Bakery and coffee roaster software in Baltimore: the checkout has a ceiling and a border

The shops this is actually about

Before any of the law, it is worth being precise about what the baking trade in this city actually is, because the picture in most people’s heads is wrong and the correction changes what software matters.

I pulled the Census Bureau’s County Business Patterns files for 2023 — the county file and the state file, downloaded on 16 September 2026 — and counted the relevant industries for Maryland and for Baltimore City. Maryland has 141 retail bakeries (NAICS 311811) employing 1,224 people on $30,460,000 of annual payroll, and another 75 baked goods stores (445291) with 703 employees and $15,825,000. It also has 48 commercial bakeries (311812) — the wholesale plants — employing 3,079 people on $146,277,000.

Now narrow it to Baltimore City, and the shape of the trade appears. The city has 10 retail bakeries and 11 baked goods stores — twenty-one shopfronts in total, with 180 employees between them and $5,309,000 of payroll. It also has 12 commercial bakeries, with 1,085 employees and $60,631,000 of payroll. Twelve wholesale bakeries employ six times as many people as all twenty-one shopfronts put together, and pay over eleven times as much payroll.

Baltimore is not a city of bakeries. It is a city that bakes for a region and keeps a shopfront. Those twelve plants hold 25.0% of Maryland’s commercial bakery establishments, 35.2% of its commercial bakery employment and 41.4% of its commercial bakery payroll — a concentration you would expect in a port city with a rowhouse industrial history, and one that is invisible if you judge the trade by what you can see from the sidewalk.

The per-employee column is the one I would put on a wall. A commercial bakery in Maryland pays $47,508 per employee a year; a retail bakery pays $24,886 — the wholesale side supports 1.91 times the payroll per head. Those are payroll figures rather than wages and the mix of full and part-time work differs, so do not read them as a salary comparison. Read them as a statement about where the value in this trade sits. The same flour, the same ovens, the same skill — and roughly twice the payroll per head on the wholesale side. Whatever else is true, the half of the business that people build the least software for is the half that carries the money.

Coffee is smaller and stranger. County Business Patterns records 15 coffee and tea manufacturing establishments in all of Maryland, with 213 employees. Baltimore City is the only Maryland county whose cell for that industry is published rather than suppressed for disclosure — 4 establishments, 33 employees, $595,000 of payroll, which works out to about eight people per roastery. Every other roaster in the state sits in a county where there are too few of them to print. That is what a craft industry looks like in official statistics: too small to count, and too small to build software for, which is precisely why the software that exists for it is either a spreadsheet or an enterprise system for people who buy green coffee by the container.

And that roastery count is new. Baltimore City had zero published coffee and tea manufacturing establishments in 2019; it has four in 2023. Maryland went from 9 to 15 over the same period, a 66.7% increase, and 10 of those 15 sit in the Baltimore metro. Meanwhile the city lost 70 limited-service restaurants — a tenth of them — and 22 drinking places between 2019 and 2023, while gaining bakeries, roasters, caterers and food trucks. Something is rotating in this city’s food economy, and it is rotating toward the small and the made-here.

The coffee shops that survived got bigger. In 2019, 331 of Maryland’s 1,020 snack and nonalcoholic beverage bars had one to four employees; by 2023 that class had fallen to 271, down 18.1%, while the twenty-to-forty-nine employee class rose from 153 to 249, up 62.8%. Retail bakeries did not move the same way at all: their one-to-four share went from 41.1% to 40.4%. Coffee consolidated; baking did not. If you are wondering why bakery software is a thinner market than coffee software, that is a large part of the answer.

And the retail end is tiny. Of Baltimore City’s 11 baked goods stores, 7 have fewer than five employees, and across the Baltimore metro 59.3% of them do. Of its 122 snack and nonalcoholic beverage bars — the category that holds independent coffee shops — 38 have fewer than five employees and 36 have between five and nine, so 60.7% of the city’s coffee bars are businesses of nine people or fewer. These are shops where the owner is on the floor. They are not going to run an implementation project, and any advice that assumes they will is advice for somebody else.

So the business this article is about is usually one of four things, and often two of them at once: a neighborhood bakery with a counter and a growing wholesale book; a cake and pastry shop where most of the revenue is made-to-order and booked weeks ahead; a coffee roaster with a subscription list and café accounts; or somebody baking at home on Saturdays who has just realized that the orders are not stopping. All four sell online. All four run into the same three walls, and none of the walls is about baking.

The ceiling, and the fifteen days left of it

Start with the number, because it is about to change and almost nobody has noticed. A Maryland cottage food business — the legal category that covers essentially every home baker in Baltimore who has ever taken money for a cake — is defined, oddly, in the definitions section of the food establishments subtitle rather than in the section about cottage food businesses. Md. Code, Health–General §21–301(b–1) says a cottage food business is a business that:

“(1) Produces or packages cottage food products in a residential kitchen; (2) Sells the cottage food products in accordance with §21–330.1 of this subtitle and regulations adopted by the Department; and (3) Has annual revenues from the sale of cottage food products in an amount not exceeding $50,000.” — Md. Code, Health–General §21–301(b–1)

On 1 October 2026 — fifteen days after this article is published — that $50,000 becomes $100,000. Chapter 320 of the Acts of 2026, House Bill 535, “Food Establishments – Cottage Food Businesses – Maximum Annual Revenue,” was approved by the Governor on 28 April 2026, and its operative language is a single bracketed substitution: “in an amount not exceeding [$50,000] $100,000.” The ceiling doubles.

Now read the front of the same act, which is where the real story is. Chapter 320 is drafted in two instructions. It repeals and reenacts “with amendments” subsection (b–1) — the ceiling. And it repeals and reenacts “without amendments” subsections (a) and (b–2) — which is the definition of a cottage food product, the one that says it must be “sold in the State.” The General Assembly printed both subsections on the same page of the same act, changed one number in the first, and reproduced the second word for word.

The ceiling moved. The border did not. That is not a drafting accident; reenacting a neighboring subsection without amendments is how Maryland keeps a section internally consistent when it touches one part of it. Somebody looked directly at “sold in the State” in April 2026 and left it exactly where it was. Whatever else a Baltimore baker takes from this article, take that: the amount you may sell just doubled, and the map you may sell it on is unchanged.

What you may actually make under that exemption is narrower than the number suggests. COMAR 10.15.03.27B allows hot-filled canned acid fruit jellies, jams, preserves and butters from an enumerated fruit list, “non-potentially hazardous baked goods,” and non-potentially hazardous candy. The Department’s Guidelines spell out what falls outside: anything needing refrigeration — meringue, pecan and pumpkin pies, cheesecakes, cream and custard pies, and pastries with cream cheese or buttercream fillings — plus low-acid canned foods, acidified and pickled products, meat, poultry, dairy, and beverages. The test is physical rather than categorical: a shelf-stable product must have a water activity of 0.85 or less and/or a pH of 4.6 or below, and a food that lands in the gray zone — banana bread, many buttercreams — can be laboratory-tested into the exemption. Worth reading closely for the coffee half of this article, because the line is drawn inside the product. Appendix A of the Guidelines lists “whole roasted coffee beans” as allowed. Appendix B, the not-allowed list, has an entry headed “Coffee:” with exactly two items under it: “Flavored coffee” and “Ground coffee.” And beverages are excluded outright — “none of any kind.” So a Maryland home roaster may lawfully sell you a bag of whole beans, may not sell you the same beans ground, and may not sell you the cup. The grinder is the boundary. That is a product attribute, set at the moment of packing, deciding which side of an exemption the sale falls on — which is the entire argument of this article rendered as a single burr. The appendices are guidance rather than regulation, and COMAR’s own enumeration does not obviously reach coffee at all, so I would ask before building a business on it.

A warning about where you look this up, because I did not expect to have to write it. The University of Maryland Extension’s own cottage food page — a .edu, and the first thing many Maryland bakers will find — states the cap as “annual revenues of up to $25,000,” under a stamp reading “Updated: December 8, 2025.” I checked it on 16 September 2026 and it still says that. The $25,000 figure was superseded on 1 October 2022 by Chapter 406 of the Acts of 2022, which raised it to $50,000 — so the page has been wrong by half for nearly four years, and on 1 October 2026 it becomes wrong by a factor of four. The state’s own Department of Health guidance, updated November 2025, has the right number. If you take one practical thing from this section: read the statute or the Department’s own PDF, not the explainer.

Before anyone panics about the ceiling, it is worth knowing how far away most home bakers are from it. Census Nonemployer Statistics for 2023 — the only federal file in this whole article that carries revenue rather than payroll — counts 32,641 US bakery businesses with no employees, and publishes their receipts by band. 32.7% gross under $5,000 a year. Another 19.2% gross between $5,000 and $10,000, so 51.9% — more than half — are under $10,000. 77.8% are under $25,000. Only 1.95% clear $250,000. Baltimore City alone has 55 of these nonemployer bakeries against 24 employer ones, so 69.6% of the city’s bakery businesses have no staff at all, and their mean receipts are $18,455. Their number grew 57.1% between 2019 and 2023.

So the honest picture is that the overwhelming majority of Maryland’s home bakers will never come near $50,000, let alone $100,000, and this section is not about them. It is about the ones who do — the shop that is working, whose orders are not stopping, and who will cross a line nobody has built them a way to see.

Why a cap inside a definition behaves differently from a cap in a rule

The drafting has a second consequence that matters more than the number. Because the ceiling sits inside the definition of what a cottage food business is, exceeding it is not a violation of anything. It means you were never a cottage food business, and so the license exemption at §21–330.1(b) — “A cottage food business is not required to be licensed by the Department if the owner of the cottage food business complies with this section” — simply never described you.

That distinction has teeth, and they point in a direction most people would not guess. Health–General §21–1214(a)(2) says in terms that a person who violates §21–330.1 is not subject to the criminal penalties in the preceding paragraph. Break the cottage food rules and there is no criminal exposure. But cross the ceiling and you have not broken the cottage food rules; you have operated a food establishment without a license under §21–305(a), and that drops you into §21–1214(a)(1) and (b): a fine of up to $1,000 or 90 days for a first offence, up to $2,500 or a year for a second, a civil penalty of up to $5,000, and — the clause that does the damage — §21–1214(c): “Each day on which a violation occurs is a separate violation under this section.”

So the safe harbour carries no penalty, and falling out of it lands you somewhere that charges by the day. That is a strong argument for knowing, on any given Tuesday, what your trailing revenue figure is.

The number nobody has defined

Here is where it becomes a software problem rather than a legal one. The statute says “annual revenues from the sale of cottage food products.” It does not say what “annual” means. Calendar year, rolling twelve months, your fiscal year — the statute is silent, COMAR is silent, the Department’s November 2025 Guidelines are silent, and so is its cottage food FAQ. It does not say whether “revenues” is gross or net. And it does not say whether the $6 you charged for delivery is revenue from the sale of a cottage food product or something else.

I do not raise those gaps to be clever. I raise them because a business has to pick an answer and be consistent, and the only place consistency can live is in a system. The conservative reading — gross, rolling twelve months, shipping included — is the one we would build, because it is the one that never surprises you. But the number has to exist somewhere before you can be conservative about it, and today it usually does not exist anywhere at all. It accumulates across the market stall, the porch pickups, the wholesale case you dropped at a grocery store and the website, and no screen anywhere adds those together. Square knows about Square. The website knows about the website. The cash box knows nothing.

That is a counter, a threshold and an alert. It is perhaps a day of work. Nobody sells it, because no platform vendor is organized around a rule that applies in one state and is about to change.

The second ceiling, which is federal and about to collide with the first

There is another $50,000 in this business, it is federal, and it measures something completely different. Under 21 CFR 101.9(j)(1)(i), a food sold by someone who makes direct sales to consumers is exempt from nutrition labeling if that person

“has annual gross sales made or business done in sales to consumers that is not more than $500,000 or has annual gross sales made or business done in sales of food to consumers of not more than $50,000, Provided, That the food bears no nutrition claims or other nutrition information in any context on the label or in labeling or advertising.” — 21 CFR 101.9(j)(1)(i)

And in the next sentence it specifies its own arithmetic: “calculation of the amount of sales shall be based on the most recent 2–year average of business activity.” A two-year rolling average, which moves every month.

