For every owner in the business

Ask what breaks the morning the processor closes your account. If the answer is a guess, the plan is too.

Understudy keeps every account the business runs on — processor, bank, host, registrar, email, ad account, the handles that carry the traffic — with a named successor for each, and the date that successor last actually did the job.

Open the demo See pricing

Opens in this browser with a worked example business already in it. No account, no email address, nothing installed.

Understudy with its example records in it

Open the free demo →

The problem

The closure comes with a policy citation and no warning. The backup you never tried is the one that does not work.

Every business in this sector sits on a stack of accounts that can each be switched off without notice. Most owners have a name in their head for what they would move to. Almost none have opened the account, passed the underwriting, and run a real sale, a real restore or a real post through it inside the last quarter — which is the only kind of backup there is on the morning it is needed.

90–180 days

that funds are typically held after a processor terminates you, as a reserve against chargebacks still to arrive. The money that would have paid for the switch is inside the hold.

HL Hunt →

5 years

on the MATCH list after a termination for cause. An acquirer that sees the listing will probably decline you unless it specialises in high-risk merchants — so the successor has to be approved before the closure, not after it.

Chargebacks911 →

Prohibited

Stripe's restricted-businesses list names pornography and adult services outright. The mainstream fallback most businesses assume they have is not one this business can use.

Stripe restricted businesses →

Nobody gets to tick a box that says “we have a backup”.

A dependency is covered on a date only if a named successor passed a rehearsal on or before that date, inside the dependency's own re-test interval, with nothing failing since. Understudy will not write a coverage mark the rehearsal record does not support — the button is locked and the reason is written on it — and a closure cannot be marked recovered until the successor that took over is on the record with a date. There is no override. An override is a button somebody presses at five o'clock on a Friday.

How it works

Every question is asked as of a date

Write down what you stand on

Each account, who provides it, what stops the morning it goes, who can get into it and where that access is kept. Not the access itself — there is no field for it, and the program refuses anything that looks like one.

Name a successor, then prove it

A successor is somebody you have already been approved by. A rehearsal is that successor doing the job for real, for a while — a sale settled, a restore served, a post that people saw. Each dependency has its own interval; a pass from last year proves nothing about this month.

Keep the file

Every notice, hold, closure and appeal, with the date and the reason they gave. When the next processor asks why you left the last one, the answer is a statement you print as of any date — gaps included, because an underwriter who finds one on their own stops believing the rest.

What it will never do

It records that an account exists. Never the way in.

A vendor holding the passwords to a whole adult business's stack would be one breach away from being the catastrophe it was sold to prevent. So Understudy cannot hold them — not as a policy, as a shape.

No credentials. Not one.No field for a password, key, API token or recovery code on any screen. Every line of free text is read for the shape of one — a live secret key, a labelled password, a long random string, a card number — and refused, not warned about.

Nothing logs in as you.Understudy never connects to your processor, bank or host. It cannot, because it never touches the network, so none of your accounts can ever be flagged because of something it did.

No money, in any form.It records that settlements were held and when; never an amount, a balance or a fee. It is not in your checkout and never sees a customer.

Flat fee. Never a percentage.The price does not move with your revenue, and it does not rise with the number of accounts you are honest enough to write down.

Pricing

Priced per business, not per account

Because the thing you must never be discouraged from doing is adding the dependency you had forgotten about.

Solo

$49/month

One owner, one business, a short stack.

Up to twelve dependencies
Successors and rehearsals as a dated history
Single points of failure counted on the front page
The credential guard on every box

Most owners

Business

$149/month

The whole stack, and the file that goes with it.

Everything in Solo
Unlimited dependencies
The cover gate and the recovery gate
The file: notices, closures, appeals, switchovers
Continuity statement as of any date
Holders and second holders

Group

$290/month

Several businesses under one owner.

Everything in Business
A register per business
Shared successors across businesses
Priority support

Flat fee, billed monthly, cancel whenever. Never a percentage of anything. Your bank statement says Understudy Software. Your licence key is emailed to you within two working days of payment.

Checkout is our own bitcoin server, not a card processor — nobody we had to apply to and nobody who can close the account. The button takes you straight to it. Give your email address there — that is where your key is sent.

Questions

The ones we actually get asked

We have backups. We just have not tested them lately.

Then as far as Understudy is concerned you have names on a list, and it will count them as single points of failure until you do.

That is not pedantry. A processor you applied to eighteen months ago may not approve you now; a restore nobody has run may take nine hours instead of forty minutes. The rehearsal is the only part of a backup that is real.

Can I give it our logins so it can check things itself?

No, and it is built so that it cannot take them. There is no field for a password, key, token or recovery code, and anything with the shape of one is refused wherever it is typed.

Understudy records that an account exists, who holds it, and where the access is kept — a password manager, a safe, a second person with emergency access. Holding the access itself would make us the single point of failure the program exists to remove.

Why can I not just mark something covered?

Because a mark that says covered is what you will point to when an underwriter asks whether you had a plan, and it has to be true on the date it names.

So the mark is refused unless the rehearsal record supports it, with the reason written on the button. There is no override. Run the rehearsal, record it, and the door opens by itself.

Where does the data live?

In the page and in the browser you opened it in. There is no Understudy server holding your register, no account, and no database with your stack in it.

Export writes the whole thing out as one file you hold. We cannot lose, leak or be subpoenaed for what we were never given.

What do I actually get when I pay?

The demo on this page is the whole program, running on invented records. Paying gets you a licence key — one line of text, emailed to the address you give at checkout within two working days. Paste it into the program and from then on it keeps your own records. Until then, nothing you type into it is kept.

The key is checked inside the page, on your own machine. It never calls us, so there is still no account and nothing about your business goes anywhere. If you ever stop paying, your records stay exactly where they are, read-only, and Export still hands you every one of them.