Weekly evidence packs, retained 18 months
One PDF covering both client-side requirements, generated weekly, containing what an assessor actually asks for rather than a screenshot of a dashboard.
Start for free
Talk to an expert
What is weekly evidence packs?
An evidence pack is a generated PDF documenting, for a given period, what was in scope, what scripts ran with what justification, every security-header change, and every alert raised. It exists because the output of a compliance control is not a dashboard, it is something you can hand to an assessor. Dashboards are live and show the present. Assessments look backwards at a period and ask what was true then, which is a different artefact.
The four sections
Weekly statistics: coverage and page views in scope. Vendor and script inventory with a justification per script, which is the 6.4.3 record. Every security-header change with distinct values and timestamps, which is the 11.6.1 record. Alerts raised and acknowledged, with who was told. Vendors requiring action sort to the top.
Two requirements, two records, one document
The pack covers both requirements while keeping their evidence distinct, because 6.4.3 is an authorisation record and 11.6.1 is a change-detection record and an assessor asks about them separately. Merging them into one undifferentiated report is a common reason evidence comes back.
Retained longer than the raw data
Generated packs are kept for 18 months, which is longer than the underlying raw script history on any plan. Assessments look backwards, and the pack is the artefact that needs to survive.
The four things an assessor asks to see, generated weekly and kept for 18 months, which is longer than the raw data behind them.
Related platform capabilities
Script inventory
Every script, with a justification per script.
Tamper detection
Content and integrity changes on the page.
Header monitoring
Distinct values seen per header, per week.
Vendors and load chains
Who loaded whom, and from where.
Script blocking
By URL, hash, domain, or single action.
Monitor-only mode
The same evidence, nothing stopped.
Frequently asked questions
Read the FAQ
Yes. Weekly packs are automatic, and you can generate a quarterly attestation pack covering any period you need for an assessment.
A PDF, because that is what assessors ask for and what survives being emailed around. The same data is available through the API and S3 export if you want it in your own systems.
Yes for an annual assessment cycle with room to spare. If your situation needs longer, Enterprise retention is configurable.
The pack still generates and says so explicitly. A period with no data looks identical to a broken integration unless the report distinguishes them, so it does.
See it on your own payment pages.
Install the tag, mark your payment pages, and watch the inventory fill in. Free forever on 1,000 page views a month, no credit card.
Free forever plan. No credit card.