Put the two side by side and something quietly absurd happens on 1 October. Today, a cottage food business that stays lawful under Maryland law — at or under $50,000 of cottage food revenue — is automatically inside the federal exemption’s food-sales prong, because the two numbers are the same. From 1 October a Maryland cottage food business may lawfully sell $100,000, which is twice the federal food-sales threshold. It can still fall back on the $500,000 total-sales prong, and most will. But the point stands: Maryland raised one ceiling and, without mentioning it, pushed a class of small bakers up against a different one written by a different government. Nobody is going to send a letter about this. It will simply become true.

If you are above the retail line there is a separate escape hatch for low-volume products at 21 CFR 101.9(j)(18)(ii): a product is exempt for a twelve-month period if, in the preceding twelve months, you employed fewer than an average of 100 full-time equivalent employees and fewer than 100,000 units of that product were sold in the United States. Note “of that product.” The count is per item. Your sourdough and your seeded rye each get their own counter, and a full-time equivalent is defined by dividing total wage hours by 2,080. The exemption is not automatic either: a notice must be filed with FDA before the period begins — unless, under §101.9(j)(18)(iv), you are not an importer, have fewer than 10 full-time equivalent employees, and the product sells fewer than 10,000 units a year, in which case no notice is needed at all. Outgrow either number mid-period and §101.9(j)(18)(iii) gives you 18 months to comply.

The filing address is 5001 Campus Drive, College Park, Maryland — about thirty-five miles down the parkway from most of the bakeries this article is about. It is the only part of federal food labeling law with a local postcode.

The sentence in your product description that can cost you a label

Now the part that belongs in an article about online stores rather than one about kitchens. Every one of those exemptions is conditional on the food bearing no nutrition claim “in any context on the label or in labeling or advertising.” The low-volume exemption is blunter still: it reaches only products “whose labels, labeling, and advertising do not provide nutrition information or make a nutrient content or health claim.”

Your online store is advertising. The product description field is advertising. The category page that says “high–protein” is advertising. The email campaign that calls the seeded loaf “low sugar” is advertising. None of that text is on the package, none of it passes a label printer, and all of it is written by whoever had ten minutes on a Tuesday. A nutrient content claim typed into a content management system can pull a product out of an exemption the owner has relied on for six years, and there is no warning, no validation and no field anywhere that says this product is exempt; do not describe it in these terms.

I am not raising this to frighten anyone, and I have never heard of a small Maryland bakery being pursued over a product description. I raise it because it is such a clean illustration of the real problem. The rules that govern a small food business are not properties of the food. They are properties of the business, the buyer, the channel and the words you used — and every one of those lives in software that was never designed to know it mattered.

The border

The second constraint is geographic, and Maryland states it four times, in four documents, each more explicit than the last.

The statute, Health–General §21–301(b–2) — the subsection Chapter 320 reprinted without changing a word — defines a cottage food product as a nonhazardous food “that is sold in the State… (1) Directly to a consumer from a residence, at a farmer’s market, at a public event, by personal delivery, or by mail delivery; or (2) To a retail food store, including a grocery store, or a food cooperative.”

The regulation, COMAR 10.15.03.27A, tightens the verb: a cottage food business may offer its foods for sale when they are “(1) Made in a private home kitchen; and (2) Offered or sold only in the State” — at a retail food store subject to conditions I come to below, or directly to a consumer “(i) At a farmer’s market; (ii) At a bake sale; (iii) At a public event; (iv) By personal delivery; or (v) By mail order.” Not sold. Offered or sold.

The definition, COMAR 10.15.03.02B(17–2), states it as a property of the product itself: a cottage food product is a non-potentially hazardous food offered for sale directly to a consumer or, in original packaging, to a retail food store, “and (b) A food that is not offered for sale through interstate commerce.”

And the Department’s own guidance answers the question a baker would actually ask. From the Maryland Department of Health’s Cottage Food Frequently Asked Questions, last updated November 2025:

“39. Can I sell my cottage foods over the Internet? Cottage foods produced in Maryland can only be sold within the State. It is not permissible to distribute the products across State lines. You may advertise your cottage food products online but sales are restricted to Maryland only.”

“40. Can I mail my products to my customers? … You may mail your product, but only within the State of Maryland.”

So two things are true at once, and they are the reason this vertical is interesting. Mail order is explicitly allowed — Maryland is not one of the states that makes a home baker hand the box over in person. You may ship. And you may only ship to Maryland.

A Baltimore home baker is therefore permitted to run a real online store — a cart, a checkout, a shipping label, a tracking email — and that store has to decline a Virginia address. Not flag it. Not add a surcharge. Decline it. The order from a customer’s sister in Alexandria who saw the cookies on Instagram is not a difficult order; it is an order the business is not lawfully able to accept, and the only place that judgment can be made cheaply is the moment the address is typed.

Worth noting honestly: the regulation says “offered or sold only in the State” and defines the product as one “not offered for sale through interstate commerce,” while the Department’s FAQ says you may advertise online. A nationally visible storefront is arguably an offer made everywhere. Those two positions are not obviously reconcilable and there is no Maryland case law on the point. This is how we read it for the businesses we build for, and it is not legal advice.

Why a shipping zone is not the answer

Every serious e-commerce platform can restrict a shipping zone to a single state, and if the story ended there this would be a settings screen and not a section of an article. It does not end there, for four reasons anybody who has run one of these stores will recognize.

The first is that shipping is not the only way an order leaves the building. Local delivery and local pickup are configured separately from shipping on every major platform, and they are exactly the channels a neighborhood bakery uses most. A store can have a perfectly correct Maryland-only shipping zone and still be quietly accepting out-of-state pickup orders, because a pickup order has no address attached to it at all.

The second is that the rule is about where the sale happens and the address fields are about where the parcel goes. A billing address in Pennsylvania with a shipping address in Towson is a normal, honest order — somebody buying their mother a birthday cake. Software cannot always tell that apart from a mail-forwarding address, and it does not have to; what it has to do is record what it saw, so the question can be answered later by a person rather than reconstructed from a payment processor’s export.

The third is gift cards, deposits and pre-orders, none of which carry a shipping address at the moment money changes hands. A cottage food business that sells a $75 gift card to an out-of-state relative in November has taken money for cottage food products that will be collected in Maryland in March. Whether that is a sale outside Maryland is a question I am not going to answer in a blog post. Whether your store recorded enough to answer it later is a question about your database schema, and that one has a definite answer.

The fourth is that nobody has decided what a delivery app is. Maryland’s list allows “personal delivery” and “mail order.” Whether a third-party courier summoned through a platform is personal delivery is not addressed in the statute, in COMAR, in the Guidelines or in the FAQ. I checked all four.

And there is a third ceiling, drawn by the city, in customers per day

§21–330.1(e) makes local law mandatory: the owner of a cottage food business “shall comply with all applicable county and municipal laws and ordinances regulating the preparation, processing, storage, and sale of cottage food products.” Baltimore’s applicable law is the home occupation provision at Baltimore City Code Art. 32 §15–507, and it is stricter than most people baking in Hampden realize:

“(d) … Client or customer visits to the site are limited to no more than 3 a day and 10 a week.”
“(e) The receipt, sale, or shipment of deliveries is not permitted on or from the premises, with the exception of regular U.S. Mail or a shipping service that is characteristic of service to residential neighborhoods.”
“(f) A home occupation may not generate noise, solid waste, vibration, glare, fumes, odors, or electrical interference beyond what normally occurs in a residential use.” — Baltimore City Code Art. 32 §15–507

Three customers a day. Ten a week. That is a porch-pickup limit expressed as a number, and it is trivially trackable — a pickup calendar that will not accept a fourth slot on a Saturday is an afternoon of work and it is the difference between a compliant home business and a complaint from a neighbor. Subsection (f) is probably fatal to a home coffee roaster in a Baltimore rowhouse, since roasting is a smell before it is anything else.

The guest list

The third constraint is the one I have never seen written down outside the regulation itself, and it is the one that catches people who are doing well.

A cottage food business may sell directly to consumers, and it may sell to a retail food store — but only after the Department has approved it in writing. COMAR 10.15.03.27C(6) requires the owner to submit the label that will go on the product together with documentation of a food safety course completed within the past three years, approved by both the Department and the American National Standards Institute, covering basic food safety, cleaning and sanitising, personal hygiene, pest control and prevention, and receiving, storing, preparing and serving food. §.27C(7) then says the owner “may not sell or offer for sale a cottage food product to a retail food store until notified by the Department, in writing, that the requirements … are satisfactorily met.” There is no fee and no license — just a review and a wait.

Fine. Now define “retail food store,” because that is where it gets strange. COMAR 10.15.03.02B(68–1)(a)–(b) defines it as “a licensed food service facility that sells prepackaged food items either fresh, refrigerated, frozen, or shelf-stable. A retail food store includes a grocery store, convenience store, retail market, retail bakery, or food cooperative.” And §.02B(68–1)(c) says what it is not:

“a restaurant, mobile food service facility, coffee shop, cafeteria, short order café, luncheonette, tavern sandwich shop, produce stand that only offers whole, uncut fresh fruits and vegetables, or an establishment that offers only prepackaged non-potentially hazardous foods.” — COMAR 10.15.03.02B(68–1)(c)

Read the list again. A cottage food business in Hampden may, with the Department’s written blessing, put its cookies in the corner grocery. It may not put them in the coffee shop four doors down. The coffee shop is named in the exclusion. So is the café, so is the luncheonette, so is the food truck. The single most natural wholesale customer for a Baltimore home baker — the independent coffee bar that wants a tray of scones on the counter every morning — is the one customer the regulation specifically carves out.

Notice what kind of fact that is. Whether a wholesale customer is lawful is not a property of the order, the product or the price. It is a property of how that customer is classified in a state regulation. It is a field. It belongs on the customer record, next to the delivery window and the invoice terms, and in every wholesale order book I have ever seen it is not there, because the platform that sold you the order book had no idea the distinction existed.

Three constraints, then, and not one of them is about food. A ceiling on the business, a border around the buyer, and a guest list of the channels. All three are questions about the order rather than about the loaf, and all three are invisible to software that thinks a shop is a list of products with quantities.

So we went looking for the app that does this

At this point the reasonable objection is: surely somebody sells this. Three constraints, all mechanical, all expressible as rules — that is what an app store is for. So we spent a morning checking, on 16 September 2026, and the answer is worth writing down carefully, because it is the clearest evidence I have that the gap in this trade is real rather than rhetorical.

The border, you can mostly buy. Shipping zones restricted to Maryland are a standard feature everywhere. The gaps are the ones above: local delivery and pickup are configured separately, gift cards have no address, and nothing records the decline.

The guest list, you cannot buy, but it is trivial to build. It is one field on a customer record and a rule that reads it. No platform ships it because no platform knows the distinction exists.

The ceiling, on the largest hosted platform in the world, does not exist as a product at all. We went through the Shopify App Store’s order-limit category — 136 apps whose own category description reads “Cap how many items someone can buy. Set weight limits, minimum purchase amounts, and other constraints, too” — and checked eleven listings individually. Every one of them counts units, orders, weight, or the value of a single order, or gates access for an individual customer. Minmaxify Order Limits ($10, $20 and $50 a month) does minimums and maximums per cart. Capacity ($9.99 a month) does daily, weekly and custom order counts. SmartStockCap (free) hides a product when a unit cap is hit. Locksmith ($12 to $199 a month by plan) can lock a store by customer tag, passcode, secret link, geography, purchase history or date — and has no revenue key. Not one of them tracks cumulative gross sales across the store against a threshold and stops selling.

Nor does the platform itself. Shopify’s own help page on managing increased sales offers three answers under “Limit orders,” and all three are manual: “Manually remove your Add to cart button” — followed by the instruction to “Make sure to add the button back at the start of your next day” — “Manually adjust your shipping zones,” and set inventory to a daily maximum by hand each morning. The Pause and Build plan does deactivate checkout across all sales channels, but it is a plan switch a human performs, not something a number can trigger.

You can build it. Shopify Flow is free from the Basic plan up, and the pieces are there: an Order paid trigger, a Run code action, and shop metafields to hold a running total between runs. Wire those together and you have a year-to-date counter that unpublishes the catalogue when it crosses a line. Three things are worth knowing before you do. Flow has no year-to-date sales variable, so the counter is hand-rolled and two simultaneous orders can race it. There is no action anywhere in Flow that closes a store — you have to loop over the catalogue and unpublish products one at a time, and republish them all to reopen. And it fires on Order paid, after the money has moved, so the cap is overshot by whatever was in flight. A genuine hard stop needs a checkout validation function, which is what the order-limit apps use, and none of them exposes a store-wide revenue counter to it.

