Thanks @jseok — that narrows it usefully. Answers in order, and I’ve also checked every other subscription on the same plan, which I think sharpens the question.
- Other apps or integrations
One integration: our own application, authenticating with a production access token rather than OAuth. No third-party app is authorised against the account. Both responses below confirm it from your side — source.name is matchmor on both subscriptions.
The account owner is the only person with Square Dashboard access, so a cancellation performed by hand in the Dashboard is also ruled out as far as we can establish.
Two things you should have rather than discover later:
- Our production access token was exposed on 2026-09-18, pasted into a transcript inside a curl copied out of the Developer Console’s API logs, which render the real bearer token in their sample requests. It was replaced on 2026-09-19. Both cancellations predate the exposure (08-31 and 09-16), so it cannot explain them.
- A sandbox webhook subscription was pointing at our production URL, disabled on 2026-09-17. Receive-only; it could never issue a call.
- RetrieveSubscription with include=actions
Addi Perkins — 8aaf3fbc-df26-4aaa-a7db-24659b401828
{
“subscription”: {
“id”: “8aaf3fbc-df26-4aaa-a7db-24659b401828”,
“location_id”: “LG1NSY8CCH9QM”,
“customer_id”: “26E7EM1CTRBKS1CYYVHYK6703R”,
“start_date”: “2026-07-16”,
“canceled_date”: “2026-09-16”,
“status”: “CANCELED”,
“version”: 1,
“created_at”: “2026-07-16T11:06:44-06:00”,
“card_id”: “ccof:CA4SEFuYy5hXeAzCaETvhUsUmiAoAg”,
“timezone”: “America/Denver”,
“source”: { “name”: “matchmor” },
“monthly_billing_anchor_date”: 16,
“plan_variation_id”: “7ANJMNRTY76QTGTHQVJ4AHYX”,
“billing_end_date”: “2026-09-16”
}
}
Nathaniel Neubert — c62b90f8-5503-41ae-9a53-097ba22000fc
{
“subscription”: {
“id”: “c62b90f8-5503-41ae-9a53-097ba22000fc”,
“location_id”: “LG1NSY8CCH9QM”,
“customer_id”: “V71K7NZX856YDJPPHCSP32AYBR”,
“start_date”: “2026-07-31”,
“canceled_date”: “2026-08-31”,
“status”: “CANCELED”,
“version”: 1,
“created_at”: “2026-07-31T12:03:21-06:00”,
“card_id”: “ccof:CA4SEFKbax4jKCiy2FHMMfh-QA0oAQ”,
“timezone”: “America/Denver”,
“source”: { “name”: “matchmor” },
“monthly_billing_anchor_date”: 31,
“plan_variation_id”: “7ANJMNRTY76QTGTHQVJ4AHYX”,
“billing_end_date”: “2026-08-31”
}
}
Neither has an actions array, so nothing was left pending at the time of reading. Neither has invoice_ids — consistent with our records that no invoice was ever raised for either member and no money was ever owed.
- Others on the same plan variation
Both are on 7ANJMNRTY76QTGTHQVJ4AHYX, which carries 54 subscriptions: 43 ACTIVE, 11 CANCELED. All 54 report source.name: matchmor.
So the rest of the plan is unaffected — this is not a plan-wide failure. Three of the ACTIVE ones carry a future canceled_date (2026-09-30, 2026-10-13, 2026-10-14); we have confirmed all three are legitimate scheduled cancellations following an account deletion or a move to our free tier.
What we can and cannot rule out from our side
Of the 54 subscriptions on this plan variation, 14 carry a cancellation date — 11 already CANCELED and 3 still ACTIVE with a future one.
We can account for 12 of the 14. Each is a member who deleted their account or moved to our free tier, and in every case our own CancelSubscription call went out days or weeks before Square executed it on the billing anniversary. That mechanism behaves exactly as documented and we have no question about it.
The 2 we cannot account for are Addi’s and Nathaniel’s. Nothing in our database recorded a request for either: no account deletion, no tier change, no pause, no admin action. No invoice was ever raised for either member, and both still had a valid card on file.
So the difference is not the plan, not the application, and not the cancellation mechanism — 12 cancellations on this same plan, through this same integration, are fully explained, and these 2 are not.
Two questions:
- What does your internal audit record as the source of each cancellation — Dashboard, API under some other credential, or system-initiated? For the 12 explained ones it should show our API call; that is exactly what makes it worth comparing against these 2.
- Is there any process on Square’s side — billing, risk, compliance, plan lifecycle — that can end a subscription mid-trial? Both of these were inside a six-month free trial with nothing owed.
Two details that may help you locate them
- Both ended on an exact monthly anniversary of their start date, to within a few seconds of the creation timestamp. Nathaniel: created 07-31 12:03:21, ended 08-31. Addi: created 07-16 11:06:44, ended 09-16. In both cases canceled_date equals billing_end_date equals the monthly_billing_anchor_date.
- They ran for different lengths — one month and two months — on the same plan variation, which is what makes me doubt a plan-configuration explanation on our side.
For completeness, and so it does not send you down a wrong path: a third member was ended in the same window by an unrelated fault entirely of our own making — a Stripe test-mode webhook writing to our own database. It never called Square, and it does not explain these two.