Build vs Buy Family Office Reporting Without Vendor Lock-in

A family with €20–150 million, four or five banks and a dozen entities has outgrown a family office run on Excel and email. It needs consolidated reporting, one report of everything it owns valued on the same date, that someone other than the founder can trust. A vendor offers a three- or five-year licence; a developer quotes a custom build. Both say the family will “own its data”.

That promise does not settle build vs buy for family office reporting. For most families in this range the answer is a hybrid: rent the custodian feeds, own the data model and write the exit into the contract. This guide shows why, from the family’s side: what the family can take with it, how fast, at what cost, and who keeps the model running after go-live. PWA receives no fee from any vendor and builds no software. PWA does not manage money, hold mandates, take commissions or give regulated investment, tax or legal advice.

Should a family office build or buy its reporting and data platform, and how do we avoid vendor lock-in, keep ownership of our data and keep an exit?

At €20–150 million, buy the aggregation and own the data model. Custodian feeds are cheaper to rent than to build. What you keep is the entity map, the full transaction history and the valuation rules, in an export you test every year, with switching, data-return and erasure terms written into the contract before you sign.

Both studies are weighted to the United States, and neither measures Europe directly. In the RBC and Campden Wealth survey, manual processes and over-reliance on spreadsheets were the operational risks family offices cited most often. What replaces the spreadsheet, and on what contract, is the decision this guide is about.

Build vs buy family office software: three options, not two

The choice is usually framed as build or buy. The third option, buy the aggregation and own the data model, is the one to price first.

A build is rarely about screens. Dashboards are the cheapest part of a reporting system. The work sits underneath:

• Custodian connections. Each custodian, the bank that holds the assets, delivers positions and transactions in its own format, by SWIFT message, file or PDF statement, and changes that format on its own schedule.
• Statement parsing. Banks that send no feed still send statements, and someone has to turn them into transactions.
• Private markets. Capital calls, distributions and quarterly valuations arrive as PDFs from each fund administrator.
• The entity and ownership model. Which holding owns which account, at what percentage, since when.
• Valuation policy. How unlisted shares, property and fund interests are valued, and how often.
• Performance calculation. A documented method, applied the same way every month.
• Access control and hosting. Who sees which entity, where the data sits, who reviews security.
• A named maintainer. The person who fixes all of the above when it breaks.

The last line is where builds fail. If one developer wrote the parsers and holds the knowledge, the family has a key-person risk in its reporting. When that developer takes another job, the system keeps running until the first bank changes a format, and then it stops.

What a feed is, and the point at which a platform pays for itself, are covered in consolidated reporting across multiple banks. If the answer is to buy, family office software sets out what each vendor states about feeds, hosting and price. This guide covers the decision before that shortlist, and the contract after it.

Where vendor lock-in hides in family office reporting

Vendor lock-in is the point at which leaving a supplier costs more, in money, time or risk, than staying with a service that no longer fits. In a SaaS reporting platform it rarely comes from the licence term. It comes from six places, and each has a test the family can run before signing.

1. The data model. The entity hierarchy exists only in the vendor’s schema, and no other system can read it. Test: ask for the full entity hierarchy, with ownership percentages and effective dates, as a file a different system could load.
2. History. Current positions export; the full transaction history does not, or only as report output. Test: export every transaction for one account since inception and check that the opening balance plus the transactions equals today’s position.
3. Derived numbers. Performance, look-through exposure and private-fund returns are calculated inside the platform and cannot be reproduced outside it. Test: ask whether the export carries the inputs to recompute them, and whether the method is documented.
4. Documents and extracted data. Statements, capital call notices and the fields the platform reads from them, including fields extracted by AI, are linked to transactions. Test: check that the export carries the documents and the link between each document and the transaction it produced.
5. People. How each account is mapped, how each asset is classified, and the fixes for each bank’s quirks often live in the vendor’s onboarding team. Test: ask for the mapping to be documented and delivered to the family.
6. Price. Once switching is expensive, the renewal increase follows. Test: look for a cap on renewal increases in the contract, not in the proposal.

None implies bad faith; each is the normal result of a platform doing its job. The point is to know, before signing, which of them the contract leaves open.

