Client-side compliance for AI startups
You added self-serve billing in a week, instrumented everything, and then an enterprise buyer sent a security questionnaire asking about client-side script integrity. This is that control.
Start for free
Talk to an expert
TL;DR
AI startups and the client-side requirements
THE OBLIGATION
PCI DSS 6.4.3 and 11.6.1 have been mandatory since 31 March 2025 for any page where a cardholder enters, reviews or confirms card data.
THE SPECIFIC DIFFICULTY HERE
Self-serve upgrade and credit top-up pages were shipped fast and carry every analytics, session replay and support tag the product loads globally.
WHAT THE TAG PRODUCES
A script inventory with justifications, a weekly header change record, runtime blocking, and an evidence pack for your assessor.
Short on time? What an enterprise security review actually wants is the evidence pack.
See what is in one
Does ai startups need PCI DSS script monitoring?
Yes, if you operate any page where a cardholder enters, reviews or confirms card data, which includes pages that embed a payment iframe. You added self-serve billing in a week, instrumented everything, and then an enterprise buyer sent a security questionnaire asking about client-side script integrity. This is that control. Requirements 6.4.3 and 11.6.1 apply to those pages regardless of platform, and have done since 31 March 2025.
Where the exposure is
Self-serve upgrade and credit top-up pages were shipped fast and carry every analytics, session replay and support tag the product loads globally
Session replay is close to standard in an early product team, and it is running on the billing screen unless somebody explicitly excluded it
Enterprise security reviews arrive far earlier than they used to, and they now ask about client-side controls by name
There is no compliance function yet, so the requirement lands on a founding engineer with a deadline from a deal
What the inventory shows you
Every script on the billing and credit top-up routes, scoped by route rather than by URL
Session replay or product analytics reading card fields, which is the finding that most often appears first
A dependency shipping changed code into production, caught by payload hash rather than version number
An inventory with a justification per script, which is the artefact a security questionnaire is actually asking for
Requirement 6.4.3 is an authorisation record: every script on the payment page, where it came from, and why it is allowed to be there.
The two requirements, in this context
Frequently asked questions
Read the FAQ
It depends on where the card is entered, and the distinction matters. If you redirect to a page hosted entirely by Stripe, that page is theirs. If you embed Stripe Elements in your own app, the page around the element is yours, and 6.4.3 applies to it. See hosted payment pages and PCI.
This is the common trigger. Send the generated evidence pack: the script inventory with a justification per script, the integrity method, the change-detection record for the page and its HTTP headers, and the alerting record. That answers the question with an artefact rather than a paragraph.
No, and the cost is the reason. Page views are the only metered unit and the free plan is permanent at 1,000 page views a month with both requirements included. A billing route that sees a few thousand views a month is a rounding error next to the deal that asked for it.
No, if it is scoped properly. Your own bundle changing every deploy is expected and can be authorised as a pattern. The alert you want is a third party changing, which payload hashing catches and a version number does not.
Yes, if you can justify it, and most teams decide they would rather not. Block the capability rather than the tag, so replay keeps running everywhere except reading the card fields. That keeps the product analytics your team depends on without the one behaviour an assessor will ask about.
No, not on its own, and we would rather be clear about it. This covers two PCI DSS requirements. The change-detection and inventory records can be referenced by change-management controls in other frameworks, but it is not a SOC 2 or ISO tool.
Minutes for the tag, then an hour or so to mark the billing routes and check the inventory looks right. There is no DNS change, no CDN change and no traffic routed through us. The quickstart covers HTML, Next.js, Vite, the CLI and an AI-assisted path.
No, install it when you add billing rather than after. The inventory builds from live traffic, so starting early means you already have a change history when the first security questionnaire arrives, instead of a screenshot taken the week you were asked.
See the scripts on your own payment pages.
Free forever on 1,000 page views a month, no credit card. Unlimited domains on every plan.
Free forever plan. No credit card.