Has a payment provider ever blocked your launch over a subdomain?
We've been stuck in merchant verification for almost a month.
The provider's site says a few days.
First the company took weeks to verify. Then the identity of the founder. Now they won't enable payment processing because they can't see the connection between our marketing site and our app, which lives on a subdomain of the same domain.
Same brand, same company, same documents they already have. One is the website, the other is the product. That's how software has worked for about fifteen years.
I want to know if this is normal now. For everyone who launched a SaaS recently: how long did merchant verification take you, and did anything actually move it faster? Or did you switch providers and start over?
Our date is sitting there waiting and I'd like to know whether to wait or to move.
Replies
MonoCloud for Startups
The subdomain issue itself doesn’t seem completely unusual. Some payment providers verify the exact domain the product runs on, so app.company.com may still need to be reviewed separately from company.com.
But taking almost a month to get to that point is the bigger problem.
I’d first make sure the connection between both domains is extremely clear. Link the app from the main site, link back from the app, keep the company details consistent, and make sure the legal pages mention the same entity.
If they still can’t give you a clear timeline after that, I wouldn’t keep the launch waiting indefinitely. At some point, switching providers becomes less risky than waiting.
It took us just few days to get our site verified with Paddle, but we only have one domain, no companion app on the subdomain. They asked to update some clauses in legal documents, which we did the same day and the next day our domain was approved. They explicitly say that if you have another product on subdomain, then it should be submitted for verification separately.
Worth separating a provider deciding something from two systems disagreeing about which hostname is canonical, because the second one produces most of what gets read as a block. We deliver sites on customer domains, so this is the part of our setup carrying the most checks. The apex and the www form get derived from one source, since modelling them separately is how you end up with one name validating while the other sits pending indefinitely with no error attached to it.
The certificate stage is where the panic comes from. Curl from a laptop against a hostname whose certificate has not been issued yet returns something that reads like a hard failure while the process is proceeding normally, and people start moving DNS underneath a thing that was going to finish on its own. We stopped treating an external request as evidence and read the state for that exact hostname from the provider's API, which is the only place it is actually true. Disclosure, this is what I sell.