The interesting contrast is WooCommerce, where this does exist. Order Restrictions for WooCommerce, by Flintop, sells for $49 a year and its store-wise module says exactly what a Maryland baker needs to hear: it will “restrict the order placement on your site when more than the specified number of order(s) or Total value is reached,” and its documentation instructs you to “input the amount above which the users will not be allowed to purchase from the shop.” It blocks order placement with an error on the cart page rather than closing the store, and its restriction window is a date range you set rather than a rolling year that resets itself — so an annual cap means re-arming it every January. Order Limit for WooCommerce does something similar for “total orders or order values over a defined time period.” Two hundred-odd sites use the first one. It is a $49 plugin, and it is the only shrink-wrapped software we could find anywhere that implements the actual shape of Maryland’s rule.

None of that is a criticism of Shopify, which is an excellent product built for a hundred and eighty countries and cannot reasonably model a revenue cap that exists in one American state. It is the point of the article. The rules that decide whether a small food business is operating lawfully are specific, numeric and local; the software it runs on is general, global and sold by the month. The distance between those two facts is exactly the size of a custom build, and it is smaller than most owners think.

The label is a calculation, not a text field

Ask a baker what a label is and they will describe a sticker. Ask a system what a label is and the honest answer is that it is a report — a derived document whose every line is computed from something else, which is why it goes wrong so reliably.

Maryland requires seven things on a cottage food label, and unusually the list is in the statute itself. Health–General §21–330.1(c)(2): the name and address of the business, or its name, phone number and the identification number the Department assigns it; the name of the product; “the ingredients of the cottage food product in descending order of the amount of each ingredient by weight”; the net weight or net volume; “allergen information as specified by federal labeling requirements”; nutritional information as specified by federal labeling requirements if any nutritional claim is made; and, printed in 10 point or larger type in a color that provides a clear contrast to the background of the label:

“Made by a cottage food business that is not subject to Maryland’s food safety regulations.”

For a product going to a retail food store, three more: the phone number, the e-mail address, and the date the cottage food product was made. The regulation then specifies what those contact details are for. COMAR 10.15.03.27C(8): the phone number “shall enable contact with the cottage food business by the Department within 24 hours.” §C(9): the e-mail address “shall enable contact … within 48 hours.” A label field with a service level attached to it is an unusual thing, and it tells you exactly what the Department thinks the label is for.

Now look at the ingredient line, which is where the calculation hides. Ingredients and sub-ingredients in descending order of weight means the label is a function of the recipe, and the recipe is a function of your suppliers. Change flour brands and the sub-ingredients in the parentheses change. Change the chocolate and the soy lecithin may or may not still be there. The state’s own model label spells the chain out — “Enriched flour (wheat flour, niacin, reduced iron, thiamine, mononitrate, riboflavin and folic acid), butter (milk, salt), semi-sweet chocolate chips (sugar, chocolate, cocoa butter, milkfat, soy lecithin, natural flavors)” — and then, underneath, “Contains: Wheat, eggs, milk, soy, walnuts.”

That “Contains” line is not typed. Or rather, it is typed, everywhere, by everyone, and that is precisely the bug. It is a derived value: the set of major food allergens present anywhere in the ingredient tree. Federal law is specific about its form — 21 U.S.C. §343(w)(1) requires either the word “Contains” followed by the food sources, printed immediately after or adjacent to the ingredient list “in a type size no smaller than the type size used in the list of ingredients,” or the source named in parentheses within the list itself. §343(w)(2) adds a trap for bakeries: for a tree nut, fish or crustacean shellfish, you must name the specific type of nut or species — “tree nuts” is not a declaration, “walnuts” is. And §343(w)(4) reaches into places a recipe card does not: “a flavoring, coloring, or incidental additive that is, or that bears or contains, a major food allergen shall be subject to the labeling requirements of this subsection.”

The ninth allergen, and Maryland’s own regulation getting it wrong

There are now nine major food allergens. The FASTER Act of 2021 (Pub. L. 117–11, approved 23 April 2021) amended 21 U.S.C. §321(qq)(1) by, in the Act’s own words, “striking ‘and soybeans’ and inserting ‘soybeans, and sesame’,” applying to any food “introduced or delivered for introduction into interstate commerce on or after January 1, 2023.”

Here is a small thing I did not expect to find. COMAR 10.15.03.02B(44)(a), Maryland’s own definition of “major food allergen”, lists milk, egg, fish, crustacea, tree nuts, wheat, peanuts and soybeans. Sesame is not in it — and that regulation was last amended effective 11 December 2023, almost a year after sesame became a federal allergen. Meanwhile the Department’s own November 2025 cottage food guidance prints the definition with sesame inserted and attributes it to B(44). Maryland’s guidance misquotes Maryland’s regulation.

The practical answer is not in doubt, because the statute routes around it: §21–330.1(c)(2)(i)5 requires “allergen information as specified by federal labeling requirements,” and federal law includes sesame. Declare it. But notice the shape of the thing — three layers of authority, three slightly different answers, and a baker in the middle who is supposed to reconcile them on a sticker. There is a further wrinkle, which is that the federal duty is keyed to interstate commerce and a Maryland cottage food business by definition never enters it; the state pulls the federal rule back in by reference. I would not build a business on that distinction, and nor would I ignore how strange it is.

Sesame is the hardest of the nine for a bakery anyway, because it arrives without being an ingredient. It is on the bun, in the za’atar, in the tahini, in the seed blend, and in the flour of a mill that also runs seeded blends. In a system where the allergen statement is computed from a bill of materials, adding sesame to one seed mix updates every label that mix touches, in one action. In a system where the allergen statement is a text field on a product record, adding sesame to one seed mix updates nothing at all, and the next person to notice will be a customer.

This is the single most valuable thing custom software does for a small food producer, and it is unglamorous: it makes the label a report. Recipes reference ingredients, ingredients carry allergens and sub-ingredients, and a label is generated, versioned and dated. Change a supplier and every affected label reprints. Nobody retypes anything. It is not clever. It is the difference between a business that knows what is in its own products and a business that believes it does.

The exemption that does not travel in the box

There is a federal exemption almost every counter bakery in America relies on without knowing its number, and it has a clause in it that stops working the day you start shipping. 21 CFR 101.9(j)(3) exempts from nutrition labeling food products that are ready for human consumption, offered for sale to consumers but not for immediate consumption, “Processed and prepared primarily in a retail establishment,” and — the fifth element —

“(v) Not offered for sale outside of that establishment (e.g., ready-to-eat foods that are processed and prepared on-site and sold by independent delicatessens, bakeries, or retail confectionery stores where there are no facilities for immediate human consumption…)” — 21 CFR 101.9(j)(3)(v)

The elements are conjunctive. The cookie made behind your counter and sold over your counter is exempt. The same cookie, listed on your website and put in a box, is not. The exemption was granted in exchange for the food staying in the room, and the room is the consideration. Maryland writes the same bargain in its own words at COMAR 10.15.03.12B, which lets a food service facility sell bulk unpackaged bakery goods with no label at all provided no claim is made and the food was made on the premises — and the moment the loaf goes into a bag for shipping, §.12A applies in full instead, including “an accurate declaration of the quantity of the package contents by weight in both metric and English units” and the food source for each major food allergen.

Two governments, two legal systems, thirty years apart, and both of them drew the same border: the exemption stops at the door. Maryland’s cottage food rule draws a third one at the state line. Nothing about a shopping cart knows that any of these exist.

Net weight, and the other thing a scale is for

The net quantity line has its own trap, and it is the one place where a bakery and a coffee roaster diverge sharply. The governing rule is 21 CFR 101.7 — not 101.105, which was redesignated a decade ago and which half the internet still cites. It requires the declaration on the principal display panel, “within the bottom 30 percent of the area of the label panel in lines generally parallel to the base,” and it sets minimum type by panel area: not less than 1/16 inch on a panel of 5 square inches or less, 1/8 inch above 5 and up to 25, 3/16 inch above 25 and up to 100, and 1/4 inch above that. Most 12-ounce coffee bags have a front face somewhere between 25 and 100 square inches, which puts them in the 3/16 inch band — a cap height of roughly 13.5 points, which is larger than most bag designs assume. §101.7(j)(3) also insists on the exact words: “The term ‘net weight’ shall be used when stating the net quantity of contents in terms of weight,” and FDA’s own worked example at §101.7(m)(2) shows three-quarters of a pound as “Net Wt. 12 oz.”

Metric is where it gets interesting for anyone shipping. §101.7(p) says metric “may” also appear — but the Fair Packaging and Labeling Act at 15 U.S.C. §1453(a)(2) says the quantity “shall” be stated in both customary and SI units, exempting only foods “packaged at the retail store level,” and FDA never conformed §101.7 to the 1992 amendment. A roaster packing centrally and shipping is not packaging at retail level. Maryland resolves the ambiguity independently and in the same direction: COMAR 15.03.02.01 incorporates the Uniform Packaging and Labeling Regulation from NIST Handbook 130, 2022 Edition, whose §6.1 states that “effective February 14, 1994, appropriate units of both systems shall be presented in a declaration of quantity,” and applies it to packages “produced, kept, offered, or exposed for sale in this State.” So: NET WT 12 OZ (340 g), bottom thirty percent, 3/16 inch on a typical bag.

And the rounding has a sting. Twelve ounces is 340.194 grams; the packer may round the metric figure down to 340 g to avoid overstating the contents. But Handbook 130 also says the larger of the two declarations is the one used for enforcement — so rounding down on the label does not lower the weight you are actually tested against. Coffee also degasses in the bag. A roaster who fills to exactly 340 grams is filling to the wrong number.

That single fact — that a roaster’s net weight is a promise about a product still losing mass — breaks the inventory model of every generic e-commerce platform, which assumes a unit of product corresponds to a unit of something you bought. It does not. Green coffee loses weight in the roaster: water leaves, dry matter combusts, and what comes out weighs meaningfully less than what went in, conventionally somewhere in the region of an eighth to a sixth of the batch depending on how dark you take it and how wet the lot was. Roasters call it roast loss and they measure it batch by batch because it is not a constant. You buy green by the sack and sell roasted by the twelve-ounce bag, and the conversion between them is a measured percentage that moves with the profile, the humidity and the lot. A roaster who wants to know “how many bags of this can I still sell?” needs the remaining green weight, the expected loss for that profile, and the packaged weight — three numbers, two of which live in a notebook next to the roaster and one of which lives in the online store. Run it the other way and the size of the problem is obvious: at a 16% loss, every pound of roasted coffee you sell consumed about 1.19 lb of green, so a hundred twelve-ounce bags is not 75 lb of inventory, it is 89.3 lb. Get that conversion wrong by two points and your cost of goods is wrong on every bag, permanently and invisibly.

The coffee club became a regulated contract in June, and nobody sent a letter

Every roaster in America is told, correctly, that the subscription is where the money is. Recurring revenue smooths the cash flow, raises the lifetime value of a customer, and turns a commodity purchase into a relationship. So they build one. And on 1 June 2026, without any fanfare that reached this trade, every one of those subscriptions in Maryland came under a statute that did not exist a year earlier.

Md. Code, Commercial Law §14–1329, enacted as Chapter 204 (Senate Bill 49) and its identical cross-file Chapter 205 (House Bill 107) of the Acts of 2025, approved 22 April 2025, in force since 1 June 2026. Its definition is one sentence:

“In this section, ‘automatic renewal’ means any contract, plan, or agreement between a consumer and a seller in which a paid subscription or purchasing agreement is automatically renewed for a subsequent term.” — Md. Code, Com. Law §14–1329(a)

Note what is missing. The bill as introduced, and as it passed both third readers, said “automatically renewed at the end of a definite term of more than 1 month.” That qualifier was struck before enactment. It survives in exactly one place — subsection (d), which says a seller with “an initial definite term of more than 1 month” may not automatically charge a credit card without clear and conspicuous notice and the consumer’s consent. Everywhere else, the term length is irrelevant. There is no minimum. A four-week coffee club is inside the statute. So is a monthly one. So is every recurring order any Maryland food business has running today.

What follows from being inside is not onerous, but it is specific, and it is not how most subscription flows are built. §14–1329(b)(1) requires the terms to be presented “in a clear and conspicuous manner before the subscription or purchasing agreement is fulfilled and in visual proximity to … the request for consent,” including the price that will be charged after the initial term ends; an easily accessible disclosure of how to cancel; and a termination path that does not “unreasonably delay, hinder, or obstruct” cancellation.