Data ownership is not data control

An ownership clause is the easy box to tick. Control is what matters when the family wants to leave, and it has three parts: custody (where the data sits and who can access it), completeness (whether the export carries everything the family needs to rebuild its history) and the right to recompute (whether the family can produce the same performance figures elsewhere).

FundCount, a vendor, frames data ownership in three dimensions, legal ownership, physical control and functional portability, and suggests asking a vendor to show what a complete data export looks like. That test is worth running whichever vendor is on the shortlist.

Two newer questions sit on top. First, derived data: whether calculated performance, classifications and data extracted from documents belong to the family or to the vendor. Second, model training: whether the vendor may use the family’s data, in any form, to train models or build benchmarks. Both belong in the contract, and both are questions for the family’s lawyer.

What the EU Data Act already gives you

The EU Data Act, Regulation (EU) 2023/2854, has applied since 12 September 2025. Its Chapter VI governs switching between data processing services. Commentators read it as covering SaaS as well as infrastructure and platform services, though complex software has to be assessed case by case. It applies to providers wherever they are established, when they serve customers in the Union.

For a reporting platform in scope, the contract must contain at least the following.

Three limits matter for a family.

• Custom builds. Article 31(1) exempts services whose main features are custom-built for one customer and not offered at broad commercial scale from Article 23(d), Article 29 and Article 30(1) and (3). A system a developer built and hosts for one family is likely to be such a service, so the zero-charge rule does not protect it. Article 31(3) requires the provider to say, before signing, which obligations do not apply.
• Who signs. The Act protects customers in the Union. A contract signed by a holding company in the UAE, Switzerland or another non-EU jurisdiction may sit outside it. Which entity signs the licence is a question for the family’s lawyer, not an afterthought.
• Fixed terms. Whether the switching rules let a family leave a fixed-term contract early, and at what penalty, is also a question for the lawyer. The Act requires those penalties to be disclosed before signing; it does not make every penalty disappear.

The rules may also narrow. The European Commission’s Digital Omnibus proposal of 19 November 2025, procedure 2025/0360(COD), would add targeted exemptions from the switching rules for custom-made services and for certain SME and small mid-cap providers under legacy contracts. As of 20 October 2026, the European Parliament’s Legislative Observatory shows the file as “Awaiting committee decision”: it is a proposal, not law. If it is adopted as proposed, a smaller vendor’s existing contracts could fall outside parts of Chapter VI. Ask the vendor whether it would qualify, and write the exit terms into the contract either way.

Why GDPR portability is not your exit

Article 20 of the GDPR gives an individual the right to receive personal data concerning them, which they provided to a controller, in a “structured, commonly used and machine-readable format”, where processing is based on consent or a contract and carried out by automated means. That is a right of a person, over data about that person. It does not reach the holding company’s ledger, the entity hierarchy or a fund’s valuation history. GDPR portability is useful; it is not an exit plan. Hosting regions and GDPR transfers are covered in the family office software guide.

Contract clauses that keep an exit

Questions to put to your lawyer before signing; PWA does not give legal advice. The table lists what to ask and the answer that should prompt a second look.

The same questions apply to a build. A development contract needs its own answers on who owns the code, who may reuse it for other clients, what documentation is delivered, and what happens when the developer stops working on it.

Software escrow: when it helps

Source-code escrow is an arrangement in which a developer deposits its source code, and ideally the instructions to build and run it, with an independent escrow agent. The code is released to the licensee if agreed events occur, typically the developer’s insolvency or its failure to maintain the software.

For a build or an on-premises licence, escrow is worth asking about. Ask what triggers release, whether anyone checks that the deposit actually builds, how often it is updated and who pays. For a SaaS reporting platform, code alone is of little use: without the vendor’s infrastructure, feeds and team, the family cannot run it. What protects the family there is a current, complete data export it has already tested.

Total cost over five years: the build vs buy matrix

A build vs buy analysis is only as good as its inputs, and the inputs belong to the family: its quotes, its banks, its hours. The worksheet below sets out the lines. PWA puts no figures in it.

One line can be filled from a public price. Asora publishes a subscription of $15,600 a year for a family with $50–100 million of net worth, billed annually, plus a one-time implementation fee of 25% of the annual subscription, $3,900 on that quote. At a flat price, five years of licence and implementation come to $81,900, before any renewal increase, add-on, internal hour or exit. That figure is the vendor’s published price, not a PWA estimate, and it is the first line of the worksheet, not the answer.

