It is a hard lesson with an expensive solution.

I agree with you, as you grow, you have to diversify. However, services like Stripe Connect are more difficult and time consuming to replicate. Stripe connect handles the processing of many different accounts and handles skimming the commissions and then depositing the proceeds into the individual bank accounts of your users after doing some cursory KYC. This service is of course not compatible with similar services offered by other processors, so you will have to write all the handling logic and integrate with the KYC providers and possibly separate ACH deposit providers on your own.

In other words, there is a lot of lock-in with services like Stripe Connect.

Yep, as I was reading OP's story I kept waiting to get to the part where he switched to his backup payment processor and life went on. My brain: "You do have a backup payment processor, don't you? Don't you??"

If you're running a business and you find that it is utterly dependent on some single point of failure, you'd think that would be something you'd want to correct ASAP.

I used to work in technical/customer support for an internet payment gateway. The esoterica of internet payments are pretty out there; most of the people who called us just wanted to sell their widgets -- they barely understood what we were talking about when we'd ask them where they had their merchant bank account.

... which is to say that, yes, you and I as people who work deeply in a space, of course we know this thing is a SPOF. Everyone else? They don't know that. It took me a long time to acquire the empathy needed to talk them through this stuff, but it made me a better communicator, and it helped an awful lot of them understand.

I think the part you missed is he's using Stripe Connect and its 35% of the merchants through him that lost the ability to process cards?

How do you handle recurring subscriptions with this setup?

You use a 3rd party payment orchestration platform. Spreedly and Very Good Security both offer this and we use them for our business.

I am not familiar with this. What makes them less of a single point of failure?

All they really do is handle tokenization and pci compliance. They're not an active participant in the financial process, basically just a technical proxy. Thus no risk (to them) of charge backs or anything like that, so aside from you not paying your bill, they would have little to no reason to nuke your account.

They're just a tech solution orchestrating (recurring) payments to your payment processors. So they don't have to do the same checks as processors. So they are only a technical single point of failure.

Presumably you have to get certified with SAQ D for actually storing your custopmers payment info instead of tokenizing. Huge hassle.