I'd love to hear from anyone who feels poorly treated or has encountered problems like this: I'm patrick@stripe.com. (I'm one of Stripe's founders.)
The way we look at it is: legitimate businesses are always fine and -- furthermore -- we know that our reputation rests on not screwing anyone over. We can afford to lose money on an account; we cannot afford to damage our reputation. Our internal philosophy document states: "In evaluating businesses, we should first be careful never to do harm." Luckily, we've had almost no issues to date.
One unfortunate case that we do often run in to, however, is that a fraudulent user will start loudly posting purported horror stories on various forums in an effort to get us to release money. It's a decent strategy: these stories are bad for Stripe. It's obviously very hard for someone else to distinguish this case from a "real" case of Stripe acting malevolently. But, no matter what happened, we obviously can't rebut them and post sensitive details about their account. So their stories stand.
Even if we were omniscient and had neither any false positives nor any false negatives, these stories would exist. It just comes with scale. And, in reality, we're of course far from omniscient. We just try to turn the dial all the way towards false negatives -- we never want to hurt a legitimate business.
It's a tough dynamic. It exists to some extent with many online services (most of whom have terms of services that prohibit certain businesses); Stripe is more acutely subject to it since you can fairly readily use Stripe for financial gain. I'd love to hear from anyone who thinks we should handle it differently or better.
(Downandout, to address your question directly, we'd be happy to chat with you (and anyone else) directly before you make the switch to reassure you that your business doesn't contravene our ToS. Feel free to drop me a line.)
Lastly, I mean it about actively wanting to hear from anyone who thinks we've handled a situation badly -- if there are any mistakes, we need to take action. patrick@stripe.com -- I'd be happy to chat by email, phone, or IM.
Thanks Patrick, I didn't mean to imply that you don't have legitimate reasons to freeze accounts when you do. I was just wondering what the odds of having problems were for a legitimate business that at times has significant spikes in volume. In light of your response, I for one actually think I will take the leap and switch.
They've been really good to me, and to some friends of my mind, who have the problem described by "legitimate business which at times has significant spikes in volume." The first time I knew it was going to happen I gave them a heads up in advance, and got back something to the effect of "Oh, don't worry, we know you're on the level Patrick." I've subsequently had e.g. one-day spikes in the $X0k range (where the account's steady state would be $1k a month) and never had a problem.
I never had an issue with Paypal that calling them didn't resolve, but that sort of spikiness made me worried about their future actions, and relatedly that of my actual banks.
As long as I'm here, I'll recount an anecdote from Bank of America, which I wanted to apprise "You're going to see a bunch of wire transfer coincidentally happening at the same time in the next few days, which will be FAR above the norms for this account, and I'd like you to know what is happening so you don't go doing anything rash like filing a Suspicious Activity Report."
Two things I learned during this process:
1) Knowing what a Suspicious Activity Report is and why one would want to avoid having them filed is is considered by some employees to be suspicious.
2) After getting the run around from telephone support, I decided to do a branch visit, at the Bank of America branch on Wall Street (since I was in Manhattan to visit Fog Creek at the time). The banker I was talking to listened attentively and then asked for clarification: exactly how much money was I talking? I gave him an estimate, whereupon he replied "Sir, this is Wall Street. We have entirely different standards for what constitutes 'a large amount of money.'"
I'd recommend Stripe unequivocally. I've been using it in the UK since it was in beta with no issues at all. The whole experience has been joyous, which is very unusual in the payments arena IME.
Another mostly-happy UK Stripe user here. We launched around the time they came out of beta and only have a few transactions going through so far, but we’ve had no major problems.
In the interests of balance, I should say that Stripe does still have some pain points for us. Two are serious enough that we’d probably jump to any competitor that handled them better.
But the fact is that right now, I don’t know of any competitors available to us in the UK that do those things better. Moreover, we anticipated much worse pain points with various other card payment systems we considered.
Stripe certainly isn’t a perfect solution, but there is a lot to like about it, and it remains our favourite choice for card payments by some considerable margin.
I probably should have been more specific rather than expressing vague concerns in a public forum like that. Apologies.
Basically, for any payment service I’m looking for three things:
1. Can I integrate with it and collect money in the ways I want to?
2. Can I maintain proper records of those transactions for tax/audit/compliance purposes?
3. Can I test all of this thoroughly?
The new generation of payment services is great at fixing #1. Stripe and the like have made integration a much more pleasant and efficient experience.
Almost every payment service we’ve considered sucks at #2 to some degree. I do understand the desire to keep things simple and market with nonsense about five-minute integrations, but in the real world we still have to produce proper accounts and file things like VAT (sales tax) returns, so we do need the data to do those things available as easily as possible.
