c/side vs Proteside: watch the scripts or verify the payment?
By Laís Peixoto
Growth Marketer, Proteside
Published
c/side watches every third-party script across all real sessions, keeps a history of what each one delivered and blocks anything outside the approved list. Proteside also inventories and blocks scripts, then checks the payment itself: QR codes, instant-payment IDs, bank slip lines, wallet addresses and card fields, compared with what the merchant issued.
Side by side
- How it describes itself
- A client-side security platform, in the company's own words. Script Security covers the scripts on the page; Fingerprint covers device identification and bot and AI-agent detection.
- Headquarters
- United States, fully remote team. Founded in 2024.
- How it enters the site
- One script tag in the page head. The site states there is no reverse proxy and no DNS change, and that site traffic is not routed through c/side.
- What it checks on the payment page
- Third-party scripts in 100% of real visitor sessions, with no sampling: inventory, per-page-load history of what each script delivered, a vendor dependency graph and per-vendor permissions.
- PCI DSS
- Requirements 6.4.3 and 11.6.1 with reports described as audit-ready and approved by VikingCloud, a QSA. A PCI SSC participation is not stated in the public material.
c/side Script Security
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| c/side | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described in public documentation | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described in public documentation | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Described with a limitation (optional, sampled, requires human action or only in one product tier)1 | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | Described in public documentation | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | Described in public documentation | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | Described in public documentation | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described in public documentation | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Described in public documentation | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Described in public documentation | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Notes on the marks
- 1Stablecoin and crypto wallet address, including when copied: c/side's public crypto page lists real-time recipient address changes and replacement of a copied wallet address in the clipboard among the threats it addresses through script monitoring. The material does not describe comparing the displayed address with the one the merchant issued, hence the partial mark.
Where c/side stands out
Every real session, no sampling
The site states coverage of 100% of real visitor sessions and contrasts that with periodic scans and simulated crawls.
A history of what each script delivered
The inventory stores, per page load, the content each third-party script shipped, which makes a change easier to investigate after the fact.
Roots in Cloudflare Page Shield
The founder was a product manager on Page Shield and co-chairs the W3C Anti-Fraud Community Group, according to the about page.
Crypto on the radar
A dedicated crypto page covers wallet drainers, scripts that change recipient addresses and amounts in real time, and replacement of a copied wallet address in the clipboard.
What Proteside checks that c/side's public material does not mention
A furniture store in Bangalore shows a UPI QR code for a 42,000 rupee order. The customer scans it with a banking app, sees the amount, approves, and the order never arrives. A compromised script had redrawn the QR with another payee's UPI ID and the same amount. No card number was stolen; the money simply went to someone else, and the store finds out when the customer asks where the delivery is.
c/side would see the script that did it, if that script was outside the approved list, and that matters. What its public documentation does not describe is a check of the payment data itself: whether the QR, ID or address on screen is the one your server issued. For UPI, PromptPay, PayNow, DuitNow, FPS and the Brazilian bank slip (boleto), c/side's material mentions no verification. For crypto wallets, it mentions the swapped clipboard address, but not a comparison with the address the merchant generated. Proteside records what was issued (QR, ID, slip line, USDT address, amount) and compares it with what the buyer sees and copies, in every session. On a mismatch, confirmation is blocked and the attempt becomes an alert and an evidence record.
The same line of code covers the card form and the third-party scripts, with the inventory, authorizations and change history that requirements 6.4.3 and 11.6.1 call for. A team already running c/side keeps its script visibility and adds payment verification without a second rollout project.
How each one enters your operation
c/side
- One script tag in the page head, on any platform.
- No reverse proxy and no DNS change, according to the site; traffic keeps flowing straight to your servers.
- Alerts to Slack, Teams, email and webhooks, with feeds into fraud and SIEM tooling.
Proteside
- One line of code on the payment page, on any platform, or a single integration in the platform's or payment provider's template.
- No proxy, no DNS or CDN change; the check runs in the buyer's browser, in every session.
- Automatic blocking before confirmation; dashboard, API and alerts by email, Slack, Teams and webhook.
When to choose each one
c/side makes sense when
- Cards are your only payment method and your priority is investigating how each third-party script behaves, with a per-page-load history.
- You want device identification and bot and AI-agent detection from the same vendor as your script security.
- Your security team already works with CSP policies and wants a reporting endpoint for the browser's reports next to the inventory.
Proteside makes sense when
- You accept UPI, PromptPay, PayNow, DuitNow, FPS, Pix, bank slips or stablecoins, and need the payee verified, not only the script.
- You need a swapped QR, ID, slip line or wallet address blocked before confirmation, in every session.
- You want protection and evidence for requirements 6.4.3 and 11.6.1 in one install, with a report your QSA can take as is.
Both together
A team that relies on c/side for third-party script detail can keep that dashboard and add Proteside on the payment page to verify the payment itself. The two tags are independent; Proteside does not alter legitimate payments and does not interfere with another tool's inventory.
Frequently asked questions
Does c/side cover Pix, bank slips or QR codes?
Not in the public information checked in October 2026. c/side's material covers third-party scripts, card data, PCI DSS compliance and privacy, and its crypto page covers wallets and copied addresses.
Can c/side and Proteside be used together?
Yes. They are two independent script tags on the payment page. c/side keeps watching the scripts while Proteside compares the payment on screen with what your server issued and blocks a swap before confirmation.
Does c/side protect against crypto wallet address swapping?
Its public crypto page names real-time address changes and clipboard replacement as threats handled through script monitoring. Comparing the displayed address with the one the merchant issued does not appear in the material; Proteside makes that comparison and blocks a mismatch.
Is a CSP policy enough for requirements 6.4.3 and 11.6.1?
c/side's own FAQ says CSP controls where scripts come from but cannot see their contents, so on its own it does not meet PCI DSS. Both c/side and Proteside add inventory, authorization and change history on top of that base.
Both watch every real session. What is different, then?
What each one looks at inside the session. c/side describes the behavior of third-party scripts. Proteside also looks at the payment data on screen and in the clipboard: QR, payee ID, slip line, wallet address and amount, compared with what was issued.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.