SaaS billing: Stripe subscriptions, taxes and dunning

Where does the money actually flow?

Before any code, decide which legal entity charges the customer. This is a business and tax question, not a technical one, and it changes everything downstream.

The common shape for a product built in Brazil and sold to US customers is a US entity, often a Delaware company set up through a service like Stripe Atlas, that holds the Stripe account, charges customers in dollars, and pays the Brazilian company for development. US customers see a US company on their statement, sales tax is handled in one jurisdiction, and the payment provider is operating in its home market.

The alternative is charging from a Brazilian entity. Stripe operates in Brazil, and a Brazilian account settles in reais, so a US customer paying in dollars is going through a currency conversion and a cross-border charge on every renewal. It works for early revenue; it gets uncomfortable as volume grows, and it makes your accountant's life harder in both countries. Talk to an accountant who knows both sides before choosing, and treat this article as the engineering half of that conversation.

How should subscriptions be modeled in Stripe?

Stripe's subscription model has four objects that matter: a Customer (one per tenant of your SaaS), Products (what you sell), Prices (how much and how often) and Subscriptions (a customer paying a price on a schedule). Almost every billing mistake we are asked to fix comes from reinventing one of these four in the application database and then trying to keep the two copies in sync.

The pattern that survives is simple. Your database stores the Stripe customer identifier on the tenant record and the Stripe subscription identifier with its current status. Stripe owns the truth about plans, prices, trials, proration and invoices. Your application asks one question on every request: is this tenant's subscription in a status that grants access? Everything else, including the pricing page, reads from Stripe.

For the checkout itself, use Stripe Checkout and the hosted customer portal in the first release. They handle card entry, 3D Secure, plan changes and cancellations without you writing a single form, and they are updated when regulations change. A custom checkout is a reasonable phase-two project once you know which parts of the hosted one actually cost you conversions.

Which webhooks matter, and how do you not lose them?

A subscription changes state without anyone clicking anything in your product: a renewal succeeds at 3am, a card fails, a trial ends, a dispute opens. Stripe tells you through webhooks, and your database has to reflect those events or your customers will be granted or denied access wrongly.

The events a SaaS cannot ignore are the ones that change access: subscription created, updated and deleted, invoice paid and invoice payment failed, and the checkout session completed event that ties a new subscription to a tenant. Each handler should be idempotent, meaning that receiving the same event twice does no harm, because Stripe retries deliveries and you will get duplicates.

Two engineering rules that prevent most incidents. First, verify the webhook signature on every request and reject anything that fails; an unsigned endpoint is an open door to granting yourself a free plan. Second, store every received event before processing it, so that a bug in a handler can be replayed after the fix rather than lost. The twelve questions we suggest asking a vendor include walking through a failed payment for exactly this reason: a team that has done it can describe these events by name.

What about sales tax and VAT?

Since the Supreme Court's 2018 decision in South Dakota v. Wayfair, a US state can require a seller with no physical presence to collect sales tax once it crosses that state's economic threshold, and many states now tax SaaS. The rules differ by state, some tax software subscriptions and some do not, and the thresholds are in dollars of sales or number of transactions. A SaaS selling nationwide will eventually have obligations in several states.

Stripe Tax can calculate the right tax on each invoice based on the customer's address and your registrations, and it can tell you when you are approaching a threshold in a new state. What it does not do is register you in that state or file the returns. Those remain your job or your accountant's, and the amount of it grows with revenue. Budget for a tax service or a firm from the first year rather than discovering the problem in an audit.

For customers outside the US, collect a tax identifier at checkout for businesses, so that invoices show it and reverse-charge rules can apply where they exist. Stripe stores customer tax IDs and prints them on invoices, which saves a support ticket per European customer per month.

What is dunning and how much does it matter?

Dunning is the set of things that happen after a renewal fails: retrying the card on a schedule, emailing the customer to update it, and eventually downgrading or cancelling. It matters because cards expire, get replaced after fraud and hit limits, and a subscription business that does nothing about failed renewals is quietly losing customers who never intended to leave.

Stripe's Smart Retries pick retry times based on when a charge is most likely to succeed, and Stripe's revenue recovery features add the emails and a hosted page where the customer updates the card. Network card updaters, which receive replacement card details from the networks, are part of the same machinery. We deliberately do not quote a recovery percentage here: Stripe publishes its own figures and they depend on your customer base. What we can say is that turning these on is configuration, not code, and that not turning them on is the most common billing mistake we see in products that arrive at our door.

What your application has to do is respond correctly to the states: keep access during the retry window, show a clear banner asking for a new card, and downgrade only when Stripe says the subscription is past due or cancelled. Cutting access on the first failed attempt is how you turn a card expiry into a churned customer.

What changes if you also sell in Brazil?

Brazilian customers pay differently. Pix, the instant payment system run by the Banco Central do Brasil, is the most used payment method in the country, settles in seconds and costs the merchant a fraction of a card fee. Boleto, a bank slip paid at any bank or app, is still common for business customers. Card subscriptions work, but the customer base expects the other two, and a SaaS that offers only card leaves money on the table.

Recurring Pix arrived in June 2025 as Pix Automático, which lets a customer authorize a merchant to pull recurring charges from their account, the way a direct debit does. It is the first time subscriptions in Brazil have had a native rail that does not depend on a card, and it is worth supporting for any Brazilian plan.

In practice this means a second processor for the Brazilian side. Mercado Pago's subscriptions API covers card recurrence and Pix, and Brazilian gateways cover Pix Automático and boleto with their own webhook models. The engineering consequence is that your access logic has to be provider-agnostic: a tenant's subscription record should say which provider it lives on and what its normalized status is, so the rest of the product never asks whether this customer is on Stripe or on Pix.

What we have built, and what we would build for you

Bias declared: we sell this. VTA built its own payment gateway, with KYC, payouts, checkout and a webhook API, and we maintain integrations in production with Stripe, Mercado Pago, BuckPay, Cakto and Paradise. That is where the opinions above come from, including the ones about idempotent handlers and storing events before processing them, which we learned the expensive way.

For a SaaS built in Brazil and sold in the US, we would build Stripe Billing with Checkout and the portal, webhooks stored and replayable, Stripe Tax on from the first invoice, and a provider-agnostic subscription record so that a Brazilian rail can be added later without touching access logic. If that is the shape of your product, the payment gateway integration page and the SaaS development page describe the work. For what the whole build tends to cost, we published public numbers.

The detail on the work itself

• Payment gateway integration →

  Stripe, Mercado Pago and Pix wired the way this article describes, with reconciliation.

• SaaS development →

  The rest of the product around the billing state machine.

Frequently asked questions

Keep reading

• Multi-tenant SaaS architecture explained for founders →

  What multi-tenant means, the three ways to separate customer data, how row-level security works in Postgres, and the decisions that are expensive to reverse.

• SaaS development cost in 2026: what US startups actually pay →

  Public price bands for building a SaaS product, the recurring costs nobody puts in the quote, and the five decisions that move a build from five figures to six.

• How to choose a SaaS development company: 12 questions →

  Twelve questions to ask every SaaS development company you shortlist, with the weak answer and the strong answer to each, so proposals stop looking identical.