: Central Queensland University / phys.org (Prof. Pak-Lok Poon et al.) (2024) →
- Almost half of all the activities people are paid almost $16 trillion in wages to do in the global economy have the potential to be automated by adapting currently demonstrated technologies. Source: McKinsey Global Institute (2017) →
- Only 22% of firms are 'future ready' having significantly transformed digitally; these companies show average revenue growth 17.3 percentage points and net margins 14.0 percentage points above their industry average. Source: MIT Center for Information Systems Research (MIT Sloan) (2022) →
- In an RCT, the no-show rate was 23.5% for patients receiving a text-message reminder versus 38.1% for the control group - a 14.6 percentage-point reduction (p = 0.04). Source: Clinical Pediatrics / PubMed Central (Lin et al.) (2016) →
Frequently asked questions
How much does it cost to hire an identity governance development company?
A paid discovery phase ranking applications by risk and surveying integration runs $15,000 to $30,000 over three to four weeks. A first release with the identity model, HR feed, top risk connectors, campaign engine and revocation runs $100,000 to $200,000 over 14 to 20 weeks. A full build adding the long tail of connectors, segregation of duties policy and usage collection runs $280,000 to $650,000 across 9 to 18 months.
Should we buy SailPoint or Saviynt rather than hire developers?
If your applications have good connector coverage and your approval structure is conventional, buy. Their campaign engines and role mining represent years of work you should not rebuild. The arithmetic shifts when most of your risk sits in applications you would integrate manually under any licence, because then a large subscription buys a campaign engine while you fund the connectors regardless. Ask both vendors to quote the same three difficult systems.
What is the biggest hidden cost in an access certification project?
Entitlement descriptions. Somebody has to sit with each application owner and write in plain language what every role permits and who should hold it, then keep that current. It is business time from people with other jobs, it does not appear in engineering estimates, and it is the reason campaigns slip. The second hidden cost is usage data, which roughly doubles integration work per application.
How do we handle applications with no connector at all?
Take them in order of hostility. Database backed applications can often be read directly with a read only account. Vendor hosted systems can usually produce a scheduled export if you ask their support team rather than their sales team. Mainframe systems normally have a report an administrator already runs by hand. Where nothing exists, use an attested manual feed that records who supplied the extract and ages visibly when stale.
Who owns the code and the entitlement data if we hire an agency?
You should own the repository, the cloud infrastructure accounts and all identity and entitlement data, with the unrestricted right to hire another firm, agreed in writing before kickoff. At Digital Heroes the client owns the code from the first commit. A system holding the map of who can do what across your whole organisation should never be rented from a supplier you cannot replace.
Who owns the code when an agency builds our internal tool?
You should, outright, with full IP transfer in the contract and the code delivered to a repository you control, such as your own GitHub organization. Digital Heroes transfers complete ownership on final payment as standard practice, and any agency that keeps the code or licenses it back to you is building a dependency you will pay for later. Confirm you also own the hosting, domain, and database accounts, since many of the vendor disputes Digital Heroes gets called into involve infrastructure registered under the agency's name.
What does an internal tool cost for a small business with 20 to 50 employees?
Plan on $5,000 to $15,000 for a focused tool that replaces one painful spreadsheet workflow, such as job scheduling, quoting, or PTO tracking. In Digital Heroes projects at this size, the sweet spot is one core workflow, two or three user roles, and a single integration, usually QuickBooks or Google Workspace. Quotes far below $5,000 usually mean a template with your logo on it rather than software built around your process.
How much does a custom internal tool cost to build?
Most custom internal tools cost $8,000 to $40,000 to build, based on Digital Heroes delivery data across 2,000+ client projects. A single-purpose tool like an approval dashboard or inventory tracker sits at the low end, while a multi-department platform with role-based access and several integrations pushes past $40,000. The three biggest cost drivers are the number of user roles, the number of systems the tool must connect to, and custom reporting requirements.
Can we start on Airtable or Retool now and move to custom software later?
Yes, and it is often the smartest sequence: run the workflow on Airtable or Retool for 6 to 12 months to learn what you actually need, then go custom once the process stabilizes. The no-code version becomes free requirements documentation, and its data exports cleanly into a custom database. The one risk is waiting too long, because teams stack automations and workarounds until migration becomes a project of its own, so set a concrete trigger in advance, such as hitting Airtable's 50,000-record Team plan cap.
Is a custom internal tool secure enough for HR records and financial data?
A properly built custom tool is generally safer for sensitive data than the shared spreadsheet it replaces, because you get role-based access, audit logs, encrypted storage, and the ability to cut one person's access instantly. Ask the agency specifically for encryption in transit and at rest, permissions down to the field level, and an audit trail showing who viewed or changed each record. If HIPAA, GDPR, or SOC 2 expectations from enterprise clients apply to you, raise it before the quote, because compliance features add real scope.
What should I prepare before contacting an agency about an internal tool?
Bring the spreadsheet or document you run the process on today, a list of everyone who touches the workflow and what each person does, and one sentence describing the outcome you want. You do not need wireframes or a technical spec; a 30-minute screen-share of the current process beats a 20-page requirements document. Decide your rough budget band and name a single internal decision-maker, because projects without one take noticeably longer in Digital Heroes experience.
How long does it take to build an internal tool from scratch?
A working first version typically ships in 4 to 8 weeks, and larger multi-module tools run 10 to 16 weeks. Across Digital Heroes internal tool projects the schedule splits into roughly one week of process mapping, 3 to 6 weeks of build, and 1 to 2 weeks of testing with your actual staff. The most common delay is not development but waiting on the client for sample data and workflow decisions, so name one internal owner before kickoff.
We run everything on spreadsheets and Airtable. How do we know it's time for custom software?
The reliable signals are re-typing the same data into multiple tools, one employee acting as human middleware between systems, and errors appearing in handoffs between teams. Hard limits force the issue too: Airtable's Team plan caps at 50,000 records per base, and Business costs $45 per seat per month, so a 20-person team pays about $10,800 a year for a tool it has already outgrown. When workarounds consume more hours than the tools save, the spreadsheet era is over.
Should I hire a freelancer or an agency for my software project?
A skilled freelancer is the right call for a single-discipline scope under roughly $15,000, like a website, a plugin, or one integration. Above that, projects need design, backend, testing, and project management at once, and a solo builder becomes the single point of failure: if they get sick or take a bigger client, your project simply stops. Agencies bill 20-40% more per hour but carry continuity, code review, and someone to escalate to, which is what you are actually buying.
Can we migrate years of data out of our current system into new custom software?
Almost always yes, through CSV exports or the vendor's API, and migration should be scoped as its own workstream with field mapping, a dry run, and a planned cutover window rather than an afterthought. The real time sink is rarely moving the data; it is cleaning it, since years of duplicates, free-text fields, and inconsistent formats surface all at once. Pull a full export from your current vendor before committing to anything new, because some SaaS plans restrict exports on lower tiers.
Is a freelancer or an agency better for building an internal tool?
A solid freelancer works for a single-workflow tool under roughly $10,000, if you accept that one person holds all the knowledge. An agency earns its premium once the tool spans departments or integrations, because you get a developer, a designer, and a project manager plus continuity when someone leaves or gets sick. The hidden freelancer cost appears 18 months later when you need changes and the original builder has moved on, a rescue situation Digital Heroes is hired for regularly.
Who can build a custom internal tools system?
Digital Heroes builds custom internal tools systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other internal tools companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.
Related guides
More from Lila.
Klaviyo & Email Lead · New-york · 7 posts on the site
Published · Last updated .
