Billing audit trail exists

Billing events are financial records. When a subscription is created, upgraded, or canceled and nothing is logged, the only audit history is Stripe's own event log — which you can query through the Stripe Dashboard but cannot correlate with your application's user IDs, feature usage, or support tickets. SOC 2 CC7.2 (System Monitoring) and ISO 25010 operability both require that significant system events produce observable records. Without application-level billing logs, diagnosing a customer complaint about an incorrect charge or missed downgrade requires manual cross-referencing between Stripe and your database.

Add structured logging to every significant billing event in your webhook handler — both success and failure events. Application logs are required; Stripe's event log alone does not satisfy this check.

case 'customer.subscription.updated': {
  const subscription = event.data.object
  console.log(JSON.stringify({
    event: 'billing.subscription_updated',
    stripe_event_id: event.id,
    customer_id: subscription.customer,
    status: subscription.status,
    plan: subscription.items.data[0]?.price.lookup_key,
    timestamp: new Date().toISOString()
  }))
  // handle the event
}

For a durable audit trail, insert a row into a billing_events table on each significant event. This enables SQL queries like "show me all plan changes for user X in the last 90 days" without touching the Stripe Dashboard.