If you feel it's worth the continual development effort then you do it. I would think that when you start thinking your first application requires a second app

If you feel it's worth the continual development effort then you do it. I would think that when you start thinking your first application requires a second application (that you have to build yourself) just to efficiently exist, you should be taking a good solid look at the viability of your idea. In Blippy's case they probably had to write their own Case in point I suppose. PCI compliance isn't something a startup should be looking to saddle themselves with, in my mind. Once you're established and can analyze whether you want to internalize an outsourced function, it's on the table with everything else I suppose.