Design Subscription Commerce

Problem Statement: Recurring Commerce & Auto-Ship

Subscription commerce — Dollar Shave Club, Birchbox, Amazon Subscribe & Save — sells predictable replenishment rather than one-off carts. The defining shift from ordinary e-commerce is that money, inventory, and fulfillment must all align on a calendar: a charge fires on a schedule, a box must ship on a promised cadence, and the inventory to fill it must be reserved before the warehouse picks. The system's job is to keep those three clocks — billing, scheduling, and fulfillment — in agreement for millions of subscribers at once.

The architectural spine is the subscription period as the unit of truth, with append-only billing_event and shipment_event streams hanging off each period. The platform never stores card numbers — a PSP (Stripe/Adyen) token vault holds the PAN, keeping the platform out of PCI scope — and it never mutates a balance without writing an event. Inventory is reserved before a WMS pick task is emitted, so the fulfillment side never promises a box it cannot fill. These four stances (period-as-truth, event ledger, PSP vault, reserve-before-pick) frame everything else.

Scale concentrates in a way ordinary commerce does not: renewals burst on shared billing anchors. With 8 million active subscribers each renewing roughly monthly, the average charge rate is only a few per second — but when monthly cycles align at, say, 06:00 UTC, the peak hits around 2,200 renewal charges per second. The defining load problem is therefore not steady throughput but a synchronized renewal spike, which (as the scaling section shows) is best flattened by jittering billing anchors at signup.

The correctness bar is set by money and trust. A double charge is a finance incident and a customer-trust failure, so the target is under 0.02% double-charge incidents, achieved by idempotency on the PSP event id and the append-only ledger. A missed shipment breaks the replenishment promise, so on-time ship within the promised window targets ~98.5%. Stating these two numbers — and that they are protected by an idempotent event ledger, not hopeful retries — frames subscription commerce as a billing-correctness system with a fulfillment calendar attached.