Past-due accounts freeze, not vanish

Seven days past due, the data layer closes with a specific lock code and the app shows a pay-to-unlock screen — the address still resolves so the tenant can reach it.

What it is

A lock flag on the account row, checked at the top of the data proxy on every request and cached briefly. Locked accounts get HTTP 402 with a machine-readable code the client turns into the lock screen. Routing deliberately still resolves a locked account's subdomain so the tenant can get to the screen that lets them fix it.

Also called: account locked pending payment · billing lock · past due · unlock by paying

See it
Past-due accounts freeze, not vanish
Area
Platform & Admin
Group
Account lifecycle
System
Multi-Tenancy & Identity
Solves
3 named problems
01orgIsBillingLocked() reads the account's billing status, cached 30 seconds per instance.
02A locked account gets a 402 with code 'billing_locked' from every data-proxy call.
03The client surfaces the lock state via the bootstrap endpoint's billing_locked flag.
The lock screen over a dimmed dashboard, with the account address still in the URL bar. Triggered by the 402 from src/app/api/db/route.ts. Sample data — no customer information appears here.
How it works
  1. 1orgIsBillingLocked() reads the account's billing status, cached 30 seconds per instance.
  2. 2A locked account gets a 402 with code 'billing_locked' from every data-proxy call.
  3. 3The client surfaces the lock state via the bootstrap endpoint's billing_locked flag.
  4. 4Subdomain resolution treats a locked-but-suspended account as resolvable on purpose.
  5. 5Unlocking is a status change, and the short cache means it takes effect within seconds.
Why we built it

The rule is recorded in the middleware resolver as a one-line judgement, Keith 08-18: 'A billing lock is a suspension the tenant can lift by paying — the subdomain must still resolve so they reach the lock screen.' Without that carve-out the account would stop resolving entirely and the customer would have no route to the page that takes their payment. The proxy comment states the scope of the lock plainly: 'the whole data proxy is closed until they pay.'

The problem
  • A hard suspension for non-payment leaves the customer with no route to pay.
  • A generic 403 gives the client nothing specific to render.
  • Checking billing state per request would hammer the database.
Sound familiar?
What you get
A past-due account keeps its data and its address.
The lock screen is reachable and explains what to do.
Paying restores access within seconds.

See it on your own jobs

Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.

or keep browsing features →