What a digital product store actually sells
A digital product store sells files or paid access: templates, presets, fonts, e-books, audio, video, datasets, software. There is nothing to pick, pack or ship, which removes half the work of a physical shop and replaces it with a subtler job. The customer is buying an entitlement, meaning the record that says who may have what, under which terms, until when. Almost everything difficult on this page follows from that record.
It is worth separating this from the projects it gets confused with. A physical store owes a parcel and a delivery promise. A catalogue-only site shows work without taking money. A recurring plan is an agreement to bill again on a schedule, which belongs with subscription e-commerce. Platform choice, gateway fees and the order chain every store shares sit with e-commerce website development.
Malaysia pays electronically now
Published statistic. An average Malaysian now makes more than ten electronic payments a week. A checkout that only takes cards on delivery is refusing the way the country pays.
Source: Bank Negara Malaysia: Annual Report 2025 and Payment Statistics T1. Reviewed .
Read the graphic as text
- 2020: 170.
- 2021: 220.
- 2022: 284.
- 2023: 343.
- 2024: 432.
- 2025: 538. Three times 2020
Chart scale: Electronic payments made per Malaysian, per year.
The licence is the product
What separates a cheap template from an expensive one is rarely the file. It is what the buyer may do with it. Licence tiers are the product being sold, so they need writing before anything is priced: personal use, commercial use, a single client project, a number of seats, resale forbidden.
- Tiers and permissions. What each tier allows and forbids, in language a buyer understands, shown before payment rather than buried in a document nobody opens.
- Where it is stored. The licence recorded on the order as sold, so a question two years later is settled by a record rather than by memory.
- Seats and scope. Whether one purchase covers one person, one team or one client project, and the route a buyer takes when they need more.
- Duration. Perpetual access, a fixed access window, or access while something else is current, decided per product instead of inherited by accident.
- Changing the terms. New terms apply to new purchases, and existing buyers keep what they bought unless you have a reason and a message for doing otherwise.
Upgrades between tiers are a normal request and an awkward one if nobody planned for them. An upgrade is a new entitlement plus a price adjustment rather than a second purchase of the same file.
Most card spending is now remote
Published statistic. More than half of Malaysian credit card value is now spent without the card present. That is your checkout, and it is also where the fraud rules and the chargebacks live.
Source: Bank Negara Malaysia: Payment Statistics, Table T2.1 Payment Instruments, 2025. Reviewed .
Read the graphic as text
Credit card value
- Card not present: 52.9%. RM120.5 billion spent online or over the phone in 2025
- Card present: 47.1%. RM107.2 billion tapped or inserted in person
Purchase, payment and entitlement are three separate events
An order is created, a payment is confirmed, an entitlement is granted. Collapsing those into one step is behind most cases of a customer who has paid and received nothing. Some payment methods confirm in a second and some do not, while the buyer sits on a screen expecting an instant download. The rule is simple: never grant access before an authoritative payment status, and never leave the buyer guessing which state they are in.
Delivery then has two shapes and is usually best as both. An emailed link is the notification. An account library holding every purchase, licence and current file version is the durable delivery, because email addresses change, filters swallow messages and a link sent in March is useless in November. Sign-in, purchase history and permissions are accounts and portals work, and building them early saves most of the support load later.
The table follows one fictional store selling downloadable design templates under a licence the merchant defines. The roles, rules and responses are assumptions made to show the shape of the workflow, and the final column lists evidence to collect during testing rather than results anybody has achieved.
| Workflow step | Assumed actor | Proposed system response | Exception | Acceptance evidence to collect |
|---|---|---|---|---|
| Buy a template | Assumed customer | Show the licence being purchased and record a payment state linked to the order | A failed or delayed payment leaves entitlement unresolved rather than granted | Licence-display and payment-to-entitlement tests recorded together for one order |
| Request a download | Assumed entitled buyer | Give access scoped to the purchased product and the agreed access period | A copied or expired link must follow the chosen access rule | Permitted and denied download observations, including an expired link and a shared one |
| Replace or refund a file | Assumed store operator | Version the file and apply the agreed entitlement or refund policy | Older versions and revoked entitlements need a recorded support decision | Version, entitlement and revocation tests traced back to one purchase |
Three events people treat as one
Editorial framework. Granting access at purchase instead of at payment is how digital stores give away stock.
Basis: Stripe: Payment intents lifecycle. Reviewed .
Read the graphic as text
- Purchase. The order exists, nothing is granted
- Payment. Authorised, then captured, sometimes later
- Entitlement. Access granted, and revocable
Re-download, and the rules buyers actually hit
People lose files. A laptop dies, a folder is tidied away, a link from two years ago has expired, and somebody writes to ask for the thing they already paid for. That conversation happens on every digital store, so the rule is worth setting before support starts inventing one per email.
