PCI compliance software for the client-side requirements

This comes up in almost every assessment conversation. Assessors want evidence covering the period being assessed, not a screenshot taken the week you bought the tool. Evidence packs generate weekly from the moment the tag is installed and are retained for 18 months, so the record builds itself from day one rather than being reconstructed under pressure later.

Yes, you can still deploy, and be straight with your assessor about the date. A control that is demonstrably live, with a documented start date and a remediation plan for the period before it, is a much shorter conversation than an open finding with neither. The inventory populates from live traffic within days, so there is something real to show quickly.

Yes, it analyses behaviour, and the distinction is worth pressing every vendor on. Checking a script URL against a list of known-bad domains is cheap, and it only ever catches what is already known. What matters is what the script does: which fields it reads, where it sends data, and whether its payload changed since you approved it.

No, and we would rather be direct about it. This automates the two client-side requirements, 6.4.3 and 11.6.1, which were introduced in PCI DSS v4.0 and became mandatory on 31 March 2025. The other ten requirement families are outside what a script-monitoring tool can observe. Most customers run this alongside a GRC platform or their QSA's process.

No. Software produces controls and evidence, and compliance is a judgement made by your assessor or by you on a self-assessment questionnaire, across the whole standard. Any vendor promising compliance itself from a single tool is overselling, and an assessor will not accept the claim either.

Often yes, and this surprises people. If the payment form is in an iframe served by your provider, the iframe is theirs, but the page hosting it is yours. A script on your page can reach around an iframe in several well-documented ways, and the page around the iframe is in scope. See hosted payment pages and PCI.

They are real options and worth evaluating, especially if you already pay for the platform. Akamai, Cloudflare, Imperva and F5 all ship a client-side module. Three differences are worth checking before you settle. Price: those modules are priced as an add-on to an enterprise platform, and Script Monitoring starts free and publishes every tier up to $799 a month. Focus: client-side security is the whole product here, not one module inside a CDN or WAF suite, so 6.4.3 and 11.6.1 evidence is the thing the roadmap is pointed at. Sampling: we monitor every page view rather than a sample of sessions, and a skimmer that fires on one request in 300 is missed by anything that samples. Ask any vendor what percentage of sessions they actually observe. Our comparison pages go through each one with a genuine strength and a genuine limitation.

Published: free for 1,000 page views a month, Pro from $99/month for 100,000 payment-page views, $499/month at 500,000 and $799/month at 1,000,000, with overage at $0.0013 per page view and annual billing at 10 months instead of 12. Enterprise is custom. Page views are the only metered unit, and scripts, domains, alerts and users are unlimited on every plan.

Yes, the controls are QSA-validated and the evidence pack is built around the four things assessors ask for: the scope, the inventory with justifications, the header change record, and the alerts raised. Assessors do differ on format, so if yours wants something specific it is worth raising with us early rather than the week before your assessment.