Automatic renewal laws · the record to keep · updated
What Stripe keeps, and what it does not
Stripe can send renewal reminders for you, and its Checkout can ask a customer to accept your terms. What it keeps of either is short. On the email log: “You can find logs for emails sent within the last 60 days” (Stripe docs: Automate customer emails) (read 10 October 2026), and renewal reminders and price-change notices are not among the types it logs. California asks a seller to keep consent for three years and to send an annual reminder; neither record stays in Stripe that long.
Each, in Stripe's words
“You can find logs for emails sent within the last 60 days in the Customers page.”
Stripe docs: Automate customer emails (email logs; renewal reminders)
The logged types are failed payments, finalized invoices, receipts, payments needing 3D Secure, expiring cards, unpaid one-off invoices, credit notes, refunds, ending trials and canceled subscriptions. Renewal reminders and price-change notices are not among them.
“Stripe only sends renewal reminder emails for subscriptions with a collection_method of charge_automatically.”
Stripe docs: Automate customer emails (email logs; renewal reminders)
They go out when “Send emails about upcoming renewals” is on, on the days set under “Upcoming renewal events”. Nothing in the API records that one was sent.
“If accepted, the customer in this Checkout Session has agreed to the merchant’s terms of service.”
Stripe API reference: the Checkout Session object (consent, consent_collection)
consent.terms_of_service is one value, accepted. It does not say which terms, which version or what they said; keep that yourself.
“List events, going back up to 30 days.”
So the invoice.upcoming event that times a renewal reminder is gone from Stripe a month later. Run this tool at least monthly and its ledger keeps each one.
“some of these regulations and laws require Stripe to retain transactional records for a prescribed period of time.”
Stripe's data retention page names no period, and the Checkout Session reference states none. Do not rely on Stripe to hold a session for three years: this tool copies what it reads into your own ledger.
So keep your own
- Copy each subscription's consent (the Checkout Session, the date, and your terms' version at that date) when it happens, not three years later.
- Log each reminder and notice you send, from your own email system, with the subscription it went to and the date.
- Run a read of your account at least monthly, so the upcoming-renewal events Stripe lists for 30 days are kept.
The record from your own Stripe account, free
$ npx --allow-remote=root https://agentwares.vercel.app/dl/autorenew-record-0.2.0.tgz check --stripeEach subscription beside the law of its customer's state: the consent on record, the annual reminder, the notices before a renewal and a price change, and what is missing, kept in a hash-chained ledger on your disk. It reads your account through a restricted read-only key you make in the Stripe Dashboard (a secret key is refused), or your Stripe exports. It never writes to Stripe, never emails your customers and sends nothing to us. No AI. Also a local MCP server: the same command with mcp.
A signed renewal evidence report
The tool writes the report for your counsel: the period's consent, reminders, notices and gaps per subscription, as JSON and PDF, with its SHA-256. A signed report adds a dated Ed25519 signature over this report's SHA-256, which anyone can check later; only the hash is sent to be signed. The report itself is complete without it.
The signature is over the report's hash only: your customers' data stays on your machine. One-time, with no account; the report command prints the link for your report's hash.
A hosted renewal ledger that records consent from your Checkout, and sends and keeps the annual reminders and price notices for three years, is not built
It would take consent as it happens from your Checkout, send the annual reminder and the notices before a renewal or a price change from your own domain, and keep each one in okgate's hash-chained log for three years.
What exists today: these pages, the free tool, and the ledger it keeps on your own disk.