Subscription billing RFP questions

Ask for named deployments, not general familiarity: which billing engine, which version, how many live subscriptions, and which payment gateways they connected. Kill Bill publishes releases such as killbill-0.24.22, released on September 29, 2026, so ask which release the partner would target and how they tracked changes since their last project. Ask them to describe one failure they resolved in production, such as a stuck invoice run or a duplicate charge, and what they changed afterward. Vague answers about "billing expertise" are a warning sign. Request references you can call, and confirm whether those references ran the platform themselves or only built it.

A credible partner starts with a written mapping of existing plans, add-ons, price versions, currencies and proration rules to the target catalog, then reconciles it against live subscriptions before any cutover. Ask for the artifacts they produce: a catalog mapping document, a migration dry run report, a reconciliation of subscription counts and balances, and a rollback plan. Ask how they handle subscriptions mid-term, customers on legacy prices, and payment method tokens that must move between gateways. Migration effort depends mainly on the number of plans, the volume of active subscriptions and how much history must be carried over, so ask the partner which of these drive their estimate.

Ask which gateway connectors and tax integrations they have built or deployed, and whether each one is a vendor-supported plugin, a community plugin or custom code. For each, the answer should cover sandbox testing with declined, partially refunded and disputed transactions, webhook replay tests, and tax calculations checked against a set of reference invoices. Ask who maintains the connector after go-live and how a gateway API change would be handled. Tax rules often change outside the release cycle, so ask how the partner keeps rate tables current and who approves changes. Confirm the exact plugin names and versions in the partner's proposal rather than accepting general claims of support.

A capable partner will draw a data flow diagram showing where card data enters, which components touch it, and where only gateway tokens are stored. Expect them to explain that the billing engine should hold tokens and never raw card numbers, and to name which services are in scope if a vault or orchestrator such as Hyperswitch is added. Ask which Self-Assessment Questionnaire type they expect to apply and why, and who makes that determination (typically your acquirer or assessor, not the implementer). They should also describe how logs, backups and webhook payloads are checked for accidental card data. Ask for the evidence they will deliver for each in-scope component.

Billing outages delay invoices and payment collection, so ask for the target architecture: how the application tier, database and job scheduler are redundant, and where they run across availability zones or data centers. Ask how they test failover, how often they restore backups into a separate environment, and which recovery point and recovery time objectives they propose and why. Ask how scheduled invoice runs are protected from double execution after a failover. Any figures in the answer should come from your agreed requirements, not from the partner's marketing, and you should confirm them in the written scope.

Ask how the partner tracks upstream releases, which environments they use to test them, and how they keep customizations separate from core code so upgrades stay manageable. A good answer names the pipeline: a staging copy seeded with anonymized production data, automated regression tests for invoice generation and proration, a reconciliation check on test invoices, and a documented rollback. Ask how long they expect a major upgrade to take in their experience and what drives that time, such as schema migrations or custom plugins. Ask who approves each change and how those approvals are recorded for change management.

Ask what testing they run against the billing stack and how often: application and API testing, infrastructure review, and access control checks on catalog and price changes. Under the FTC Safeguards Rule at 16 CFR 314.4, covered financial institutions must test their information systems, and absent continuous monitoring, the rule calls for penetration testing annually and vulnerability assessments at least every six months, so confirm which of those your partner will perform and which you must schedule yourself. Ask for sample evidence: change tickets, access review records, audit logs of price changes and invoice credits, and test reports. Note that DeployOpen prepares systems, controls and evidence for assessments but does not issue audit reports or certifications.

Ask for a written split of responsibilities: who monitors the platform, who handles incident response and on what hours, who applies security patches and who owns gateway and tax connector updates. Clarify whether support is a fixed-scope handover, a retainer for ongoing operations and upgrades, or your own team with partner backup. DeployOpen offers ongoing support, upgrades and continuous testing as retainers, and most engagements are fixed-scope with scope, deliverables and timelines agreed in writing before work starts. Ask each bidder for their response process, escalation path and what is included in a retainer versus billed separately, then compare those answers in the quote.

Ask the partner to state, in writing, which components run on open-source releases alone and which would benefit from a commercial support agreement, and to explain the reasoning for each. For Kill Bill, ask about the commercial enterprise offering the partner would recommend and what it includes, such as vendor support or additional modules, and confirm the current terms directly with the vendor before deciding. Ask how the partner would operate without that agreement, including how they would fix a critical defect in the core. The cost of any license should be compared with the in-house effort to maintain the same capability, so ask for both figures in the bid.