Compliance & Security
Billing systems hold sensitive customer, financial, and operational data. Treat Floatless as a production system of record.
This page describes operational practices for secure billing management. Your legal, finance, and security teams should define the final policy for your organization.
Access control
Use least-privilege access:
| Role | Typical access |
|---|---|
| Admin or owner | Workspace settings, integrations, team management, API keys. |
| Finance | Invoices, payments, credits, reports, exports. |
| Support | Customer billing state, invoices, payment status, portal links. |
| Developer | API keys, webhooks, integration testing, logs. |
| Read-only reviewer | Reports and audit context without write access. |
Review access at onboarding, role changes, and offboarding.
Auditability
Important billing actions should leave an audit trail:
- Customer creation and changes.
- Product and price changes.
- Subscription creation, amendment, cancellation, and suspension.
- Invoice posting and correction.
- Payment, refund, and credit memo actions.
- API key and webhook changes.
- Bill run execution.
Audit notes should explain why a manual action happened, not just what changed.
API key security
- Create separate keys for each production integration.
- Store keys in a secrets manager.
- Rotate keys after employee or vendor access changes.
- Never place live keys in browser code, mobile apps, screenshots, docs, or logs.
- Delete unused keys.
Webhook security
- Use HTTPS endpoints.
- Verify webhook secrets or signatures when available.
- Dedupe by event ID.
- Keep handler logs free of secrets.
- Return success only after durable processing or queueing.
Data handling
- Keep test data separate from live reporting.
- Do not send customer financial data to unapproved tools.
- Limit exported files to users who need them.
- Remove old exports from local machines and shared drives.
- Avoid using real customer data in demos.
Governance checklist
- Team access reviewed monthly or quarterly.
- Production API keys have named owners.
- Webhook endpoints have owners and retry monitoring.
- Manual credits and refunds require reason notes.
- Bill run execution is limited to trained operators.
- Security incidents have an escalation path.
Sales-tax compliance (Canada & US)
Floatless helps you issue statutorily complete invoices in both countries.
Tax registrations. Add your registration numbers under Settings → Tax Registrations: CRA GST/HST (123456789 RT0001), Revenu Québec QST/TVQ (1234567890 TQ0001), provincial PST, or US state seller's permits. Registered numbers are printed in the invoice "From" block and drive compliance checks.
Invoice content checks. The invoice compliance validator flags statutory issues before you send: CRA information tiers ($100/$500 thresholds — registration number, buyer name, description, payment terms), Revenu Québec rules (QST number present; GST 5% and QST 9.975% as separate lines, never merged), HST shown as a single combined line (never split into federal/provincial parts), and US state registration expectations when you charge state sales tax.
Destination tax lookup. A date-aware baseline engine resolves statutory tax lines by customer province/state — including the Nova Scotia HST increase to 14% effective April 1, 2025. US figures are state-level baselines for awareness; confirm taxability with your advisor or a tax engine.
US economic nexus. The nexus check aggregates trailing-12-month US sales by customer state and flags states crossing post-Wayfair thresholds ($100k sales or 200 transactions; $500k for CA/TX/NY) so you can register before collecting.
Record retention. Canadian businesses generally must keep records for six years from the end of the relevant tax year (CRA); US federal limitation periods run 3–7 years. Keep invoices and payment records exported and archived accordingly.
Related docs
CASL-safe dunning (email + SMS escalation)
The dunning engine escalates email → SMS when the policy enables send_sms
and the customer has a phone number. SMS uses the same CASL consent gate and
the same transactional-first bilingual copy rules as email. A Twilio provider
is auto-selected when credentials are configured; otherwise SMS logs only.
Automated payment reminders run through a consent ledger keyed by contact email: existing-business-relationship clocks (2 years from purchase/contract end, 6 months from inquiry), express consent, and one-click unsubscribe with signed links. Every reminder records the consent basis at send time; contacts without an active basis receive strictly transactional copy. Customer replies are classified (promise-to-pay, dispute, document request) for supervised follow-up. Reminders render in English, French, or Spanish per customer.
Record retention & exports
Invoices carry a six-year retention window (idempotently stamped) with legal hold; audit packages (ZIP + JSON manifest of invoices, payments, and the dunning log) export for any period; per-customer DSAR exports provide structured data portability (Law 25 / CCPA).
Team roles (RBAC)
Access is governed by a central permission matrix. Functional roles: System Admin (workspace administration), Finance Ops (invoices, payments, refunds, taxes, retention), Billing Ops (catalog, subscriptions, bill runs, usage, wallets, dunning), Support (read-only), Viewer (analytics), Developer (API keys, webhooks). Admins assign roles from Settings → Organization; ownership transfer stays owner-only.