Then §14–1329(b)(3) sets out what the cancel button has to be, and this is the provision most small roasters would fail today. The mechanism must be “cost–effective, timely, and easy–to–use,” and it must:

“1. Be at least as easy to use as the mechanism the consumer used to consent to the automatic renewal; 2. Be available through the same medium the consumer used to consent to the automatic renewal; 3. In the case of cancellation by electronic medium, be easy to find, not require interaction with a live or virtual representative unless the consumer interacted with a live or virtual representative to consent … and include: A. A prominently placed direct link or button to initiate the cancellation process … or B. An immediately accessible termination e–mail formatted and provided by the business … that a consumer may send without additional information” — Md. Code, Com. Law §14–1329(b)(3)(ii)

Sign up online, cancel online. Not by e-mailing the shop and waiting for somebody to read the inbox on Monday. Not by replying to a shipping notification. The statute does allow an e-mail route, but it has to be a pre-formatted cancellation e-mail the business supplies, which the customer can send without adding anything — and a link or button is the other option. Most small roasters are running the exact inverse: subscribing is two clicks and cancelling is a conversation.

The notice requirement has the most awkward software consequence, because it has a floor and a ceiling. Under §14–1329(c)(3), where the customer accepted an offer with an initial term of at least a year, the renewal notice must go out “not less than 15 days and not more than 45 days before the date when the automatic renewal is scheduled to take effect.” Under §14–1329(c)(2), where the offer included a free gift or trial lasting more than 14 days, the window is “not less than 3 days and not more than 21 days.”

A notice sent too early is as non-compliant as one sent too late. That is not how marketing automation thinks. Marketing automation thinks in reminders, and a reminder that went out early is a reminder that went out. Here it is a window, anchored to a renewal date that itself moves every time a customer skips a shipment, pauses for a holiday or changes the interval — which is precisely what subscription customers do, constantly. The notice has to be scheduled from a date that is still being edited. Get that wrong in either direction and you have a compliance failure produced entirely by a scheduler.

And there is a gap in the drafting worth knowing about, because it will affect more Maryland coffee clubs than anything else in the section. Subsection (c)(1) requires notice before the end of any automatic renewal. But only (c)(2) and (c)(3) supply deadlines — for trials over fourteen days, and for initial terms of a year or more. A plain monthly or six-week coffee subscription with no trial owes a notice under (c)(1) and has no statutory window at all. That is a reading of the enacted text; there is no case law and no Attorney General guidance. The practical answer is to send something sensible and consistent and to be able to prove you did, which is again a records question.

On enforcement, the statute is narrower than people assume, and I would rather you heard the accurate version. §14–1329(g) makes a violation “an unfair, abusive, or deceptive trade practice” subject to Title 13’s enforcement and penalties — except §§13–408 and 13–411, which are the private damages action and the criminal misdemeanour. And §14–1329(h) says flatly: “Nothing in this section may be construed to authorize a private right of action under this section or any other law.” So there is no customer lawsuit and no class action here. What remains is Attorney General enforcement under §13–410, with civil penalties not exceeding $10,000 for each violation and $25,000 for each subsequent one. Low probability, high ceiling — which is the risk profile people are worst at pricing.

The federal rule everyone read about was vacated, and the 1973 one came back

If you followed this in the trade press in 2024 you will remember the Federal Trade Commission’s “click–to–cancel” rule, and you may still be operating on the assumption that it governs you. It does not. In Custom Communications, Inc. v. FTC, 142 F.4th 1060, decided 8 July 2025, the Eighth Circuit held that the Commission had failed to follow the procedural requirements of §22 of the FTC Act and vacated the rule in its entirety, expressly rejecting the Commission’s request for narrower, party-specific relief as “not feasible” given the breadth of the rule’s coverage. The defect was procedural: the Commission had preliminarily determined the amendments would not cross the $100,000,000 threshold that triggers a preliminary regulatory analysis, its own administrative law judge found otherwise, and it finalised anyway.

The Commission then finished the job itself. A final rule at 91 FR 6507, effective 12 February 2026, recodified “the text of the Negative Option Rule as it existed before the effective date of the Commission’s 2024 final rule” — including changing the name back to “Use of Prenotification Negative Option Plans” — and an advance notice of proposed rulemaking at 91 FR 12318 on 13 March 2026 reopened the question. Comments closed on 13 April 2026 and nothing has been re-proposed since.

So the 1973 rule is back in force, and it is built around mailed announcements, forms, return dates and ten-, fifteen- and twenty-day intervals — a book-club machine. A modern coffee subscription that simply bills and ships the same thing every month is almost certainly not a prenotification negative option plan at all, which means the rule that came back does not reach it.

What does reach it is a statute, which no court vacated: the Restore Online Shoppers’ Confidence Act, 15 U.S.C. §8403. It makes it unlawful to charge a consumer for goods sold online through a negative option feature unless the seller “(1) provides text that clearly and conspicuously discloses all material terms of the transaction before obtaining the consumer’s billing information; (2) obtains a consumer’s express informed consent before charging …; and (3) provides simple mechanisms for a consumer to stop recurring charges.” Three obligations, in force the whole time, and they read like an abbreviation of the Maryland statute.

The practical upshot for a Baltimore roaster is simple and does not depend on how any of the federal rulemaking turns out. Disclose the recurring terms on the page where the card details are entered, record the consent with a timestamp, and put a cancel button in the customer’s own account that stops the next charge immediately. Do those three things and you satisfy ROSCA, you satisfy §14–1329(b), and you will satisfy whatever the FTC eventually re-proposes. None of them is hard. All of them are structural, which is why bolting a subscription app onto a storefront gets you the billing and leaves you the compliance.

The other thing you are selling is a date

Retail software has one deep assumption baked into it: a product is a thing that exists, sitting somewhere, waiting. Quantity on hand. Reorder point. Pick, pack, ship. That model is so universal it is invisible, and it is wrong for both halves of this article.

A bakery does not have inventory in the morning. It has capacity. The wedding cake ordered in September for a date in November is not a unit of stock; it is a claim on eleven hours of one decorator’s time in a specific week, plus oven space, plus a fridge shelf big enough to hold it. Two cakes that look identical in a catalogue can consume wildly different amounts of the only resource that actually runs out. And the constraint is never the shop’s capacity for the year — it is the capacity of one Saturday, which is also everybody else’s Saturday.

So the question an online cake order form has to answer is not “is this in stock?” It is “given everything already promised, can this shop deliver this thing on this date?” That is a scheduling problem wearing a shopping cart’s clothes, and it is why so many bakeries end up with an order form that collects a request and a phone number, and a human who spends an hour every evening turning requests into promises. The e-commerce platform did the easy half.

A roaster has the same problem from the opposite direction. Roasted coffee has a roast date, and that date is the product’s most important attribute and the only one that changes while the product sits there — and here is the odd part: no federal rule requires it to be printed at all. Except for infant formula, which must carry a “Use by” date under 21 CFR 107.20(c), product dating is not required by federal regulation. Every roast date on every bag in America is there because the trade decided it mattered, not because anybody made them. It is the single most commercially important attribute of the product, it is entirely voluntary, and consequently no platform has a field for it. A bag that is excellent on day five is tired on day forty. So a roaster does not want to hold stock; a roaster wants to roast to order, which means the catalogue is not a list of what exists but a list of what will exist, on which roast day. Subscriptions sharpen this further, because a hundred and twenty subscribers whose renewal dates have drifted apart over two years generate a roasting schedule of maximum inconvenience, whereas the same hundred and twenty aligned to Tuesday and Friday roasts generate two clean batches. The difference between those two businesses is not equipment. It is whether the software that schedules the renewals knows that roast days exist.

The shipping estimate on your product page is a legal representation

There is a federal rule that applies to every single business in this article that takes an order online, that almost none of them have heard of, and that reads as though it were drafted by somebody who had thought hard about software. It is the Federal Trade Commission’s Mail, Internet, or Telephone Order Merchandise Rule, 16 CFR Part 435, and its central provision is this:

It is an unfair or deceptive act or practice for a seller “to solicit any order for the sale of merchandise to be ordered by the buyer through the mail, via the Internet, or by telephone unless, at the time of the solicitation, the seller has a reasonable basis to expect that it will be able to ship any ordered merchandise to the buyer: (i) Within that time clearly and conspicuously stated in any such solicitation; or (ii) If no time is clearly and conspicuously stated, within thirty (30) days after receipt of a properly completed order.” — 16 CFR §435.2(a)(1)

“Ships in 2–3 business days” on a product page is a solicitation containing a clearly and conspicuously stated time. So is “roasted and shipped every Tuesday.” So is the two-week lead time on the custom cake form. Each of those is a representation the business has to have had a reasonable basis for when it made it — not on average, not usually, but at the time of the solicitation. And if you state nothing at all, the rule fills the gap with thirty days, which is a long time for a loaf of bread and an eternity for a subscription customer.

If you cannot ship in time, §435.2(b)(1) requires you to offer the buyer, “clearly and conspicuously and without prior demand, an option either to consent to a delay in shipping or to cancel the buyer’s order and receive a prompt refund,” and “prompt refund” is defined at §435.1(b)(1) as one sent within seven working days of the buyer’s right to a refund vesting. Not “when we get to it.” Seven working days.

Now the provision that makes this a software article rather than a compliance article. §435.2(a)(4):

“In any action brought by the Federal Trade Commission, alleging a violation of this part, the failure of a respondent-seller to have records or other documentary proof establishing its use of systems and procedures which assure the shipment of merchandise in the ordinary course of business within any applicable time set forth in this part will create a rebuttable presumption that the seller lacked a reasonable basis for any expectation of shipment within said applicable time.” — 16 CFR §435.2(a)(4)

Read that as a specification. The federal government has written down, in a trade regulation rule, that the absence of a record is evidence against you. A bakery that promises three days and ships in three days but cannot show it is in a materially worse position than one that keeps a plain log of order date and ship date. The rule does not ask for software. It asks for “systems and procedures,” and it asks you to be able to prove they exist. The cheapest honest way to do that is two timestamps and a report, and the cheapest honest way to be unable to do it is to run your store on a platform that records when the order came in and when the label was printed but never puts the two next to each other.

There is no exemption for food. §435.3(a) lists what the rule does not cover — subscriptions ordered for serial delivery after the initial shipment, orders of seeds and growing plants, collect-on-delivery orders, and prenotification negative option plans — and perishables are not on the list. Note what that means for a coffee club: the first shipment of a subscription is squarely inside the rule, and the ones after it are not. The single most common failure mode in subscription coffee — a delayed first box while a new customer waits and wonders whether they have been scammed — is the one shipment the rule actually reaches.

Your tax status is a ratio you compute about yourself

Most retailers learn their sales tax treatment once and never think about it again. Bakeries and coffee shops do not get that. In Maryland the taxability of the box of croissants a customer carries home is not a property of croissants. It is a property of your sales mix, recomputed continuously, and almost nobody who owns one of these shops knows it.

The test is in the statute. Tax–General §11–206(a)(6): “‘Substantial grocery or market business’ means a business at which at least 10% of all sales of food are sales of grocery or market food items, not including food normally consumed on the premises even though it is packaged to carry out.” And §11–206(c)(1) exempts “a sale of food for consumption off the premises by a food vendor who operates a substantial grocery or market business at the same location” — with (c)(2) pulling back out anything served for on-premises consumption, and anything that is “food for immediate consumption.”

Then the Comptroller’s Business tax tip #5 answers the question for this trade specifically:

“Are sales at a bakery considered grocery or market food items? Yes. However, when calculating if a business meets the 10 percent threshold for a substantial grocery or market business, you may not include sales of single servings, heated or prepared food or sales to be consumed on the premises.” — Comptroller of Maryland, Business tax tip #5: How are Sales of Food Taxed in Maryland?

Sit with that. Your take-home sales are exempt only if you are a substantial grocery or market business, and you are one only if qualifying sales are at least a tenth of your food sales — with single servings, anything heated, and anything eaten on the premises stripped out of the qualifying side. That is a fraction whose numerator is a subset of the till and whose denominator is the whole till.