Fill in the maintainer line first. A build needs a named person, every year, to keep the feeds and the model working; a purchase needs one on the family’s side for what no platform reconciles on its own. If that line is blank, the totals mean little.

The hybrid: buy the aggregation, own the data model

The hybrid is a family office technology stack in two layers. The platform does what platforms do well: receives custodian feeds, aggregates, reconciles and produces reports. The family keeps, in a store it controls, the part that defines its wealth:

• The entity register, with ownership percentages and effective dates.
• The asset classification, so that every platform the family ever uses reports on the same categories.
• The valuation policy: how unlisted holdings, property and fund interests are valued, and when.
• The monthly reconciled snapshot: positions and transactions as at each month-end, as signed off.

The store does not need to be elaborate. A database in a family-owned cloud account works; so does a versioned set of files, if someone owns it. It is fed from the platform’s API or export. Addepar, for example, documents a Jobs API for asynchronous large data exports to a data warehouse or repository. Whatever the platform, the test is the same: can the family’s store be refreshed every month without asking anyone’s permission?

The classification and valuation rules are decisions, not software settings. They belong to the family’s investment and wealth architecture, written once and applied to every platform. Running the model month to month, chasing missing statements and signing off the snapshot, is family office administration work.

The hybrid wins when the family expects to use several banks or platforms over a decade, when a succession horizon means the history has to survive a generation, or when the advisor or office that runs reporting today may not run it tomorrow. In the Bank of America study, offices used just under two wealth management platforms on average, and better platform integration was their top technology request. A family-owned model is what makes two platforms, or a change of platform, a manageable event.

It does not win for one bank and a handful of entities. There, a platform alone, or a well-kept spreadsheet, is enough. The family office software guide sets out when a spreadsheet is still enough.

An exit plan you test every year

A software exit plan is only real if it has been run. Once a year, before the renewal notice date:

1. Request the full export. Every category the contract lists, not a sample.
2. Load it outside the platform. Into the family’s own store, or into a plain database.
3. Reconcile one month. Rebuild one month-end total from the export and compare it with the platform’s own report for the same date.
4. Check what survived. Full transaction history, the entity hierarchy with ownership percentages, valuation history, and documents with their links.
5. File the result with the renewal date. If the export failed any check, raise it before the renewal, while the family still has room to negotiate.

The failures to look for are a missing field, a history that starts at go-live, or documents that export without their links. Each is cheaper to fix in year one than at the exit. For what a family’s reporting looks like before any of this exists, see a founder with four banks and no single view.

If the decision is close, or the contract is already on the table, the fastest first step is a Wealth Operations Review: an independent read of the options, the contract terms and the five-year cost before anything is signed.

Questions we hear

What is vendor lock-in in family office reporting?

Vendor lock-in is when leaving a reporting platform costs more than staying, even when the service no longer fits. In family office reporting it rarely comes from the licence. It comes from an entity model only the vendor’s schema understands, a history that does not export, performance figures that cannot be recomputed elsewhere, and mappings only the vendor’s team knows.

Who owns the data in a family office reporting platform?

The contract decides, and an ownership clause is the easy part to obtain. What matters is control: where the data sits, who can access it, whether the export includes full transaction history, entity ownership and valuation history, and whether the family may recompute performance elsewhere. Ask for derived and document-extracted data to be covered too.

Can a family office build its own reporting system?

It can, but the screens are the small part. A build has to receive custodian feeds, parse statements, capture capital calls and fund valuations, model entities and ownership, calculate performance and control access. Then someone must keep all of it working when a bank changes a format. If that someone is one developer, the build carries key-person risk.

Does the EU Data Act let a family switch reporting provider?

Largely yes, since 12 September 2025, for a customer in the EU. The contract must allow switching on no more than two months’ notice, a transition of up to 30 days, at least 30 days to retrieve data, and erasure. Switching charges end on 12 January 2027. Custom-built services are exempt from the charge rules.

What should a reporting software contract say about leaving?

These are questions for your lawyer, not legal advice. Ask whether the contract lists every exportable data category, sets the export format and cost, gives API access without paid professional services, caps renewal increases, provides termination assistance, covers the vendor’s sale or insolvency, names sub-processors, and ends with a dated data return and an erasure certificate.

