Remove billing identity without breaking retained invoices
A billing customer can carry personal details as well as links to financial records the operator needs to preserve. Wildo’s billing erasure effect handles the personal side without deleting the customer record that retained invoices depend on.
The resulting receipt identifies the provider steps that completed and any that need follow-up.
Example — Close a subscriber’s personal billing data
The application erases an individual account. Its billing effect cancels relevant subscriptions, scrubs the provider customer and detaches payment methods, while leaving retained invoices linked to the preserved customer record.
For engineers
Backend startup registers the billing effect when the relevant billing services are available. It resolves billing accounts for the subject and delegates through the configured billing provider. This actual effect fragment shows the ordered actions and the complete-result boundary:
Source: billing-subject-erasure-effect.backend.ts (selected excerpt).
await cancelSubscriptions(provider, dependencies, variants, account._id, steps);
await anonymizeCustomer(provider, providerCustomerId, steps);
await detachPaymentMethods(provider, providerCustomerId, steps);
}
const failed = steps.filter((step) => !step.succeeded);
if (failed.length === 0) {
return {
effectRef: BILLING_SUBJECT_ERASURE_EFFECT_REF,
status: SubjectErasureExternalEffectStatus.COMPLETED,
detail:
`Provider-side erasure completed for ${accounts.length} billing account(s): subscriptions cancelled, `
+ `customer anonymized, payment methods detached. The customer record was KEPT (anonymized) so the `
+ `retained invoices remain attributable.`,
steps,
};
}
The effect never calls deleteCustomer. Retaining the provider customer keeps invoice attribution intact; the provider implementation scrubs the supported personal customer fields instead. An absent billing account produces NOTHING_TO_ERASE. An unsynced local account contributes a successful skip-unsynced-billing-account step; the overall result still reflects the other accounts and steps.
The effect applies to USERS and USER_SELF and checks that user billing is registered before reading accounts. It selects the user-scoped billing variant; an employee account is not a reason to cancel an organisation’s shared subscription. Application builders should verify their billing subject ownership before extending the effect.
Each action records its own outcome. A failed provider step produces a partial receipt after local erasure, with details for provider-side follow-up. Verify provider state independently when completing the operational request. Financial retention purposes and periods are operator decisions; this mechanism preserves the relationship needed to implement them.