Now add an espresso machine. Every latte is a single serving. Every warmed breakfast sandwich is heated and prepared. Every pastry eaten at the window counter is consumed on the premises. All of them enlarge the denominator and none of them enlarges the numerator. A bakery that adds a coffee program — which is exactly what every bakery in Baltimore has done in the last decade, for perfectly good margin reasons — is pushing its own ratio downward, month by month, toward a line that changes the tax treatment of the bread.

Most bakeries are nowhere near that line and a shop whose whole business is boxed take-home goods is fine. The point is the shape of the fact, not its likelihood: a number your point of sale already has, that nobody ever computes, determines the tax treatment of a different number your point of sale also has. A report showing the ratio by month is an afternoon of work. It is worth more than most of the dashboards people pay for, and I have never once seen it on a screen.

The counter, the chairs and the market hall

What counts as “on the premises” is defined more broadly than anyone expects. COMAR 03.06.01.05: “‘Facilities for food consumption’ means items such as tables, chairs, booths, benches, counters, and stands set aside or made available for the consumption of food sold. The term does not include parking spaces for vehicles as the sole accommodation. If, however, any of the above-described equipment is located on a parking lot, this equipment constitutes ‘facilities for food consumption’.” Two chairs and a shelf by the window are facilities.

And there is a rule in Business tax tip #5 that reads as though it were drafted with this city in mind:

“If a public market provides eating facilities for the use of any vendors in the market, food vendors who conduct substantial grocery or market businesses are required to collect the tax on sales of food intended for consumption at these facilities. Other food vendors in the market are required to collect the tax on all their sales.” — same source

Baltimore runs on public markets — Lexington, Cross Street, Broadway, Belvedere Square, Avenue Market, Mount Vernon Marketplace, R. House and every hall that has opened since. A bakery stall in a market with communal tables is in a different tax position from the identical bakery on a corner two blocks away, and if that stall is not a substantial grocery or market business in its own right, the rule as written has it collecting tax on all of its sales — not only the ones eaten at the shared tables.

So one business selling one croissant has at least three possible answers depending on the room it is standing in: the shop, the market hall, and the farmers’ market tent in a parking lot, which the regulation expressly says is not a facility on its own. A multi-channel bakery in this city is running several tax treatments simultaneously from one product catalogue, and the only place that distinction can live is the channel field on the order.

Coffee is food. Hot coffee is not.

The coffee side has its own line, and it is drawn by temperature. §11–206(a)(3) names coffee as food in terms — “‘Food’ includes … beverages, including coffee, coffee substitutes, cocoa, fruit juices, and tea” — and then excludes alcoholic beverages, soft drinks and carbonated beverages, cannabinoid beverages, and candy or confectionery. §11–206(a)(4) defines “food for immediate consumption” as an exhaustive five-item list: salad, soup or dessert bar food; party platters; heated food; sandwiches suitable for immediate consumption; and frozen desserts in containers of less than a pint. Bakery items as a category are not on it.

The Comptroller’s List of Tangible Personal Property and Services Subject to Sales and Use Tax then applies all of that to the actual counter. On the exempt side: “Coffee,” “Iced coffee,” “Tea,” “Bakery products,” “Bread,” “Cookies,” “Frosting & Icing.” On the taxable side: “Coffee (heated)” and “Donuts (heated).” And the category rule for this trade, verbatim: “Grains and flours and products made from these ingredients, including breads and bakery items, but not including items packaged or sold as ready-to-eat single servings.”

That last row is the one that will cost somebody money this Christmas, and it is the most e-commerce-specific rule in Maryland tax guidance. The Comptroller’s list states it plainly: if an exempt food is sold in combination with a taxable food or non-food item, “the entire charge is subject to sales tax. There is no allocation of the purchase price between taxable and non-taxable items.” A holiday gift box — two bags of coffee, a tin of shortbread and a ceramic mug, one price, one SKU — is taxable end to end, including the coffee that would have been exempt on its own. Sell the same four things as four lines on one order and three of them are exempt. The tax outcome is decided by how you built the product, not by what is in the box. No off-the-shelf store will warn you about that, and the fix is a tax class per component and a bundle that knows it is a bundle.

Two more that matter once you ship. Shipping charges are outside the taxable price under Tax–General §11–101(l)(3)(i)1 only when “stated as a separate item” — roll delivery into the item price and you have made it taxable. And if you sell beyond Maryland, COMAR 03.06.01.33 sets the out-of-state collection trigger at gross revenue from deliveries into a state exceeding $100,000 or 200 or more separate transactions, in the previous or current calendar year. Maryland never repealed the transaction prong, and other states have their own. Two hundred orders is not much for a roaster with a mailing list, and it is a count, not a revenue figure — which means a business can acquire a filing obligation in a state it has barely sold anything in.

One useful asymmetry while we are here: a marketplace like Etsy is a marketplace facilitator and collects Maryland tax for you. Shopify is not a marketplace — it is your own store, so you are the vendor and the registration and collection are yours. Moving from a marketplace to your own storefront is usually a good decision and it quietly transfers a compliance job you did not previously have.

And a small irony worth a sentence. Since 1 July 2025, Tax–General §11–104(l) has applied a 3% sales and use tax to data and information technology services and to software publishing services, keyed to NAICS sectors 518, 519, 5415 and 5132, under Chapter 604 of the Acts of 2025. Which means the storefront subscription, the hosting, the point of sale software and the contracted development work that a Maryland bakery buys in order to comply with everything above are themselves now taxed. We wrote about that in more detail here.

A deposit is a promise about a Saturday

Of everything in this trade that software handles badly, the custom cake order is the worst, and it is worth its own section because it is where a bakery’s money and its reputation are both most exposed.

Go and read what bakers actually ask each other about it. On CakeCentral, the trade’s long-running forum, the recurring threads are “How Much Deposit Do You Require For A Wedding Cake?”, “When Do You Require A Deposit?”, “How Far In Advance Do You Book Consults?”, “Please Help…last Minute Cake Cancellation” and “Help Wedding Cancelled”. And then there is the one that ought to be printed above every bakery e-commerce product page in the country:

“Are Some Of You Really Taking Orders Via Text Messages And Fb Messages?” — thread title, CakeCentral forum

Yes. They really are. Not because they are disorganized, but because no cart on the market can take the order properly, so the cart collects a name and a human finishes the job in a direct message at half past nine at night.

Here is why the cart cannot do it. A deposit on a custom cake is not a part-payment on an item. It is a reservation against capacity on a specific date, priced against a product that does not exist yet and whose final price is not known at the moment money changes hands, because the customer has not decided between three tiers and buttercream or fondant. The generic e-commerce primitive — product, quantity, price, pay in full — is wrong in every particular. What the order actually needs is a date with a capacity check behind it, a lead-time minimum that varies by product (a sheet cake is three days; a tiered wedding cake is six weeks), a deposit that is a percentage of an estimate rather than a price, a balance due on a rule rather than on a date, and a cancellation policy that changes as the date approaches.

That last one is where the arguments happen, and it is genuinely a data model rather than a temperament. A deposit taken in September for a November wedding is refundable in September and is not refundable in the last fortnight, because by then the bakery has turned away other work for that Saturday and bought product. Almost nobody writes that down in a form the system enforces, so it gets litigated by text message, once per cancellation, forever. A policy that the checkout states at the moment of payment and the system then applies on its own is not a legal nicety; it is the difference between a rule and an argument.

Two things from earlier in this article land directly on this. The lead time you publish is a representation under 16 CFR §435.2(a)(1), and the records showing you met it are what §435.2(a)(4) presumes you do not have. And a deposit is revenue — taken this year, against a cake collected next year — which means it lands somewhere in that trailing-twelve-month cottage food total whether or not anybody has decided where. The day a home baker takes $300 of deposits in December for March weddings is the day the ceiling and the calendar start interacting, and no spreadsheet built for cakes has ever had a column for it.

None of this is hard to build. It is a calendar with capacity, a product with a lead time, an order with a deposit and a balance, and a policy that the system knows. It is perhaps two weeks of work, and it replaces the single most expensive hour in a cake shop’s day, which is the one after closing.

The order book is the other half of the business, and it is nobody’s product

Ask a Baltimore roaster where the revenue actually comes from and the answer is usually wholesale — the cafés, the restaurants, the office accounts, the other bakery across town that serves your beans. Ask a bakery the same question once it has grown past the counter and you get the same answer: the restaurants that take burger buns four mornings a week, the hotel that takes breakfast pastry, the caterer who orders in bursts. Retail is the shop window. Wholesale is the payroll.

How much of it there is, honestly, nobody can tell you precisely. The 2022 Economic Census publishes a class-of-customer table, and for baked goods stores (NAICS 445291) it says 86.1% of sales go to household consumers, leaving 13.9% to retailers for resale, wholesalers and distributors, and hotels, restaurants and foodservice. But that table excludes NAICS 311811, the retail bakeries that actually bake, and no published source anywhere gives a wholesale-versus-retail split for artisan bakeries specifically. If you have seen a confident “70/30” on a trade blog, it came from nowhere. What the Census does tell us is the shape: for this city, it is the twelve commercial plants at the top of this article, and a long tail of shopfronts with a growing side business nobody has measured.

And wholesale runs on a structure that consumer e-commerce does not have a word for: the standing order. Not a subscription, which is a consumer contract with a renewal date and a cancellation right. A standing order is a rhythm. Twelve dozen on Tuesday, Thursday and Saturday, more on the Saturday before a holiday, nothing the week they close for renovation, and a different figure entirely in August. Everyone involved treats it as fixed, and it changes constantly, usually by text message at nine at night.

What that structure needs is unglamorous and specific. It needs a cut-off time, because a bakery that mixes at three in the morning must know by nine the night before what it is mixing. It needs per-customer pricing, because wholesale prices are negotiated one relationship at a time and the same case goes out at three different numbers. It needs a delivery day and a route, because the van has an order and the order is not alphabetical. It needs the pick list and the invoice to be generated from the same record, because the single most common source of wholesale friction in this trade is a delivery that does not match the paperwork, and the second most common is an invoice nobody can reconcile against what was actually dropped. And it needs a credit note path, because things do get dropped.

None of that is exotic. All of it is missing from the consumer platforms, which is why the wholesale side of most small food businesses runs on a shared spreadsheet, a WhatsApp group and one person’s memory. The marketplaces that do serve this — the ordering networks that sit between restaurants and their suppliers — solve the communication problem and introduce a different one, because they put a third party between you and a customer you already had, and they are not free.

There is a quieter cost in all this that owners rarely price. When the order book lives in a spreadsheet, the business cannot answer questions about itself. Which accounts have quietly shrunk 20% since spring? What is the real margin on the wholesale line once delivery labour is in it? Which customer has not increased their price since 2023? Those are not analytics questions; they are the questions that decide whether the wholesale business is worth having. A shop with a real order book answers them in a minute. A shop with a spreadsheet answers them in February, once a year, badly.

The day you cross the line

Everything above describes a business below the ceiling. What happens above it deserves a section, because it is the moment almost every growing food business in this city passes through and almost nobody plans for — and because the fee schedule contains a genuine surprise.

Above the cap you are a food business like any other, and which license you need depends on a ratio. The Department’s own decision tree splits it cleanly: if you are selling retail directly to consumers — including internet sales — with wholesale at 49% or less of total sales, you need a food service facility license from the local health department. If you are wholesale only, or wholesale is more than 50%, you need a food processing plant license from the Maryland Department of Health. The Department’s FAQ says it in prose: local licensing “covers retail sales directly to customers, including internet sales, and wholesale sales up to 49 percent of total sales.”

So there is a fourth number in this business, and it is a percentage of your own revenue mix that decides which government regulates you. It is the same shape as the tax ratio and the same shape as the cottage food cap: computable from data you already have, tracked by nobody.

The state side is straightforward and cheap. Health–General §21–301(g)(1) names a bakery plant expressly as a food processing plant, and the Department’s published fee for a bakery plant license is $400 a year — the same $400 it charges for a confectionery or a general food manufacturing plant. Two details in the regulation are worth knowing before you apply. COMAR 10.15.04.18B says the Department “shall specify on the food processing license what foods or food types the licensee is authorized to process” — the license is scoped to products, so adding a line is an action, not a decision. And COMAR 10.15.04.14B forbids constructing, remodeling or “manufactur[ing] a food using a new or modified process before receiving written approval of the plans and specifications from the Department.”

Coffee roasters should note that the exclusion they might hope for does not reach them. §21–301(g)(3)(i) excludes a warehouse that “does not process food” and stores only sealed containers of whole bean, ground or instant coffee. Roasting is processing. A roastery is a food processing plant.

