Keep useful, privacy-safe records
Maintain records that let authorized staff understand the recurring arrangement without copying full payment credentials into general business systems. Useful records can include the version of the terms shown, the customer's affirmative action, enrollment timestamp, confirmation delivery, billing events, service activity, notices, support conversations, cancellation request, and final account status.
Limit access according to job responsibilities and use the approved payment platform for payment data. Never ask a customer to send a full card number, security code, password, bank credential, complete account number, or secret API key through email, chat, shared documents, or a general contact form. When responding to a dispute, use the evidence categories and submission process supplied by the processor or acquirer.