- Signed links with a defined life, re-issued from the account rather than by resending an old email.
- Whether re-downloads are unlimited, capped, or capped with an override, and who holds that override.
- A record of every download attempt, allowed or refused and why, so support answers from evidence.
- Large files served directly from storage and resumable, so a dropped connection is not a support ticket.
- What a buyer of the first version gets when the second ships, decided as policy and published as a changelog.
Keeping old versions downloadable is cheap and prevents the worst conversation on a digital store, where a customer's project breaks after an update they never asked for. Version the file, keep the previous one reachable, and let the buyer choose.
Refunds that take the access back
A physical refund gets the goods back. A digital refund cannot. The entitlement flips to revoked, links stop working, and the buyer keeps whatever was already downloaded. That is the honest shape of it, and the policy should say so rather than implying a return that is not happening.
- The refund window, and whether a completed download closes it.
- Bundles: whether a refund is all or nothing, and what happens to the items already taken.
- Chargebacks, and whether one revokes access automatically or opens a review first.
- Who may revoke, what the customer is told, and the log entry recording the reason.
Publish that policy where it is read before payment and store the version the buyer accepted on the order. It turns a later argument into a lookup, which is worth more than any wording you could choose.
A refund has to reach the entitlement
Editorial framework. The fourth state is the common one, because the gateway and the store were never connected.
Basis: Stripe: Refunds. Reviewed .
Read the graphic as text
- Refund issued. Money returned by the gateway
- Entitlement revoked. Access ends, downloads stop
- Record kept. Who had access, and until when
- The gap. Refunded but still downloading
Piracy is a business decision, not a technical one
Any file a customer can open can be copied. Protection is a spectrum of friction, and each step up it costs honest buyers convenience and costs you engineering. The real question is not how to make copying impossible. It is how much inconvenience you are willing to charge the people who paid in order to slow down the people who did not.
- Watermarking documents and media with a buyer reference, invisible in normal use and traceable if a file is republished.
- Licence keys and activation for software, with a clear route for a customer who changes machine.
- Streaming or view-only access when the value is the content rather than possession of the file.
- Strict copy protection, which we rarely recommend: it fails for paying customers first and is worked around anyway.
The measure that works commercially is making the bought copy the convenient one: current versions, a changelog, an invoice, support, and a licence the buyer can prove if a client ever asks. Treat leakage as a cost with a routine for spotting and handling it rather than a problem to be engineered away.
The records that reconcile money with access
Support and finance need one view that traces a single purchase end to end, otherwise every query becomes detective work across a payment dashboard, an inbox and somebody's memory.
- The order and its payment reference, with the method and the time it was confirmed.
- The licence exactly as sold, rather than the current version of your terms.
- Entitlement state and its history, including who changed it and why.
- Every delivery attempt, granted or denied, and which file version was served.
What a card payment costs, as published
Published statistic. The headline rate is half the decision. Settlement speed, the online banking fee and what a plan upgrade costs decide what you actually keep.
Source: toyyibPay pricing plans. Reviewed .
Also: Billplz pricing.
Also: Curlec by Razorpay pricing.
Also: Stripe Malaysia pricing.
Read the graphic as text
- toyyibPay: 1.50%. Cards carry a RM100 onboarding fee
- Billplz: 1.80%. 1.5% on the paid plan
- Curlec: 2.40%. 2.00% on the premium plan
- Stripe: 3.00%. Plus RM1.00 per transaction
Chart scale: Domestic card rate on the entry-level plan, read from each gateway on 18 September 2026.
When a build is worth it, and when it is not
If you sell a handful of files under one licence, with no seats and nothing to connect to, a plugin on the store you already run is usually enough. WooCommerce development and Shopify development cover those routes and what each costs to run. Building becomes the better answer when licensing has tiers or seats, when entitlement has to unlock something in another system, when the catalogue is large enough to need catalogue and search, or when you sell software that has to validate its own keys.
Either way, digital products and licensing is a custom build scoped to how your business operates rather than an off-the-shelf package, and we would rather say which route fits during scoping than bill you for the bigger one.
What to bring to a first conversation
Bring the product list, the licence terms as you would explain them to a customer, and what a buyer should receive at the moment payment clears. Add how you handle re-downloads and refunds today, anything the entitlement has to unlock elsewhere, and any constraint that cannot move. Send that as a scoped enquiry and we will tell you which parts look ready to build and which need a policy decision from you first.

