I wrote another post the other day about the key questions facing SaaS marketers. I talked about Consumer versus Enterprise billing and about Direct versus Channel marketing models. Overlaid on all of these choices, we have the concept of Session Control.
We implement Session Control through a component of our application called the "Session Manager". It's an optional service but virtually all of our existing clients use it.
If you're a do-it-yourselfer and your application keeps track of users and sends data to the billing application (wherever it is), session management is done by the application itself. If a customer doesn't pay their bill, someone in a place of authority has to take action to disable access to the application until they pay.
If you have a small number of customers, the "someone" is probably in your accounting department and they call or email someone at the hosting company to pull the plug for a while. It's a workable model for a small business, or if you don't care about timely payment. It may sound odd, but if the customer has a perpetual license, for instance, or it's your corporate parent there's no payment to wait for and session management is unnecessary. Manual control doesn't scale beyond a few customers, though - it becomes pretty labor-intensive as you grow.
What our Session Manager does is automate the control process and close the loop on payments. After an account is set up for a new customer, the application and the Session Manager constantly swap messages about who's using the system (is this user that just logged in an authorized user?) and tracking the necessary billing data. The Session Manager also monitors the payment queue to track whether the account is up to date.
The real value of the Session Manager becomes evident on that fateful day that a customer doesn't pay their bill. Then the Session Manager uses the client's business rules to decide how to respond. If the rules say that the customer is supposed to get daily "payment due" reminders and be allowed 30 days to catch up, then the Session Manager sends advisory messages to your administrative managers and implements that strategy without human intervention.
At 31 days, if the account is still delinquent, an eerie silence descends on the freeloading users as the service is suspended pending settlement of the outstanding account. While payment-due notices always get attention, a service suspension usually gets a response that a whole blizzard of notices just can't summon.
For any business model where customers pay on a monthly pay-as-you-go basis, session control makes a lot of sense. It's one less administrative task for the accounting group, and one more control that keeps you from giving your stuff away through inattention to administrative detail.