Chargeback evidence checklist for SaaS

The issuing bank decides a chargeback on what you send, and nothing else. It does not log in to your app, read your help center or call your support line. For a SaaS business, that means the case is won or lost on records you made months earlier: what the customer agreed to, when they used the product, what they told you.

This is a working checklist: what to record all the time, what to send for each kind of dispute, and how to package it so a reviewer can follow it. It is based on processor documentation: Stripe’s evidence best practices, reason codes and defense requirements and Dispute object; Braintree’s evidence requirements; Adyen’s dispute reason codes and defense requirements; and Visa’s Dispute Management Guidelines for Merchants (all accessed November 2026).

Part 1: what to record all the time

You cannot assemble evidence after the fact if it was never logged. These records should exist for every customer, from day one.

Account and agreement

Account creation date, customer account ID and email.
The exact terms, pricing and cancellation policy shown at signup, versioned, with the version the customer accepted.
Timestamp, IP address and device of the acceptance (checkbox, button click).
For trials: what was shown about when the first charge happens and for how much.

Payments

Every invoice and charge: date, amount, plan, billing period, card brand and last four digits.
Receipts and renewal reminders sent, with timestamps.
Refunds and credits, with dates and amounts.
The statement descriptor used on each charge.

Usage

Logins with timestamp, IP address and device or user agent.
Key product actions with timestamps: projects created, files uploaded, API calls, seats added, whatever shows real use.
Which user in the account did what (for team plans).

Cancellation

Every cancellation attempt, including flows started and abandoned, with timestamps.
Answers given during the cancel flow.
The confirmation email sent after cancellation.
Plan changes, pauses and offers accepted.

Communication

All emails sent to the customer (transactional and marketing), with delivery status.
All support conversations, with timestamps.

Retention

Keep these at least as long as a dispute can arrive. Stripe says networks typically give cardholders around 120 days from the payment, sometimes more; and Visa Compelling Evidence 3.0 looks at transactions up to 365 days back. A retention of 18 months or more covers both. Check that this is compatible with your privacy policy.

Part 2: what to send, by dispute type

Read the reason code first; it tells you what the bank will look for. Mapping and codes are in reason codes for subscriptions.

Fraud: “I did not authorize this” (Visa 10.4, Mastercard 4837, 4863)

Customer account ID, email and signup date.
Prior undisputed payments on the same card, with dates and amounts.
IP address and device for sessions around each of those payments and the disputed one.
Usage in the billed period: logins and key actions with timestamps.
3D Secure authentication result, if any (Stripe adds this for you).
Any message from the cardholder that shows they know the service.
If Visa 10.4: check CE 3.0 eligibility (two prior undisputed transactions 120 to 365 days old, matching identifiers).

Cancelled recurring: “I cancelled” (Visa 13.2, Mastercard 4841)

The cancellation policy as shown at signup, with the relevant section highlighted. Stripe suggests uploading the relevant part rather than your whole terms.
Proof the customer accepted it (timestamp, IP).
Your cancellation records: no request before the charge, or the exact time of the request if it came after.
Usage after the date the customer says they cancelled. Visa’s guidelines, for disputes processed from 19 October 2024, accept proof that the cardholder used the service after withdrawing permission.
Renewal reminder or receipt sent before or after the charge.
Any refund already issued.

If your records show the customer did cancel before the charge, do not contest. Accept and fix the bug.

Not received (Visa 13.1, Mastercard 4855)

Proof the account was provisioned and accessible during the billed period.
Logins and usage during that period.
Your terms on service delivery.
Any outage or access restriction in that period, and how you handled it (if access was really blocked, consider accepting).

Not as described (Visa 13.3, Mastercard 4853)

The product or plan description shown at purchase.
Usage showing the features were available and used.
Support conversations about the issue, and your responses.
Refund policy shown at purchase.

Credit not processed (Visa 13.6, Mastercard 4860)

The refund record, if issued: date, amount, reference.
If no refund was due: the refund policy accepted at signup and the conversation where it was discussed.

Duplicate (Visa 12.6, Mastercard 4834)

Both invoices, showing they cover different periods, seats or products.
Or, if one was a mistake, the refund.

Part 3: how to package it

Processors have strict limits, and reviewers read many cases. A clear packet is part of the evidence.

Respect the format

Stripe documents these constraints on its best practices and responding pages:

Constraint	Stripe
Submissions	One. You cannot add or edit after submitting
Files	One file per evidence type; combine several documents into one multi-page file
Size	4.5 MB combined; Mastercard evidence limited to 19 pages combined
Text	150,000 characters across all text fields
Links	Banks do not review external content; do not rely on URLs

Braintree organizes evidence by category and is equally strict about format; its evidence requirements page lists what each category accepts. Adyen lists the defense documents per reason code. Check your processor before building templates.

Write a cover note

Start with a short summary, in plain language:

Who the customer is and when they signed up.
What they bought, at what price, on what billing interval.
What happened: the charge, the claim, and why the claim is wrong.
A list of attached documents, each tied to one point.

Example: “Customer acc_8812 signed up on 3 February 2025 for the Team plan, monthly, and accepted the terms (Exhibit A, with timestamp and IP). The disputed charge of 7 March 2026 is the 14th renewal on the same card; the previous 13 were not disputed (Exhibit B). Users on the account logged in 41 times between 7 March and 2 April 2026 (Exhibit C). No cancellation request was received (Exhibit D).”

Make logs readable

Export logs as a table: date, time with time zone, user, IP, action.
Filter to the relevant period. Thousands of rows hide the point.
Highlight the rows that matter.
Use the customer’s name or email as shown on the card account where possible, so the reviewer can connect them.

Do not

Send internal jargon or database dumps.
Send screenshots of an admin panel without explanation.
Argue about the customer’s character. Stick to facts and timestamps.
Miss the deadline. The date on the dispute is the one that counts; Stripe says you usually have 7 to 21 days.

Part 4: review before sending

Reason code read and evidence matches it.
Cover note explains the case in under a page.
Every claim in the note has an exhibit.
Personal data limited to what the case needs.
File sizes and page counts within limits.
A second person has read it.
Deadline checked.

Doing this with NoChurn

NoChurn gathers this evidence automatically for each Stripe and Braintree dispute: cancel flow answers with timestamps, the emails NoChurn sent, usage and custom data you send by API, and conversations from Intercom, Zendesk, HubSpot, Help Scout, Gorgias or Crisp (read only). It drafts the cover note and response with AI, and nothing is sent until a person on your team has reviewed it. The bank still decides the outcome. See chargebacks and custom data.