Does a family office need software escrow?

Mainly for a build or an on-premises licence. Source-code escrow deposits the code with a third party and releases it if the developer fails, for example on insolvency. For a SaaS platform, code without the vendor’s infrastructure is of little use. What protects the family there is a current, complete data export it has tested.

How do we compare the cost of building and buying over five years?

Put both options on one worksheet with the family’s own figures: licence fees for five years with the contracted renewal increase, per-entity or per-custodian fees, implementation, internal hours at the family’s own rate, and for a build, development, hosting, feed upkeep and a named maintainer each year. Add one exit to both columns. Test the maintainer line hardest.

Sources

All pages opened and checked on 20 October 2026. Vendor pages are quoted as the vendor states them; nothing here is a PWA estimate.

• European Union, Regulation (EU) 2023/2854 on harmonised rules on fair access to and use of data (Data Act), OJ L, 2023/2854, 22.12.2023. Supports: scope over providers serving customers in the Union (Art. 1(3)); application from 12 September 2025 (Art. 50(2)); the switching contract terms in Art. 25(2)(a), (b), (d), (e), (g), (h) and Art. 25(4) (30 calendar days, two months, 14 working days, seven months, at least 30 days, erasure); switching charges in Art. 29(1)–(4) (reduced charges from 11 January 2024 to 12 January 2027, none from 12 January 2027, pre-contract disclosure of early termination penalties); the custom-built exemption in Art. 31(1) and (3). Official text: eur-lex.europa.eu; publication record: op.europa.eu. Arts. 1, 25, 29, 31 and 50 read in the Official Journal text published by the EU Publications Office, publications.europa.eu.
• Maples Group, “The EU Data Act’s switching framework: a practical overview”, 17 April 2026. Supports: switching rules read as covering IaaS, PaaS and SaaS, with complex software assessed case by case; the Digital Omnibus custom-made exemption for non-IaaS contracts concluded before 12 September 2025 and a lighter regime for SME and small mid-cap providers (as proposed). maples.com
• European Parliament, Legislative Observatory, procedure 2025/0360(COD), “Simplification of the digital legislative framework – Digital Omnibus (Omnibus VII)”. Supports: Commission proposal COM(2025)0837 of 19 November 2025; status “Awaiting committee decision” on 20 October 2026; summary wording “targeted exemptions for custom-made services and certain SME/SMC providers under legacy contracts”. oeil.europarl.europa.eu · document summary
• Regulation (EU) 2016/679 (GDPR), Article 20, right to data portability. Supports: personal data concerning the data subject, provided to a controller, in a “structured, commonly used and machine-readable format”, where processing is based on consent or contract and carried out by automated means. gdpr-info.eu
• RBC Wealth Management, “2025 RBC and Campden Wealth report: North American family offices adapt to uncertainty and embrace AI innovation”, 16 October 2025. Supports: 69% of family offices have adopted automated investment reporting systems, up from 46% the previous year; manual processes and over-reliance on spreadsheets most often cited as operational risks; 317 responses worldwide, 141 from North America; survey conducted April–August 2025. rbcwealthmanagement.com
• Bank of America, “Family Office Study” (Family Office Report 2025). Supports: 44% of family offices face technology challenges; just under two wealth management platforms used on average; better platform integration the top technology request; 335 US family office decision-makers, offices with at least $25 million in assets, fielded May–June 2025. ml.com
• Asora, pricing page. Supports: brackets from $30M of net worth; $15,600 a year ($1,300 a month, billed annually) for $50–100M; one-time implementation fee of 25% of the annual subscription ($3,900 on that quote). asora.com
• Addepar Developers, “Use cases”. Supports: the Jobs API for asynchronous large data exports to a data warehouse or repository. developers.addepar.com
• FundCount, Don Harder, “Who owns and controls your data?”, 2026 (page undated). Supports: the three dimensions of legal ownership, physical control and functional portability; the advice to ask a vendor to show a complete data export. fundcount.com

---

Pedro Souto is the founder of PWA — Private Wealth Advisory. He works with UHNW founders, families, and single-family offices to build an independent operating layer around complex wealth — combining markets, analytics, technology, and governance to turn fragmented advice into one coherent picture, and to make someone, finally, responsible for the whole of it.