We built Volta between April and June 2026, a subscription platform for creators selling access to an audience, and retired it in August. One of the last things it got was a function that packaged everything the database knew about a single order into a zip file: the audit trail, the channel joins, the payment attempts, the download log. We wrote it in the week after our first chargeback, which is about two months later than we should have.
A chargeback is a form you file, once, before a deadline, with attachments. For a digital product every attachment worth having is a log you were either keeping in April or you were not, and nothing you do in the seven days you are given will change which.
The response is a form, and it has a clock on it
When a buyer disputes a card payment, the money is already gone from your balance. What you get in return is a window. Stripe puts it at "usually 7 to 21 days, depending on the card network," and spells out what happens at the end of it: "If you don't respond before the deadline, you automatically lose the dispute and can't retrieve the disputed funds."[1] Being late is not a weaker case. It is a lost one.
Inside that window you get one attempt. "You've only one opportunity to submit your response," Stripe writes. "You can't edit the response or submit additional files, so make sure you've assembled all your evidence before you submit."[1] There is no follow-up, no clarification, no second email once you find the screenshot you meant to include.
The submission itself is more constrained than most people expect. PDF, JPEG or PNG only. Under 4.5 MB combined, under 50 pages, and under 19 pages if the card is a Mastercard.[2] One file per type of evidence, so five screenshots of the same email thread have to be merged into a single document before they go in.[2]
And whatever you attach has to be self-contained, because the person reading it will not leave the page. Stripe's instruction is explicit: banks "won't review any external content," which rules out audio and video files, "requests to call or email for more information," and "links to click for further information."[1] A response that says "full logs available at our dashboard" is a response with no logs in it.
Then you wait. The issuer's decision "can take up to 3 months."[1]
What counts as proof when nothing shipped
For a physical product this is a solved problem: you attach the tracking number and the delivery address, and the argument is mostly over. Digital sales have no equivalent. Stripe says so directly - digital products "don't have trackable shipping data, so focus on evidence of usage, login, or download."[3]
The field that carries it is access_activity_log, and its description reads like a
schema. Stripe asks for "server or activity logs showing proof that the customer accessed or
downloaded the purchased digital product after they made the payment," and adds that this
"should ideally include IP addresses, corresponding timestamps, and any detailed recorded
activity."[3]
A receipt does not satisfy that. Neither does a screenshot of your product page, nor your recollection that the buyer was in the Telegram group for three weeks. What satisfies it is a log: the buyer in it, times on it, dated after the payment.
Subscriptions add a second document. When the claim is that the member cancelled, the evidence Stripe wants is your cancellation policy plus "an explanation of how and when the customer was shown your cancellation policy prior to purchase."[3] That one is not a log at all - it is a screenshot of your own checkout, taken while the checkout still looks the way it looked on the day they bought.
The evidence has to exist before the dispute does
Every item on that list is something you cannot produce retroactively. This is the part that changed how we built.
Volta's dispute record carried a due_by timestamp from the day the dispute arrived,
because the deadline belongs to the problem and an inbox is a poor place to keep it.
Alongside it we wrote an assembler that took an order id and returned
a zip containing four files - the order's full audit trail, the slice of it covering channel
joins, every payment attempt against the order, and every download issued for it. One call,
one archive, no archaeology at 11pm on day six.
The download log is where we got something subtly wrong, and it is worth copying the correction rather than the design. We logged one row each time we issued a signed download URL: buyer, file, timestamp. That proves we handed over a key. It does not prove anybody opened the door, and Stripe's field asks whether the customer "accessed or downloaded" the product.[3] A log of URLs issued answers a slightly different question than the one the bank asked. Log the fetch, not the offer.
That zip was raw material. It was JSON, and the bank wants a PDF under 50 pages with the relevant part called out, so somebody still had to read the archive and write two paragraphs a stranger could follow in ninety seconds. Automation gets you the facts by the deadline. It does not get you the argument.
Your platform's deadline is shorter than the network's
If you sell through somebody else's checkout, the 7-to-21-day window is not yours. Theirs is.
Gumroad, which is the merchant of record for the resale of its sellers' products and handles "refunds, chargebacks and other disputes with Buyers in Gumroad's sole discretion,"[4] gives the creator a form and a much tighter clock: "You have 72 hours to submit any additional information using the form below; after that, we will auto-submit on your behalf. You can only submit additional information once."[5] Attachments are "combined into one PDF in the order you add them,"[5] so the order you upload in is the order a bank clerk reads in.
Seventy-two hours is generous compared to nothing, and it can be shorter - Gumroad notes that when they hear about a dispute late, you get however many hours are actually left, and if there are none they file without you.[5] None of this is a criticism of Gumroad; they are being unusually clear about a thing most platforms leave you to discover. But it means your real deadline is set by a company that found out before you did.
The mirror case matters just as much. Where the buyer paid a connected account rather than the platform - Stripe Connect or PayPal Connect - Gumroad hands the whole thing back: "resolving disputes on those transactions is the creator's responsibility," to be fought "through your respective Stripe or PayPal accounts."[5] Same storefront, same buyer, completely different answer to "who files this."
"Do you handle chargebacks" is the wrong question to ask your platform. Ask who files, how long you get, whether you can attach your own files, and whether you can export the access logs for a single buyer without opening a support ticket.
What a win is actually worth
Before you clear an afternoon for one, look at the odds.
Stripe's Radar scores each dispute's win likelihood from one to five dots and publishes what those mean: five dots is a 60% chance, three is 25%, one is 5%. Stripe's own gloss on the table sits directly underneath it - "Even in the most favorable cases, it's very difficult to overturn a disputed payment."[2]
Against that, the fees. A dispute costs $15 to receive, and countering costs another $15, returned only if you win.[6] On a $10 product, as we worked through in an earlier piece on refunds and reversals, fighting is plainly irrational. On a $299 course it is just as plainly worth an hour. Somewhere between those two is a number you should decide once, in advance, rather than per dispute while annoyed.
The thing the odds do not change is the count. Dispute activity "is calculated based on the disputes received, not won or lost,"[2] so a dispute you win still counts toward every threshold that matters. Gumroad's version of that threshold is concrete: "Payouts are automatically paused when your chargeback rate goes above 1% of your sales volume."[5] You can win every case you fight and still have your payouts frozen.
Four things to do before your first dispute
Log access, not delivery. One row per fetch, with the buyer id, the timestamp and the IP, kept for at least a year. If your product is a Telegram or Discord group, the row that matters is the join. If it is a file, it is the download completing, not the link being issued.
Screenshot your own checkout. The cancellation-policy evidence has to show what the buyer saw on the day they bought,[3] so take a fresh capture whenever you change the page and put the date in the filename.
Fix your statement descriptor. One of the three causes Gumroad lists for chargebacks is a customer who "does not recognize the charge on their credit card statement,"[5] and their own warning is that the descriptor carries the seller's name or username rather than their brand. Sell films as Breadcrumb Films while your account says Mildred Peppercorn and the buyer sees Mildred Peppercorn. Their help page puts it better than we can: that customer "will be understandably alarmed."[5] It is a settings change, and it is the only item here that prevents disputes instead of answering them.
Ask your platform those four questions in writing, before you need the answers. If they file, ask whether you can add evidence and how long you get. If you file, check today that you can actually open the dispute in your own Stripe dashboard.
Disclosure. The due_by modelling, the four-file evidence archive and the download-log
mistake are from our own build of Volta rather than anyone's documentation, so they carry no
citation below. Volta was our product, it is retired, and none of this is a recommendation to
use it. Every external figure is cited to the provider's own documentation, terms or pricing
page.