Payments and billing

Introduction

If the SaaS product takes payments, billing becomes part of the data, security and support surface. The simplest early position is to avoid card-data handling wherever possible.

Payments can look like a commercial detail, but they quickly affect architecture and governance. Billing data is personal data. Payment provider dashboards need access control. Webhooks become an integration surface. Failed payments create support processes. Invoices create retention requirements.

Early stance

For most early SaaS products, use a payment provider and avoid storing card data. The goal is to avoid unnecessary PCI scope and keep the product focused on its core value.

If the Pilot is free or manually invoiced, payments can be deferred. That should still be a recorded decision, because the product may need billing concepts later: customer, plan, entitlement, invoice, renewal, cancellation and account status.

Detailed decision considerations

• Use a payment provider rather than storing card data.
• Avoid PCI scope where possible.
• Treat billing data as personal data.
• Invoice retention.
• Access to payment dashboards.
• Webhook security.
• Who can issue refunds or credits.
• How failed payments affect access.
• Whether billing is self-serve or manually managed.
• Whether pricing plans affect product authorisation.

Security considerations

Payment webhooks should be treated as security-sensitive. They may change customer status, entitlements or access. Verify signatures, log events carefully without leaking payment data, and make webhook processing idempotent.

Access to the payment provider should use named accounts, MFA and least privilege. Finance access and engineering access are not the same thing.

How this evolves as the company grows

• At Pilot, payments may be absent, but pricing and billing assumptions should not contradict the intended operating model.

• Before Production, payment providers, invoicing, support, failed payments, refunds and data retention need clear ownership.

• At Production, billing becomes part of customer trust, data protection, support and unit economics.

• As the company scales, payment and billing processes should feed customer onboarding, revenue reporting and risk review.

What an agent should look for

• What customer and payment data is created?

• Who handles billing failures and refunds?

• How does billing affect support and retention?

What good looks like

The company can explain the decision, show the evidence behind it and identify the next point where the control needs to mature.