An almost universal failing in payment APIs we’ve looked at is having a data/API model built around mutable entities. I don’t want the details for a charge I already knew about to change if something like a refund or chargeback happens. I want a separate transaction recorded for that, with its own unique ID and date and records of things like fees and taxes, and of course a cross-reference to the original. This is easy to audit, and it’s easy to detect things like duplicate notifications while integrating.
An example more specific to Stripe is not applying a unique ID to the transfers it makes to our bank account, which of course occur close together and for similar amounts of money since we’re using it for B2C subscription charges. Unfortunately, different VAT criteria might apply to the underlying charges to our customers, depending on whether they’re in Europe or not. This leads to crazy things like manually reconciling records using spreadsheets, dashboards and the Mk I human eyeball, instead of writing a script that takes our downloaded bank statement and our Stripe API key and just works everything out quickly and accurately. It has also resulted in more in accountancy fees to prepare a tax return than the total amount of tax on the return! (If we must have this, please consider allowing us to have a single transfer weekly or monthly. In our case, a few days of drifting cash flow is no big deal, and the effort it would save every time we have to file a tax return would be well worth it.)
Also, slightly related, VAT invoices. Please, for the love of all that is holy, sort this out. It’s the law, a tiny amount of money is actually involved, but not keeping proper business records is not acceptable. We aren’t likely to get in a lot of trouble over 20p of misplaced tax. We are likely to get in trouble if we are picked for a Business Records Check and can’t show we’re following good practices, and right now that again means we waste crazy amounts of time fussing over literally pence on each transaction to make sure everything is squared away if anyone asks. Again, this stuff should just work, and our total effort required for compliance should be on the order of ten seconds to download a one-page PDF from the web site every month.
For #3, Stripe’s test facilities are a worthy effort. There’s a separate version of the system that can be used to check integrations without making real charges, and you can simulate a reasonable amount of real world behaviour with it. That is already better than a lot of payment services offer.
What you can’t do, unfortunately, is build an automated integration test suite that will fire off all the API calls we will ever want to make and receive all the incoming webhooks we might ever see in rapid succession. Some plausible things can’t be simulated as far as I know (e.g., what happens when someone’s card works for some subscription payments but then expires, or if someone raises a chargeback). Also, webhook notifications sometimes take a considerable time to arrive after whatever would have triggered them, which isn’t very test-friendly.
Despite our efforts to test our integration thoroughly, the lack of ability to run an automated suite quickly after we’ve made a change means again we’re talking about spending a lot of time manually testing all the key integration points every time we touch that part of our code.
I hope this is of interest to those in this discussion who work on payment services. Also, this has been a long post and obviously its purpose is mostly criticism, so I want to finish by reiterating that our experience with Stripe has been very positive overall. Even where I’m picking on them above, I don’t know of anyone else who’s actually doing things any better in most cases, and many other payment services seem to suffer from the same problems today.
Edit: And just to be clear, the two potentially loyalty-defeating issues I alluded to before are:
1. being able to automate the preparation of our accounts/tax records, matching up all transactions with our customers with the deposits that ultimately hit our bank account, and
2. being able to run a comprehensive, automated integration test suite.
The way we look at it is: legitimate businesses are always fine and -- furthermore -- we know that our reputation rests on not screwing anyone over. We can afford to lose money on an account; we cannot afford to damage our reputation. Our internal philosophy document states: "In evaluating businesses, we should first be careful never to do harm." Luckily, we've had almost no issues to date.
One unfortunate case that we do often run in to, however, is that a fraudulent user will start loudly posting purported horror stories on various forums in an effort to get us to release money. It's a decent strategy: these stories are bad for Stripe. It's obviously very hard for someone else to distinguish this case from a "real" case of Stripe acting malevolently. But, no matter what happened, we obviously can't rebut them and post sensitive details about their account. So their stories stand.
Even if we were omniscient and had neither any false positives nor any false negatives, these stories would exist. It just comes with scale. And, in reality, we're of course far from omniscient. We just try to turn the dial all the way towards false negatives -- we never want to hurt a legitimate business.
It's a tough dynamic. It exists to some extent with many online services (most of whom have terms of services that prohibit certain businesses); Stripe is more acutely subject to it since you can fairly readily use Stripe for financial gain. I'd love to hear from anyone who thinks we should handle it differently or better.
(Downandout, to address your question directly, we'd be happy to chat with you (and anyone else) directly before you make the switch to reassure you that your business doesn't contravene our ToS. Feel free to drop me a line.)
Lastly, I mean it about actively wanting to hear from anyone who thinks we've handled a situation badly -- if there are any mistakes, we need to take action. patrick@stripe.com -- I'd be happy to chat by email, phone, or IM.