1. The Problem: When Pricing Logic Lives in More Than One Place
Running a subscription infrastructure business like BigBlueButton.Host involves catering to both international customers (paying via credit cards in USD/EUR/GBP) and domestic Indian educational institutions (requiring statutory 18% GST tax invoices and domestic payment rails).
Managing this across disparate systems or relying on client-side pricing calculators introduces severe operational risks:
- Price Tampering Vulnerability: If a frontend checkout payload is trusted to compute subtotals, tax rates, or currency exchange rates, malicious requests can manipulate parameters to underpay or bypass subscription tiers.
- Currency Drift on Renewals: Subscriptions that freeze an arbitrary exchange rate at initial signup silently drift away from real macroeconomic movement over multi-year periods.
- Tax Compliance Hazards: In India, Goods and Services Tax (GST) requires exact 18% calculation applied to the converted base amount, generating formal tax invoices with mandatory GSTIN attribution. Approximating or miscalculating this creates legal compliance headaches.
- Manual Provisioning Bottlenecks: If payment confirmation from Stripe or wire transfers does not instantly update the customer's server quotas, staff must manually copy-paste data, leading to delayed onboarding and administrative strain.
2. Architecture & Key Design Decisions
To solve these problems permanently, I built Bymond’s customer and billing platform around a strict operational principle: the backend API is the sole authority for what an item costs.
A. Quote-Locked Checkout Engine
Client applications are never trusted to compute prices or apply discount parameters. When a customer initiates a checkout, the backend creates a cryptographically signed, time-limited pricing quote:
- The quote locks the plan SKU, exact duration, calculated tax, exchange rate reference, and final payable amount.
- Any client request that alters the payload at checkout time is rejected immediately by the backend signature verification.
B. Canonical Currency Model
All internal accounting and plan definitions are maintained in a single canonical baseline currency. When a customer checks out in a regional currency, the backend queries daily-cached central-bank reference rates rather than ad-hoc arbitrary conversions. On renewal dates, recurring charges re-evaluate against current rates, ensuring long-term financial integrity.
C. Dual Billing Paths with Unified Provisioning
International subscriptions process automatically through Stripe card billing. Indian institutional customers requiring manual tax invoicing follow an equivalent domestic path against the exact same canonical pricing engine. Both pathways feed into an idempotent webhook listener that validates payment events and updates the customer's server quotas automatically.
D. Passwordless Authentication & Log Privacy
To eliminate credential reuse risks and password leak vulnerabilities, customer portal authentication uses secure one-time verification codes exchanged for an HttpOnly, Secure, SameSite=Strict session cookie. Sensitive tokens, webhook secrets, and customer credentials are systematically redacted from server logs by policy.
3. Outcome & Operational Impact
The platform has run Bymond’s commercial subscription operations continuously:
- Zero Billing Fraud: Server-side signed quotes made client-side price tampering technically impossible.
- Automated Tax Compliance: Indian GST invoices are generated automatically with full statutory accuracy.
- Hands-Off Service Fulfillment: Payment webhooks trigger instant server-quota updates, allowing customers to upgrade or renew without waiting for manual administrator intervention.
4. Key Lessons Learned
Building this engine reinforced a vital architectural principle: business logic, tax rules, and pricing must never be scattered across the client layer. Centralizing pricing authority into an immutable server-side state engine eliminates an entire class of security vulnerabilities and accounting errors.