Baltimore City: the eight-fold fee swing that has nothing to do with your floor plan

The city side is where it gets interesting. Baltimore’s Food Control Section licenses and regulates over 5,000 food facilities, and the Health Code deliberately keeps the amounts out of the code — Baltimore City Health Code §6–403 says the annual fee for each class is “as set from time to time by the Commissioner, with the approval of the City Council.” The numbers live on the application form the City currently serves, and they read:

Now the part nobody tells you. Baltimore has no bakery license. Health Code §6–101(d) borrows the definition of “food service facility” straight from COMAR 10.15.03.02B(34), which covers “a restaurant, coffee shop, cafeteria, short order cafe, luncheonette, tavern, sandwich stand, soda fountain, retail market, or retail bakery outlet” in one breath. One definition for all of them. What separates a $65 license from a $520 one is not the sign over the door and it is not the seating. It is the menu.

COMAR 10.15.03.33, which the City’s fee tiers are bolted to, designates as low priority a facility serving “non-potentially hazardous food that is cut, assembled, or packaged on the premises, such as candy, popcorn, and baked goods.” High priority is for potentially hazardous food prepared “a day or more in advance of service” or through two or more passes across the 41°F–135°F range.

So a bakery selling bread, cookies and unfilled pastry is a low priority facility: $65 a year, no HACCP plan, and an inspection once every two years. Add cream fillings, custards, cheesecake or a sandwich case and you move to moderate or high — $285 or $520, a HACCP plan, and two or three inspections a year. That is an eight-fold fee swing and an entirely different regulatory posture, decided by a product line that a pastry chef might add on a whim in April.

There is an escape hatch at the other end too. Since 13 December 2014, Baltimore has not licensed facilities that offer only prepackaged foods that are not potentially hazardous — they “are no longer considered food service facilities.” A shop that sells only sealed bags of beans and boxed shelf-stable baked goods it did not make is outside the licensing regime entirely.

None of this is theoretical. In January 2013 the City halted production of Berger cookies — the most famous baked good this city makes — over a food license, and production resumed only after an inspection on 14 February 2013 and the fees were paid. If it can happen to Berger, the license is not decorative.

One footnote on all of this that I did not expect. There is no public register of licensed Baltimore City food facilities. Open Baltimore, the city’s open data portal, publishes 978 datasets; twenty-one of them match “food,” twenty-five match “permit,” eleven match “restaurant” — and zero contain the string “baker.” The only food-business point file the city publishes has 1,327 rows, every one of which was last edited in 2008, and exactly one of those rows contains the word “bakery.” The Health Department says it licenses over five thousand food facilities. You cannot download the list, and neither can anybody else. The most recent public version of it that we could find was obtained by researchers at Johns Hopkins in August 2011.

What actually breaks that day is the software

Three assumptions flip at once and nobody edits them. The border disappears: you can ship to all fifty states, which means the sales tax rules of every state you ship into rather than one, and the economic nexus triggers — $100,000 or 200 transactions in Maryland, and something similar elsewhere — start running. The label changes: the cottage food disclaimer comes off, and the nutrition labeling analysis at 21 CFR 101.9(j) restarts against different thresholds, including the retail exemption at (j)(3) that you lose the moment the product is “offered for sale outside of that establishment.” The channel list opens: the coffee shop that was excluded as a wholesale customer becomes an ordinary account, and the wholesale side of the business — the part that, on the Census numbers at the top of this article, carries nearly twice the payroll per head — becomes available for the first time.

What almost every business does at that moment is widen a shipping zone and carry on. The cottage food disclaimer stays on the labels for another eighteen months because it is baked into a print template nobody remembers editing. Out-of-state orders now go through, but the store still assumes one tax jurisdiction. Wholesale customers get set up as retail customers with a discount code, because that is the only tool the platform offers. None of this is negligence. It is what happens when the rules a business runs on are hard-coded into settings screens instead of modeled as facts about the business that can change.

This is the strongest argument for building rather than renting and it has nothing to do with money. If your store knows that it is a cottage food business — as a state of the business, with a date on it — then crossing the line is one change in one place, and the border, the label, the tax treatment and the customer types all follow from it. If your store does not know what it is, crossing the line is forty small edits that nobody makes a list of.

What Baltimore’s bakeries and roasters are actually running

Rather than guess, we checked. On 16 September 2026 we took twenty-six currently-operating bakeries, pastry shops, cake shops and coffee roasters across Baltimore City and the near suburbs, and identified what each one’s website and checkout are actually built on — from the site’s own responses rather than from what anybody says in a press release. Here is the tally.

Four findings fall out of that, and the last one is the reason this section exists.

Seven of the twenty-six — 27% — are running two or more commerce systems at the same time. Not one of those seven is running a single system. The pattern is always the same: a website on one platform, a shop on another, and ordering on a third, with the product list retyped into each. One Baltimore bakery group runs a Squarespace site, two separate Shopify stores and Toast simultaneously. That is not incompetence; it is what happens when each system solves one problem and none of them solves the next one.

Six of the twenty-six — 23% — can put a box on a truck to anywhere in the United States today. Everybody else is selling into a delivery radius, a pickup window, or a counter. For a trade whose products are mostly perishable, that is not a failure; it is a sane response to the fact that shipping a cake is hard and shipping roasted coffee is easy.

Four of the twenty-six — 15% — have no online store at all. One of them is a Hamilton bakery a century old whose site is a hand-built template with broken HTTPS and a phone number. Another takes payment through a personal payment-app handle on a free site builder. These are real, functioning, much-loved businesses. They are also the clearest possible evidence that “just put it on Shopify” has not, in fact, happened everywhere.

And then the finding that ought to stop a roaster in their tracks. Only four of the twenty-six sell anything on subscription — and all four are coffee. Not one of the twelve bakeries in the sample has a subscription of any kind. The single most-recommended e-commerce mechanic of the last decade, the one every platform sells an app for, the one this article has spent three thousand words on the legal machinery of, has been adopted by 15% of the trade in this city, and entirely by the half of it that sells a shelf-stable product.

You can read that two ways. Either subscriptions do not suit a bakery — and there is something to that, since bread has a twelve-hour peak and a cake is an event, not a habit. Or the tooling has never been built for the thing a bakery could actually sell on a recurring basis, which is a standing order: the same four loaves every Thursday, collected, not shipped. That is a subscription with a pickup window instead of a shipping label, and no subscription app models it, because the entire category was built for a parcel.

One more thing turned up while we were looking, and it is worth a paragraph because it says something about how thin the digital ground is under this trade. Thirteen Baltimore food-business domains we checked are dead, parked, or worse. A former Baltimore coffee house’s domain now serves a live overseas lottery-spam site. A beloved Highlandtown bakery’s old domain now hosts a personal-injury law firm’s landing page about truck accidents. Several are registrar parking stubs, several have no DNS at all, and one working bakery’s obvious domain is listed for sale while the business trades from a different one. None of that is anybody’s fault in particular. It is what happens when the website was a favor somebody’s cousin did in 2013 and the renewal notice went to an email nobody reads. It is also a reminder of the most under-rated reason to own your own store outright: the asset only stays yours if somebody is holding the keys.

What bakery and coffee software actually costs, meter by meter

Every price in this section comes from the vendor’s own published pricing page, read on 16 September 2026. Where a vendor does not publish a price I say so, because “contact sales” is itself information about who a product is for.

First, the model, so the arithmetic has something to bite on — and this time we can derive it rather than assume it. County Business Patterns puts Baltimore City’s ten retail bakeries at 126 employees and $4,079,000 of annual payroll, which is 12.6 employees and $407,900 of payroll per establishment. The Census Bureau’s Annual Integrated Economic Survey — the same program as the Economic Census, run forward two more years — puts payroll at 32.23% of revenue for retail bakeries (NAICS 311811) in 2024, with materials at 34.46%, so two-thirds of every dollar is spoken for before rent. Divide and that Baltimore establishment is doing about $1,265,000 a year.

Be honest about where that sits: the 2022 Economic Census size table shows 57.2% of US retail bakeries took under $500,000 and 77.7% took under $1 million, so a $1,265,000 shop is in the top fifth of the trade. That is deliberate. It is the size at which the build-versus-rent question actually becomes live, and I will show you further down what happens to the arithmetic at a quarter of the scale.

Call it a Baltimore bakery-roastery with a counter, a wholesale book and an online store, and split it the way these businesses usually split: $695,750 over the counter (55%), $379,500 wholesale (30%), and $189,750 online (15%). Inside that online figure, a coffee club of 220 subscribers at a $38 average order, shipping every four weeks, is 2,860 orders and $108,680 a year, leaving $81,070 of one-off online sales. Every number after this is computed from those. They are a model, not a survey, and your own figures will differ — but the structure of the bill will not.

The card is the biggest software bill you have

Before any subscription fee, look at what it costs to take the money, because for a business this size it dwarfs everything else and almost nobody itemises it. Square publishes four different rates for the same card. In person, tapped, dipped or swiped: 2.6% + 15¢ on the free plan, 2.5% + 15¢ on Plus, 2.4% + 15¢ on Premium. Online: 3.3% + 30¢ free, 2.9% + 30¢ on Plus and Premium. Invoices paid by ACH: 1% with a $1 minimum. And manually keyed or card on file: 3.5% + 15¢, on every plan, with no volume discount at all.

That last rate is the subscription rate, because a recurring charge is by definition a card on file. So the coffee club pays 3.5% + 15¢ on $108,680 across 2,860 orders: $3,803.80 in percentage and $429.00 in per-transaction fees, $4,232.80 a year. The identical money taken over the counter at 2.6% + 15¢ would cost $3,254.68. Running the club rather than selling the same coffee across the counter costs $978.12 a year in card fees alone, before a single subscription app is installed.

And here is a number worth writing on the wall, because it falls straight out of the published rates and I have never seen anyone state it. Compare card-on-file at 3.5% + 15¢ against Square’s ordinary online rate of 2.9% + 30¢. Set them equal: 0.6% of the order equals 15¢, so they cross at exactly $25.00. Below a $25 order, having the card on file is cheaper than a fresh online checkout. Above it, the card on file is more expensive, and the gap widens with every dollar. A roaster selling one twelve-ounce bag a month on subscription is on the cheap side of that line. A roaster selling two bags and a bar of chocolate is on the expensive side. The average order value of your subscription decides which of two payment economics you are running, and no dashboard anywhere draws that line for you.

The fifteen cents is bigger than the plan you are arguing about

A bakery counter ticket is small. Take a coffee and a pastry at $14 and run the arithmetic on Square’s fixed component: 15¢ on a $14 ticket is 1.07% of the sale. That is larger than the entire difference between Square’s free plan and its top plan, which is 0.2 of a point. The meter that matters in a bakery is not the percentage; it is the per-transaction fee, because your transactions are tiny and there are tens of thousands of them.

For our modeled shop, the counter does $695,750 across roughly 49,696 transactions at a $14 average. On Square Plus at 2.5% + 15¢ that is $17,394 in percentage and $7,454 in per-transaction fees — $24,848, or 3.57% of counter sales, against a headline rate of 2.5%. Three-tenths of that bill is the fifteen cents.

While we are here: Square Plus costs $49 a month per location, or $588 a year, and buys a 0.1-point improvement on the in-person rate. That pays for itself at exactly $588,000 a year of tapped card volume. Below that you are buying the features, not the rate — and one of those features is now Square Loyalty, which used to be a separate per-location add-on and is bundled into Plus and Premium as of this pricing round.

The whole bill for the modeled shop

Here is the stack we would expect to find in a Baltimore bakery-roastery of this size: Square at the counter, Shopify for the online store, a subscription app for the coffee club, a roast log, a nutrition and allergen label tool, and accounting. Every price is the vendor’s published list price on 16 September 2026, at annual billing where annual billing is offered.

Two things stand out, and neither is the number at the bottom. The first is that the software is 17% of the bill and the payments are 83%, which means the vendor you spend the most energy choosing is not the one taking the most money. The second is that the single most expensive rate in the whole table — 3.5% + 15¢, card on file, 3.89% all-in on this order size — is the one that applies to the part of the business every consultant tells you to grow.

