Payment Gateway

Taking cards online once meant contracting with card issuers directly. The trouble was that there is never only one issuer. A market can easily have eight or more, each with its own request format and its own way of answering, so accepting every card meant building the same feature eight different ways. When one of them changed its specification, payments through that one issuer would start failing quietly while everything else looked fine.

The heavier problem was the card number itself. Wire up payments yourself and a customer's card number passes through your servers, and recurring billing means storing it somewhere. At that moment the company becomes a business that handles card data, and it inherits the whole set of requirements that come with it — encryption, separated access rights, regular audits. It was not unusual for an engineer assigned to add paid plans to spend three months reading issuer specifications and security standards instead.

A payment gateway packages both of those problems and sells them back. You integrate once, with the gateway, and it absorbs the differences between issuers along with the job of storing card data. In exchange you pay a fee proportional to the amount collected.

There are four specific jobs a gateway takes off your hands.

1. It collapses one integration per issuer into a single one. You send one payment request to the gateway and it routes that request to the right issuer. Adding a wallet or an international card brand is closer to a configuration change than a project.
2. It keeps card numbers out of your systems. The card a customer types goes straight to the gateway, and what comes back to you is a token — a string that points at that card. Next month's charge is requested with the token. If your servers are breached the card number isn't in them, and a token alone can't be used to charge anywhere else.
3. It runs recurring charges. A subscription business has to charge thousands of cards on the same day each month, and the scheduling and retrying live on the gateway's side. Dunning — reattempting failed charges after a few days and notifying the customer — is usually attached there too.
4. It collects payment state in one place. Successes, failures, partial cancellations, and refunds are all recorded per transaction, so a customer question can be answered on the spot.

The price is the fee. Domestic card payments typically run two to three percent of the amount charged, so a company collecting $40,000 a month on cards loses roughly $1,200 of it here. The cost scales directly with volume, which is why the number stops being background noise as the business grows.

Easier reconciliation comes along with it. A card approves or declines on the spot, so failed charges appear in a list immediately. A bank transfer sends no notification either way, so you match the statement against the invoice list on the day payment was due.

There are three other ways to get paid by card, and volume and customer type decide which one fits.

1. Integrating with issuers directly. Skip the gateway, contract with issuers yourself, and the fee drops toward one percent. In exchange the integration work and the security obligations come back to you, including the registration and security standards set out in laws such as the Electronic Financial Transactions Act. This becomes worth examining once monthly volume reaches several million dollars and the fee you would save exceeds the cost of dedicated staff.
2. Bank transfers and virtual accounts. The fee is a flat amount per transaction — well under a dollar — rather than a percentage, which makes it attractive on large amounts. Enterprise customers signing annual contracts usually pay this way. The cost is that someone has to reconcile deposits by hand, and anything that doesn't arrive piles up as accounts receivable.
3. An international payment platform. Some services act as the seller of record, handling currency conversion and local sales tax for you. The fee is higher than a domestic gateway's, but you don't file tax in each country yourself. Once overseas revenue is a meaningful share, that is worth paying for.

Selling digital goods inside a mobile app narrows the choice further. The app store requires its own billing and charges fifteen to thirty percent, which means the same product leaves you with substantially less than it would on the web.

"Card fees are 2.9 percent, so we're moving the big contracts to bank transfer."

The fee is a percentage, so the larger the transaction the more another route is worth.

"Card numbers never touch our side. We only hold the token the gateway gave us."

Even in a breach, card data isn't on the company's servers.

"Forty failed charges yesterday and half are over-limit. I'll set up retries."

Most of those will clear in a few days, so they shouldn't be treated as cancellations.

When Pagedeck added paid plans on top of its free tier, this was the choice Theo and Grace made together. Integrating with issuers directly would have saved a few hundred dollars a month at their volume, and building it would have taken months of engineering and security review, so they took the gateway and spent that time on the product instead.

Two routes run in parallel now. Teams paying by card go through the gateway, and the enterprise accounts Sofia handles sign annual contracts and pay by transfer.

The most common mistake is assuming a gateway takes over responsibility for payments as a whole. Handing over card data and the integration makes it feel like everything downstream went with it. But what the gateway carries ends at passing requests along and storing card data. Setting refund policy, issuing tax invoices, and submitting evidence on a chargeback all stay with you. A chargeback is a customer disputing a charge with the card issuer directly so the payment gets reversed, and once your rate crosses a threshold the gateway will raise your fee or end the contract. Treat it as someone else's job and you can lose the payment route itself.

The other common belief is that a gateway alone makes you ready to sell abroad. International card logos on the checkout screen make it look finished. But having a charge approve and being ready to sell in a country are different things. Prices displayed in local currency, local consumption tax filings, and the payment methods people in that country actually use all remain. Open it without preparing and charges go through while tax filings fall behind, and customers who don't see a familiar payment method leave at the last step.