Compliance & Security
Billing systems hold sensitive customer, financial, and operational data. Treat Floatless as a production system of record.
This page describes operational practices for secure billing management. Your legal, finance, and security teams should define the final policy for your organization.
Access control
Use least-privilege access:
| Role | Typical access |
|---|---|
| Admin or owner | Workspace settings, integrations, team management, API keys. |
| Finance | Invoices, payments, credits, reports, exports. |
| Support | Customer billing state, invoices, payment status, portal links. |
| Developer | API keys, webhooks, integration testing, logs. |
| Read-only reviewer | Reports and audit context without write access. |
Review access at onboarding, role changes, and offboarding.
Auditability
Important billing actions should leave an audit trail:
- Customer creation and changes.
- Product and price changes.
- Subscription creation, amendment, cancellation, and suspension.
- Invoice posting and correction.
- Payment, refund, and credit memo actions.
- API key and webhook changes.
- Bill run execution.
Audit notes should explain why a manual action happened, not just what changed.
API key security
- Create separate keys for each production integration.
- Store keys in a secrets manager.
- Rotate keys after employee or vendor access changes.
- Never place live keys in browser code, mobile apps, screenshots, docs, or logs.
- Delete unused keys.
Webhook security
- Use HTTPS endpoints.
- Verify webhook secrets or signatures when available.
- Dedupe by event ID.
- Keep handler logs free of secrets.
- Return success only after durable processing or queueing.
Data handling
- Keep test data separate from live reporting.
- Do not send customer financial data to unapproved tools.
- Limit exported files to users who need them.
- Remove old exports from local machines and shared drives.
- Avoid using real customer data in demos.
Governance checklist
- Team access reviewed monthly or quarterly.
- Production API keys have named owners.
- Webhook endpoints have owners and retry monitoring.
- Manual credits and refunds require reason notes.
- Bill run execution is limited to trained operators.
- Security incidents have an escalation path.