The per-order meter nobody quotes

Subscription apps are quoted as a percentage, and the percentage is not the problem. Recharge Starter is $99 a month plus 1.49% plus 19¢ per order. At the $38 average order our model uses, the 19¢ adds 0.50% and the all-in software take is 1.99%. Drop the average order to $25 — one twelve-ounce bag and nothing else, which is what a lot of coffee clubs actually look like — and the 19¢ becomes 0.76% and the all-in becomes 2.25%. At a $15 order it becomes 1.27% and 2.76%. The fixed fee is worth more than half the headline rate at the order sizes this trade actually runs.

Which is why the published alternatives are worth reading carefully rather than by headline. Loop charges $99 a month plus 1.0% and nothing per order on its Starter plan, and $399 plus 0.75% on Pro. Awtomic is $299 a month plus 1% per order. Stay AI is $499 plus 1% + 19¢; Skio is $599 plus 1% + 20¢. Seal Subscriptions charges a flat $0 to $399 a month by number of active subscriptions with 0% and no per-order fee, and its own tiers say “unlimited revenue.” Appstle runs $0, $10, $30 and $100 a month and advertises a 0% transaction fee — but its tiers are capped on monthly subscription revenue, which is a percentage fee rendered as a staircase. And Shopify’s own Subscriptions app is free, with a documented limitation that matters enormously here: bundles are not compatible with it, and a bundle is what a coffee club is.

Put those side by side at $50,000 a month of subscription revenue across 2,000 orders, software only, card fees excluded: Shopify Subscriptions $0, Seal $89.95, Appstle $100, Stripe Billing $350, Chargebee $400, Loop Starter $599, Awtomic $749, Recharge Starter $1,224, Stay AI $1,379, Skio $1,499, Recharge Plus $1,549. A fourteen-fold spread for the same job.

And a detail that ought to be embarrassing: at that volume Recharge Plus costs more than Recharge Starter. The $400-a-month step buys a 0.15-point rate cut worth about $75 a month at $50,000, and does not break even until roughly $267,000 a month of subscription revenue. Upgrading is the wrong move for every roaster in Baltimore and there is no way to know that from the pricing page.

What the vendors publish, and what that tells you

The clearest signal in this whole teardown is not a price. It is which vendors publish one. Of the five pure-play wholesale ordering platforms a Baltimore roaster would be pitched — Rekki, Choco, Cheetah, BlueCart and Pepper — none publishes a price. Rekki has no pricing page at all. Cheetah’s domain is in registry redemption. Pepper describes a “pay-for-performance pricing philosophy” with “no hidden fees” on a page that publishes no fees. Choco’s visible page says to talk to sales, while the page’s own meta description says its pricing “is based on a small percentage of Choco transactions.” The percentage is the thing, and the percentage is the thing they will not print.

Faire is the honourable exception and worth studying because it is so explicit: 15% commission on every marketplace order, including reorders, plus a one-time $10 new customer fee, and 0% on customers you bring yourself through Faire Direct. That is a completely honest pricing page, and it tells a roaster exactly what a wholesale account costs to rent versus to own.

The same split runs through the bakery software category. Cybake publishes nothing — not on its own site, not on Capterra, not on SoftwareAdvice — while running a blog post titled “Are you paying too much for bakery management software?” that prices a competitor to the dollar: “per user pricing is used by another of our competitors, with prices starting at $295 per month. Should a bakery wish to add a new user to its system, however, it is charged an additional $145 per month.” That competitor is FlexiBake, and $295 plus $145 a user is exactly what FlexiBake’s own page says today. Wherefour is at least candid about it: “We don’t publish a price list because every operation is different.”

And the two that do publish are a perfect natural experiment, because they have made opposite bets about what a bakery is. Stocksmith (formerly Craftybase) charges by order lines — $20, $49, $99, $199 and $349 a month — with seats free. FlexiBake charges by people: $295 a month plus $145 per user, or $375 plus $165, or $495 plus $175. A three-person, high-volume bakery pays $585 on FlexiBake and $349 on Stocksmith. A twelve-person, modest-volume bakery pays $1,890 on FlexiBake and $99 on Stocksmith. Same industry, same year, a nineteen-fold divergence for the same twelve-person shop depending purely on which vendor’s theory of a bakery you happened to buy.

Coffee is the one category where the meters are honest and, unusually, get cheaper as you grow. Cropster charges a base license — €26, €95, €275 or €999 a month — plus a per-kilogram charge that starts only after 250 kg a month and then falls through eight bands from about €0.07 to €0.0055 per kilo. RoastConsole is $79 a month including 220 lb, then eight cents a pound falling to two. RoasterTools runs $99, $199, $499, $999 and $2,300 with pound allowances and per-pound overage from ten cents down to one. Mill City’s RoastPATH, free to $129 a month, advertises the counter-position in a bullet: “Zero per-pound fees as you grow.” And Artisan, the open-source roast logger, is free under the AGPL and actively maintained.

The roasting vendors price the bean. The e-commerce vendors price the basket. The bean is the thing a roaster actually controls, which is why those meters feel fair and the percentage meters do not.

The meter that runs whether you look at it or not

One last finding, because it closes the loop on the ceiling. BigCommerce restructured its plans on 1 June 2026. The new ladder is Core at $39 a month, Growth at $105, Scale at $399 and Performance from $1,499 — digit for digit the same as Shopify’s Basic, Grow and Advanced — with an “open payment provider fee” of 2.0%, 1.0% and 0.6%, also digit for digit the same as Shopify’s third-party payment fee. Two independent companies, four identical numbers.

But look at what BigCommerce attached those tiers to. Core carries a $30,000 trailing-twelve-month GMV cap; Growth, $100,000; Scale meters at $33,333 a month with a 0.9% overage; and at $2 million the account “will automatically upgrade to Performance.” The platform computes your rolling twelve-month gross sales continuously, to the dollar, and acts on it automatically when you cross a line.

The capability exists. It has been built, shipped and documented. It simply never runs in your favor. A Maryland baker who wants that exact mechanism — trailing twelve-month gross sales, a threshold, an automatic action — can watch it operate on them every month and cannot buy it for themselves.

What custom actually costs, and when it does not pay

Our prices are published and they do not move: a one-week Prototype Sprint is $3,500, a custom online store starts at $6,000, and a custom app, internal tool or operations system starts at $12,000. Fixed, agreed before we start, and you own every line of the code.

So the honest question is which part of that $43,014 a build actually replaces, because it is not all of it and anyone who tells you otherwise is selling something. The card processing stays — $35,692 of the total is money moving, and nothing we write makes a Visa cheaper. The point of sale stays; Square Plus at $588 a year is excellent value for a counter and we would not touch it. The accounting stays. The roast log stays if it is working.

What a build replaces is the storefront, the subscription layer and the label tool — $348 + $3,351 + $588 = $4,287 a year at 220 subscribers. Against that, a $6,000 online store pays back in 16.8 months and a $12,000 build in 33.6 months. That is a real answer and it is not an especially exciting one.

Now move the one variable that matters, because the subscription meter is the only line that scales with you:

At eighty subscribers we would tell you to wait, and we have told people exactly that. Two years is too long a payback on a discretionary spend for a business whose flour price moves more than that. At two hundred and twenty the store is a good decision and the full build is a marginal one. At six hundred both are obvious, and the reason is not that our price changed — it is that the meter on the other side got bigger while you were busy.

That is the actual economics of renting software: the vendor’s bill grows with your success and ours does not. Every percentage in that teardown is a small share of your growth, permanently assigned to somebody else, and the case for owning the thing gets stronger every month you do well. It is also why we would rather you came to us at two hundred subscribers than at twenty — not because the small shop matters less, but because at twenty the honest answer is Shopify and a spreadsheet, and we would like to still be the people who told you that.

The numbers above also leave out everything that is not a line item. The hour every evening turning cake requests into promises. The Saturday somebody double-booked the decorator. The wholesale invoice that did not match the delivery. The label that still says sesame-free because the seed blend changed in March and the product record did not. Those do not appear on any invoice, which is exactly why they never get counted, and in our experience they are worth more than the software bill.

What we would actually build

The design follows from everything above, and it rests on one claim that sounds pedantic until you try to write the queries: in a small food business the regulated object is not the product, it is the order — who bought it, where they are, what kind of business they are, what it was made from, what you had already sold that year, and how long it took you to ship it. Five structures carry information a generic retail schema throws away.

A recipe is a real object with ingredients, sub-ingredients and yields, and every ingredient carries its own allergen set and its own supplier. From that one structure you get three things that are otherwise three separate manual chores: the ingredient statement in descending weight order, the “Contains” line computed rather than typed — with the specific tree nut named, as §343(w)(2) requires — and a true cost per unit that moves when a supplier’s price moves. Change the seed blend and every label it touches is stale in the same instant, and the system says so. This is the piece that repays the build on its own, and it is also the piece nobody sells to a shop with nine employees for less than the price of a second oven.

A product knows its net weight in both systems, its label version, the date that label was generated, and — for a roaster — the green lot behind it and the measured roast loss of the batch it came from. It carries a rolling twelve-month unit count, because that is the number 21 CFR 101.9(j)(18) turns on, and a flag for whether any nutrient content claim has been made about it anywhere, including in the storefront copy. Those two fields cost nothing and answer a question that otherwise depends on somebody remembering a rule they read once.

A customer has a type, and the type is not decorative. Consumer, retail food store, or excluded channel — the distinction COMAR 10.15.03.02B(68–1) draws, sitting on the record where a human will see it before they accept a standing order. Wholesale customers carry their own price list, their own delivery day, their own standing order and their own invoice terms, because a wholesale customer is not a retail customer with a discount; it is a different relationship with a different rhythm.

An order knows its channel, its destination state and its promised ship date, and it keeps the date it actually shipped next to the date it was promised — which is precisely the “records or other documentary proof” that 16 CFR §435.2(a)(4) says you are presumed not to have. It knows its tax treatment from the channel rather than from a global setting, so the market stall, the counter and the shipped box can differ. And it knows whether the store is allowed to accept it at all: below the line, a cart that will not complete an out-of-state shipment and that records what it saw when it declined; above the line, the same cart with the restriction lifted. One configuration change rather than a rebuild, which is the entire point of modeling the constraint instead of hard-coding it.

A subscription is a first-class object with an interval, a next charge date, a skip history and a computed notice window — recomputed, every time the charge date moves, from the current charge date rather than from the date the customer signed up. The cancel path lives in the customer’s own account, one click deep, stops the next charge immediately and is reachable through the same medium they signed up in, because that is what §14–1329(b)(3) requires and because a cancel button that works is a better retention tool than one that does not exist. People who can leave easily come back. It also knows which roast day it will be filled on.

On top of those, four screens earn their keep. The first is the running total: cottage food revenue for the trailing twelve months across every channel, with the line drawn on the chart — at $50,000 today and $100,000 from 1 October — so that crossing it is a decision rather than an accident. The second is the production board: what has been promised for each of the next fourteen days, measured in the resource that actually runs out, which is decorator hours for a cake shop and roast batches for a roaster. The third is the wholesale order book: standing orders by customer and delivery day, with cut-off times, per-customer pricing and a printed pick list generated from the same record as the invoice. And the fourth is one line on a monthly report showing the substantial grocery ratio — qualifying sales over all food sales — because it costs an afternoon to compute and it is the only way anybody ever finds out they have drifted toward the wrong side of 10%.

None of that is hard. It is ordinary software with an honest data model, and the reason it does not exist off the shelf is that a product sold into forty thousand food businesses across fifty states cannot afford to model one state’s cottage food regulation, one city’s priority tiers or one trade’s roast-loss arithmetic, and should not try. If you want to see the shape of what we mean, our demos page has a working e-commerce build you can click through.

Build, or keep paying

I would much rather you kept a store that works than paid us to rebuild it. The honest test is short, and it is the only list in this article:

• Keep renting when your coffee club is under about a hundred subscribers, when online is a small tail on a healthy counter, when nobody in the building is retyping the same product into two systems, when your wholesale accounts fit on one page, and when you make nothing that needs a label you did not design.
• Build when a percentage of every recurring order is going to a platform on top of what the card already costs, when your allergen statements are typed rather than computed, when the wholesale order book lives in a spreadsheet and a group chat, when your renewal notices are scheduled from a signup date rather than the current charge date, when you cannot say today what your trailing twelve-month revenue is, or when you are about to cross a line — the cottage food ceiling, the state border, the move into a licensed kitchen — and would like the software to know that it moved.

