Payment gateway: what it is, how it works and how to choose one

A payment gateway is the service that connects your application to the financial system. When a customer enters a card to subscribe to a plan, the gateway receives that data, transmits it securely to the issuing bank and returns the answer (approved or declined) in seconds. It is the bridge between your checkout and the money that lands in your account.

In SaaS, the gateway is what turns a subscription into actual revenue. Every dollar of MRR only materializes when the gateway manages to authorize the recurring charge each month. That is why it is not an infrastructure detail: it is a central part of the recurring-revenue machine. Stripe and Asaas are well-known examples.

A charge flows through a few quick steps. The customer enters the card; the gateway encrypts and sends the data to the card network and the issuing bank, which check balance, limit and fraud signals; the answer comes back authorizing or declining the transaction. All of this happens in fractions of a second, invisible to the user.

The key piece is tokenization: instead of storing the card number in your database, the gateway replaces it with a token, a code with no value outside that context. You then charge the customer again next month using the token, without ever holding the card. This drastically reduces the risk and the compliance scope that falls on your system.

It is common to confuse three roles that work together but do different things. The gateway is the software layer that captures the data at checkout and forwards it securely. The processor routes the transaction between networks and banks. The acquirer is the institution that actually settles the money and deposits it into the merchant account.

• Gateway: authorizes, tokenizes and talks to the checkout.
• Processor: routes the transaction through the card networks.
• Acquirer: settles the transaction and pays the merchant.

In practice, many modern providers bundle the three roles into a single product, which is why the line between them blurs. For someone running a SaaS, what matters is that the whole stack authorizes the charge and deposits the revenue reliably.

Not every declined charge means a customer who wants to cancel. An expired card, a limit briefly maxed out or a random bank decline knock down payments from customers who still want the product. When those charges are not recovered, the customer drops for a purely operational reason: this is involuntary churn.

A good gateway attacks this with smart retries and dunning: it reprocesses the charge on the times and days most likely to be approved, tries a backup card and sends emails asking the customer to update their details. Every recovered charge is MRR that does not vanish from your balance. Across a large base, recovering even a fraction of declines makes a meaningful difference to retention.

Processing cards means following the PCI DSS standard, the set of security rules from the card networks. By using the gateway tokenization and hosted checkout, much of that responsibility leaves your system, because the sensitive data never touches your servers. This lowers the cost of compliance and the risk of a breach.

The gateway also helps handle a chargeback, the dispute in which the cardholder asks the bank for a refund. Fraud prevention, identity verification and evidence collection help reduce how often they happen and contest legitimate charges. A high volume of chargebacks, beyond the direct loss, can lead the card network to penalize the business.

For a SaaS, the criteria go beyond the per-transaction fee. Look at the approval rate (the higher it is, the more revenue lands), the quality of retries and dunning, support for recurring billing and subscriptions, local payment methods (in Brazil, Pix is decisive) and how easy the API is to integrate.

• Approval rate: approving more cards is more revenue without selling more.
• Recurring billing and dunning: native subscription support and smart retries.
• Local methods: cards, Pix, bank slips and wallets to match your audience.
• Integration: API, webhooks and reports that talk to your system.

Cloud spending keeps growing, and Gartner projects that public cloud spending will reach around $723 billion in 2025, which underscores how much a reliable billing infrastructure matters for any recurring-revenue business. Choosing the right gateway is, in the end, protecting the revenue you have already won.