Build it, or start from it?
A license looks expensive next to $0. But $0 is not the alternative: your own team building the same foundation is. Here is what that actually involves, and when building it yourself is the right call.
Last updated
The work you are comparing against
Not features you might want one day. This is the list of things enterprise customers assume are already there, and refuse to buy without.
- Authentication
- Password policy, lockout, email confirmation and reset, two-factor over email, SMS and authenticator apps, social logins, OpenID Connect, LDAP and Active Directory, ADFS, session timeout, active-session monitoring, login-attempt logging.
- Authorization
- A permission model that survives contact with real customers: roles, granular permissions, hierarchical organization units, user delegation, tenant and user impersonation, and permission-aware UI on every screen.
- Multi-tenancy
- Tenant isolation across every query, editions and feature gating, subscriptions with trials and renewals, Stripe and PayPal, invoicing, per-tenant configuration, branding and database strategy - single, per-tenant or hybrid.
- Operations
- Audit logging, entity change history, background jobs, real-time notifications, health checks, structured logging, caching, and the settings infrastructure that all of it reads from.
- The admin application
- Every screen behind the login that is not your product: users, roles, tenants, editions, subscriptions, languages, settings, audit logs, organization units - built three times if your team wants Angular, React and MVC.
- Keeping it alive
- A .NET major release every November, security advisories against the auth stack, framework and package upgrades, and the regression tests that let you take them without fear. This one never finishes.
Every line above is in ASP.NET Zero today and has been in production since 2013. See the full list if you want to check that claim before reading further.
There are four real answers, and three of them are not us
The typing is the short column. Proving it is right is the long one.
Our estimate, per area, for an experienced .NET developer who has built this before and works with an AI assistant. Substitute your own numbers; the shape of the table will not change. The assistant is why the first column is short. It does little for the second.
| Area | Writing it to a first working version, with an AI assistant | Proving it is right testing and hardening, our estimate | What you have to prove the part that does not show up in a demo |
|---|---|---|---|
| Authentication | 3 - 5 days | 3 - 5 weeks | Every path that is not "login succeeded": lockout, reset-token reuse, two-factor recovery, session invalidation on password change, the LDAP edge cases your first enterprise customer will find. |
| Authorization | 2 - 4 days | 2 - 4 weeks | That every API endpoint checks the same permission the UI hides behind, and keeps doing so as screens are added by people who were not there when the rule was made. |
| Multi-tenancy | 3 - 5 days | 4 - 8 weeks | That no query, join, report, background job or cache can cross a tenant boundary. The hardest thing on the page to test, and silent when it is wrong. |
| Operations | 3 - 5 days | 3 - 5 weeks | That audit and change history record who really acted, including under impersonation, and that jobs and notifications survive a restart and a deploy. |
| The admin application | 1 - 2 weeks per UI | 4 - 8 weeks per UI | Consistency: every screen, filter, export and permission check behaves the same way, in every language you ship, on every UI you support. |
| Keeping it alive | - | Every year, forever | That the .NET upgrade and the security patch broke nothing you cannot see. You need the regression suite before the day you need it. |
| About a developer-month of writing, then roughly 4 to 7 developer-months of proving it, before your product has a single feature of its own, for one UI - and then the last row forever. The assistant shortens the first number. The license buys the second; set it against your own loaded rate. | |||
Every row in the table is in ASP.NET Zero today, with the proving already paid for: 400+ automated tests ship in the solution, and every bug found by 10K+ customers since 2013 became a regression test.
The build cost is the part everyone estimates. The maintenance is the part that surprises them.
A foundation is not delivered once. It is the code most likely to be attacked, and the code most exposed to the platform underneath it.
- .NET ships a major release every November. Something in the auth stack moves almost every time.
- Security advisories land against identity and token handling on their own schedule, not yours.
- Every enterprise deal adds a requirement to it: SSO with their provider, their audit format, their retention rules.
- The people who wrote it move on. What they knew about it usually goes with them.
- None of this work is visible to a customer. It competes for the same engineers as the features that are.
On a licensed foundation this is somebody else's roadmap. ASP.NET Zero has shipped 100+ releases and has been maintained against every .NET version since 2013, with a documented upgrade path for each one.
The published numbers
Not our estimates: outcomes our customers put their names to. Each one links to the story it came from.
Set those against the license: $2,999 for a team of up to 3 developers, one time, source code included. Apply your own loaded day rate to the months and the arithmetic finishes itself.
Frequently asked questions
How long does it take to build an enterprise .NET application foundation?
Our estimate, for an experienced .NET developer working with an AI assistant: about a developer-month to write a first working version, then roughly 4 to 7 developer-months of testing and hardening, for one UI, before the product has a feature of its own. After that, it needs maintaining against every .NET release.
When should you build your own application foundation?
When the foundation is the product, when your requirements genuinely do not fit anyone else's model, or when you have a team with the time and a mandate to own it. You get exactly what you designed, and you carry it for as long as the product lives.
Does an AI coding assistant make building the foundation cheaper?
It makes the writing faster, not the proving. Claude Code or Cursor will produce a running auth stack and tenant filtering in a day, but an assistant does little to shorten the months of testing and hardening that show the code is correct, or the maintenance that follows.
What have ASP.NET Zero customers saved by not building their own foundation?
In their own published case studies, the City of Portland saved 6+ months of development and testing time, Zwapgrid reported 50% lower software development cost, and Workiom went from start to a launched SaaS MVP in 20 days.
What does it cost to license the foundation instead of building it?
$2,999 one time for a team of up to 3 developers: a perpetual license with the full source code, one year of updates, and no runtime fees or per-user cost. Set that against the developer-months of building and proving the foundation, at your own loaded rate.
Check it against your own requirements
The question left is how long the foundation would take your team, and whether those months are better spent on the part of your product nobody else can build.
- vs AI-generated boilerplate: why generating the foundation is not the same as verifying it
- vs free open-source templates: what starting from a free template or foundation leaves to you
- Everything included: the full feature list, so you can check it against your requirements
- Pricing: one-time license, perpetual, no runtime fees and no per-user cost
- Live demo: see the admin application before you decide anything
- Talk to an expert: 30 minutes, free, and we will tell you if it is not a fit
Still weighing it up? Look at it first.
Explore the live demo, or book 30 minutes with the team that maintains it.