Most shops we talk to land in the middle, and the middle is a good place to be: keep the till, keep the card processing, keep the accounting, keep the roast log, and own the storefront, the subscriptions, the recipe and the order book — which is exactly where this trade’s peculiarities live. That is a $6,000 to $12,000 decision, not a rip-and-replace, and it is the one we recommend most often.

When you should not call us

If you are baking at home and selling at one market on Saturdays, software is not your problem and we would be a bad spend. A spreadsheet with a running total and a Square stand will carry you a long way, and the honest advice is to put the money into ingredients and a better tent. If your online sales are a small tail on a healthy shop floor and nobody is retyping anything, leave it alone. If you are three weeks from opening, do not start with a custom build — open, sell through two seasons, find out what you actually do rather than what you planned to do, and then call us with something specific. And if the thing that is hurting is rent, or flour, or the fact that you cannot hire a second baker, we cannot fix any of those and we will say so on the call rather than after the invoice.

How we work

Fixed price, agreed before we start. You talk to the people writing the code — there are two of us and no account layer. You own every line, in your repository, on your infrastructure, from the first commit. We ship in weeks rather than quarters, and we start with the one screen that is costing you the most, which in this trade is almost always the wholesale order book or the subscription schedule. If a week of work would tell us both whether the rest is worth doing, that is what the $3,500 Prototype Sprint is for, and it is credited against the full project if you go ahead.

Questions we get from bakery and coffee owners

Can I sell baked goods from my home kitchen in Maryland?

Yes, within limits, and the limits are the whole story. Health–General §21–330.1(b) says a cottage food business “is not required to be licensed by the Department” if the owner complies with the section, and §21–301(b–1) defines a cottage food business as one that produces or packages cottage food products in a residential kitchen and “has annual revenues from the sale of cottage food products in an amount not exceeding $50,000” — a figure that becomes $100,000 on 1 October 2026 under Chapter 320 of the Acts of 2026. The products must be non-potentially hazardous: broadly, shelf-stable baked goods, high-acid jams and jellies, and non-potentially hazardous candy, prepackaged and labeled in your own kitchen. Anything needing refrigeration — cheesecakes, cream and custard pies, many buttercream and cream cheese icings — is out unless laboratory testing shows a water activity of 0.85 or less and/or a pH of 4.6 or below. In Baltimore City you also have to satisfy the home occupation rule at Art. 32 §15–507, which limits customer visits to 3 a day and 10 a week. This is how we read the rules for the businesses we build for, and it is not legal advice.

Can a Maryland cottage food business ship out of state?

No. Mail order itself is allowed — Maryland is more generous than several states here — but only inside Maryland. COMAR 10.15.03.27A permits sale when the foods are “offered or sold only in the State,” including “by mail order,” and COMAR 10.15.03.02B(17–2)(b) defines a cottage food product as one “not offered for sale through interstate commerce.” The Department’s own FAQ answers it directly: “You may advertise your cottage food products online but sales are restricted to Maryland only,” and “You may mail your product, but only within the State of Maryland.” Note that Chapter 320 of 2026 doubled the revenue ceiling and reenacted the “sold in the State” definition without amendments in the same act. Practically: a Maryland-only shipping zone, the same restriction applied separately to local delivery and pickup, and a record of what the store saw when it declined an order.

Can a Shopify store restrict sales to one US state?

Not as a hard block on the plans a bakery is actually on. Shopify gates the country dropdown at checkout — a customer can only select a country that is in both an active market and a shipping zone with rates — but at state level the documentation says a customer entering an out-of-zone address simply “receive[s] a notice that no shipping rate is available for their region.” That is a price quote failing, not a door closing. A genuine address-level hard block does exist through checkout validation functions, which can “prevent shipping to restricted locations” using the delivery address province code — but a store’s own bespoke rule is a custom app, and custom apps containing Function APIs require Shopify Plus, which starts at $2,300 a month against Basic at $29. Local delivery is the strongest native tool almost by accident: eligibility requires the customer be within the radius and the same state, so leaving “include neighboring states” switched off confines it to Maryland. Pickup, however, is gated by country rather than state. On WooCommerce the selling gate is country-only in core — “sell only to Maryland” is not expressible in the settings — but because it is self-hosted PHP, a checkout validation hook is a few dozen lines and free.

Is there an app that stops selling when I hit an annual revenue cap?

We looked, on 16 September 2026. On Shopify, no. The order-limits category runs to 136 apps and every one we checked counts units, orders, weight, or the value of a single order, or gates access per customer — none tracks cumulative gross sales across the store against a threshold. Shopify’s own guidance offers three manual workarounds, the first of which is to “manually remove your Add to cart button.” You can build it in Shopify Flow with a shop metafield and a Run code action, but there is no year-to-date sales variable, no action that closes a store, and the trigger fires on Order paid, so the cap overshoots. On WooCommerce it exists: Order Restrictions for WooCommerce, at $49 a year, will “restrict the order placement on your site when more than the specified number of order(s) or Total value is reached.” Meanwhile BigCommerce tracks trailing-twelve-month gross merchandise value to the dollar and acts on it automatically — to upgrade your plan at $30,000, $100,000 and $2 million. The capability exists; it just never runs in your favor.

Do I need a nutrition facts panel on my baked goods?

Often not, but the exemptions are conditional on things you do online. 21 CFR 101.9(j)(1)(i) exempts food sold by a person making direct sales to consumers with annual gross sales to consumers of not more than $500,000, or annual gross sales of food to consumers of not more than $50,000, calculated on “the most recent 2–year average of business activity” — but only where the food bears no nutrition claim “in any context on the label or in labeling or advertising.” §101.9(j)(18)(ii) exempts a low-volume product where, in the preceding twelve months, you employed fewer than an average of 100 full-time equivalent employees and fewer than 100,000 units of that product were sold in the United States; a notice must be filed with FDA before the period begins unless you have fewer than ten full-time equivalents and the product sells fewer than 10,000 units a year. And the exemption most counter bakeries rely on, §101.9(j)(3), requires the food be “not offered for sale outside of that establishment” — so it stops applying the day you list that cookie on your website and ship it. Your product descriptions and email campaigns are advertising. A nutrient content claim typed into a product description can cost you an exemption you have relied on for years.

Do I have to declare sesame on my labels?

Yes, and it is the newest of the nine. The FASTER Act of 2021 (Pub. L. 117–11, approved 23 April 2021) amended 21 U.S.C. §321(qq)(1) by “striking ‘and soybeans’ and inserting ‘soybeans, and sesame’,” effective for food introduced into interstate commerce on or after 1 January 2023. There is a wrinkle worth knowing: COMAR 10.15.03.02B(44)(a), Maryland’s own definition of a major food allergen, still lists only eight and does not include sesame, even though it was last amended in December 2023 — while the Department’s November 2025 cottage food guidance prints the same definition with sesame in it. The statute routes around the discrepancy: §21–330.1(c)(2)(i)5 requires allergen information “as specified by federal labeling requirements,” and federal law includes sesame. Declare it. Sesame is the hardest of the nine for a bakery because it arrives without being an ingredient — in a seed blend, in tahini, in za’atar, on a bun — which is the argument for computing the “Contains” line from a recipe rather than typing it on a product record.

Are bakery items and coffee taxable in Maryland?

It depends on a ratio you compute about your own shop, and for coffee it depends on temperature. Tax–General §11–206(a)(6) defines a “substantial grocery or market business” as one where “at least 10% of all sales of food are sales of grocery or market food items,” and only such a vendor’s off-premises food sales are exempt. The Comptroller’s Business tax tip #5 confirms bakery sales count — but in calculating the 10 percent “you may not include sales of single servings, heated or prepared food or sales to be consumed on the premises,” so every latte and warmed sandwich enlarges the denominator without enlarging the numerator. On coffee: §11–206(a)(3) names coffee as food, so a bag of beans and an iced coffee are exempt, while the Comptroller’s taxable list carries “Coffee (heated)” and “Donuts (heated).” Candy and confectionery are not “food” at all. And watch gift boxes: if an exempt food is sold in combination with a taxable item, “the entire charge is subject to sales tax. There is no allocation.”

Does Maryland’s automatic renewal law apply to my coffee subscription?

Yes — to all of them. Md. Code, Com. Law §14–1329, in force since 1 June 2026, defines an automatic renewal as any paid subscription “automatically renewed for a subsequent term,” with no minimum term. The bill as introduced said “more than 1 month”; that qualifier was struck before enactment and survives only in subsection (d), which governs automatically charging a credit card. So a four-week club, a monthly club and a six-week club are all inside it. The cancellation mechanism must be “at least as easy to use as the mechanism the consumer used to consent” and available “through the same medium” — sign up online, cancel online, with a prominently placed link or button or a pre-formatted cancellation e-mail. Where the initial term is at least a year the renewal notice must go out not less than 15 and not more than 45 days before renewal; for a trial over 14 days it is 3 to 21 days. A window with a ceiling as well as a floor, anchored to a date that moves every time a customer skips. Enforcement is Attorney General only — §14–1329(h) rules out a private right of action — with civil penalties up to $10,000 a violation and $25,000 for a subsequent one.

Can I sell cottage food on Etsy, DoorDash or Uber Eats?

The constraint that bites is Maryland’s, not the platform’s, and it is the same one either way: COMAR 10.15.03.27A allows a cottage food business to sell only “in the State,” and the permitted routes to a consumer are a residence, a farmer’s market, a public event, personal delivery and mail order. A national marketplace listing reaches buyers in fifty states, so whatever the platform permits, your own store has to refuse everything outside Maryland — and a marketplace generally will not let you restrict to one state the way your own checkout can. On the delivery apps there is a further, genuinely unanswered question: whether a third-party courier summoned through a platform counts as “personal delivery.” That is not addressed in the statute, in COMAR, in the Department’s Guidelines or in its FAQ — we checked all four. One practical note in the other direction: a marketplace like Etsy is a marketplace facilitator and collects Maryland sales tax for you, whereas your own Shopify store is not, so moving to your own storefront hands you a collection duty you did not previously have. Confirm any individual platform’s current policy with the platform; this is how we read the Maryland rules, and it is not legal advice.

How should a bakery handle deposits and lead times on custom cake orders?

Treat the deposit as a reservation against capacity on a date rather than as a part-payment for an item, because that is what it is. The order needs a date with a real capacity check behind it, a lead-time minimum that varies by product, a deposit calculated as a percentage of an estimate rather than of a price the customer has not yet fixed, a balance due on a rule, and a cancellation policy that tightens as the date approaches and that the system applies by itself. Two outside constraints attach to it. The lead time you publish is a representation under 16 CFR §435.2(a)(1), and §435.2(a)(4) presumes against a seller who cannot show records that its systems actually meet it. And a deposit taken in December against a March collection is revenue in a trailing-twelve-month total that, for a cottage food business, has a statutory ceiling attached to it. No generic cart models any of this, which is why so many cake orders are still taken by text message — a practice bakers openly discuss among themselves.

How much does bakery and coffee software cost?

For a modeled Baltimore bakery-roastery doing $1,265,000 a year with a 220-subscriber coffee club, the whole published stack is $43,014, or 3.40% of sales — of which only $7,323 is software and $35,692 is payments. The list prices themselves are modest: Square Plus $49 a month per location, Shopify Basic $29 a month billed yearly, RoastLog Starter $129, ReciPal Business $49, QuickBooks Essentials $75. The meters are where the money is. Card on file is 3.5% + 15¢ on every Square plan and never improves. Recharge Starter is $99 a month plus 1.49% plus 19¢ an order, and at a $25 average order that 19¢ is another 0.76 of a point. Bakery-specific tools split sharply: Stocksmith charges by order lines ($20 to $349 a month) while FlexiBake charges $295 plus $145 per user — $99 versus $1,890 a month for the same twelve-person shop. Cybake publishes nothing at all.

Is it worth building custom software for a bakery or coffee roaster?

It depends almost entirely on the size of your subscription program, because that is where the percentage meters are. For the modeled shop above, the layer a build actually replaces — the storefront, the subscription app and the label tool — is $4,287 a year at 220 subscribers, against which our $6,000 online store pays back in about 16.8 months and a $12,000 build in 33.6. At eighty subscribers those become 24.7 and 49.5 months and we would tell you to wait. At six hundred they become 9.0 and 17.9. The card processing, the point of sale and the accounting stay whatever you do. Our packages are published: a one-week Prototype Sprint is $3,500, a custom online store starts at $6,000, and a custom app, internal tool or operations system starts at $12,000.