Vendor load chains and fourth-party discovery
You approved a vendor. The vendor loaded two more. The browser treats all three identically, and so does PCI DSS 6.4.3.
Start for free
Talk to an expert
What is vendors and load chains?
A load chain is the record of which script caused another script to load, traced from your own page through every vendor to the last script in the chain. It matters because approving a vendor is not the same as approving a script. A tag manager loads an analytics vendor, which loads a CDN helper, which loads a pixel from a company you have never heard of, and every one of those executed on your payment page with the same privileges as your checkout code.
Fourth party and beyond
A third party is a vendor whose script you added. A fourth party is a script your vendor loaded. The general case is a chain of arbitrary depth, and you have no contract with anything past the first link. The chain is what answers the question 'how did this get here', which is the first thing anyone asks when an unexpected script appears.
A weekly review that takes ten minutes
Vendor reviews fail for organisational reasons: the list is stale, nobody owns it, and it happens annually under assessment pressure. The workable shape is a weekly prompt containing only what changed, with everything stable staying quiet.
The reminder is deliberate
A vendor-review reminder goes out on Thursdays, listing payment-page vendors still needing review. It exists because the most common failure of this control is not technical.
You approve a vendor, the vendor loads its own vendors. 6.4.3 applies to every script that executes, not only the ones you added yourself.
Related platform capabilities
Script inventory
Every script, with a justification per script.
Tamper detection
Content and integrity changes on the page.
Header monitoring
Distinct values seen per header, per week.
Script blocking
By URL, hash, domain, or single action.
Monitor-only mode
The same evidence, nothing stopped.
Alerts
Three channels: email, webhook, or S3.
Frequently asked questions
Read the FAQ
From the call stack at load time, which names the script URL, its content hash, and the line and column that triggered the load. That is what makes the chain a record rather than an inference.
Yes. Blocking by domain stops everything from that origin, and because the chain is recorded you can see in advance what else would stop, which avoids discovering it in production.
You see it, and this is one of the more common real-world events. A new link in the chain appears as a new script requiring action, attributed to the vendor that loaded it.
No. Scripts, vendors and domains are unlimited on every plan. Page views are the only metered unit, so an accurate inventory never costs more than an incomplete one.
See it on your own payment pages.
Install the tag, mark your payment pages, and watch the inventory fill in. Free forever on 1,000 page views a month, no credit card.
Free forever plan. No credit card.