I'm a Ruby on Rails developer. I'd like to create a web application. I will let users get a payed subscription to use the product. So I will need a recurring billing system (e.g. via paypal).

But there is the fear to fail and make some bad mistakes, because I will handle money from other people.... regardless following the instructions of e.g. Ryan Bates on Railscasts how to implement such a recurring payment system.

What is your advice to overcome this fear of building such a product?

What are the risks I need to calculate when designing such a system?

closed as too broad by user40980, GlenH7, durron597, user22815, gnat Oct 24 '15 at 5:25

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


1) You're right to use a service to do the recurring payments for you so you don't have to worry about security. Your biggest risk is that you could expose payment data to malicious individuals. Make secure storage of the credit card data somebody else's problem.

2) Write really good tests. Don't stop at unit tests, move up to integration, functional and behavioral tests. It's not enough to test "testCardAccepted." You also need tests like "Given my card was processed successfully and a year has passed and I have not canceled Then I should see one charge of 9.99 on the test card account." and "Given my card was ... and the expiration date is in the past and there is one month to renewal Then I should see an e-mail asking to update the card information."

3) Do some analysis and design before you start. See if there's a well established library you can use to do the recurring payments from your merchant. Understand the problem really well and get a sense of what might be problem areas. I can't think of a good library, but check to see if the merchant has good quality sample code you can re-use.

4) Make sure you form an LLC or corp with its own, separate bank account for transactions with the merchant. Check to see if your local laws require you to carry a bond or other insurance, including business licensing.

that all the advice I have for you.

  • Thank you! That's a great answer and a great advice. I guess the point (4) will be the next problem to care about. – sn3ek Mar 3 '13 at 22:26

The fact that you use PayPal mitigates the risk from IT to legal and accounting departments. You don't have to process payments in a secure way: PayPal does. You don't have to safely store credit card numbers: PayPal does.

If something goes wrong, it's up to the accounting department to discuss the issue with the client, having PayPal recordings as a proof. In the worst case, the customer will actually pay, but your web application will fail to record (or magically forget) that PayPal processed the payment. In this case, accountants could simply have an override, letting them to indicate to the web app that the payment was effectively done.

Not the answer you're looking for? Browse other questions tagged or ask your own question.