Feroot vs Proteside: script governance or payment verification?
By Laís Peixoto
Growth Marketer, Proteside
Published
Feroot inventories and governs the scripts on the payment page to meet PCI DSS, across websites and mobile apps. Proteside runs that inventory and goes further: it checks, on the buyer's screen, whether the QR code, payment key, bank slip line or wallet address shown is the one the merchant issued, and blocks a swap before confirmation.
Side by side
- How it describes itself
- Automated compliance platform for PCI DSS, HIPAA and privacy; PaymentGuard handles payment pages.
- Headquarters
- Toronto, Canada. Founded in 2017.
- How it enters the site
- Script on the payment pages, with a configurable assessment frequency; DXSecure is described as agentless with in-browser monitoring.
- What it checks on the payment page
- Scripts (including dynamic and nested ones), hash-based integrity, page content and HTTP headers; iOS and Android apps.
- PCI DSS
- Requirements 6.4.3 and 11.6.1 with an evidence report for the QSA. Associate Participating Organization of the PCI SSC, according to its own website.
Feroot PaymentGuard e DXSecure
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| Feroot | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described in public documentation | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described in public documentation | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Not found in public information | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | Described in public documentation | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | Described with a limitation (optional, sampled, requires human action or only in one product tier)1 | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | Described in public documentation | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described in public documentation | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Described in public documentation | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Described in public documentation | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Notes on the marks
- 1Watches real buyer sessions: The website describes DXSecure both as an agentless deployment and as monitoring in the user's browser; the public material does not detail how the two combine.
Where Feroot stands out
Mobile apps in scope
The public material includes iOS and Android apps alongside websites, which is uncommon in this category.
Privacy and healthcare in the same dashboard
The platform also covers HIPAA and privacy laws, useful for teams with more than one regulatory obligation.
Diagnostic tools before rollout
A Chrome extension and a web scanner show the exposure before any deployment.
Operational integrations
Alerts in chat, incident and observability tools, plus an API.
What Proteside checks and Feroot's material does not mention
Picture a store in Bengaluru that takes UPI. The customer reaches checkout, sees the QR code, opens their banking app and pays. If a compromised plugin or a browser extension swapped the QR code for another one with the same amount, the store finds out only when the customer complains that they paid and the order never arrived. No card data was stolen; the payee was swapped. A Brazilian store taking Pix lives the same scene.
Script inventory is the right answer to the card problem, and Feroot delivers it with care. For UPI, PromptPay, PayNow, Pix, boleto (Brazilian bank slip) and crypto wallets, Feroot's public documentation does not describe a check of what appears on screen. Proteside records what your server issued (QR code, key, bank slip line, address, amount) and compares it with what the buyer sees and copies, in every session. On a mismatch, confirmation is blocked and the attempt becomes an alert and a piece of evidence.
The same install covers the card form and third-party scripts, with the inventory and history that requirements 6.4.3 and 11.6.1 call for. One line of code does both jobs.
How each one enters the operation
Feroot
- Script on the payment pages, or distribution through the payment processor to many pages at once.
- Configurable assessment frequency, from hourly to weekly.
- Runtime policy enforcement described as optional in PaymentGuard.
Proteside
- One line of code on the payment page, on any platform, or a single integration in the platform or provider template.
- Continuous verification in every session, with no sampling and no gap between assessments.
- Automatic blocking before confirmation; dashboard, API and alerts by email, Slack, Teams and webhook.
When to choose each one
Feroot makes sense when
- Cards are the only payment method and the priority is script governance with a report for the assessor.
- You need to cover mobile apps as well as the website.
- HIPAA or privacy laws are part of the same compliance obligation.
Proteside makes sense when
- You are paid through UPI, PromptPay, PayNow, Pix, bank slips, stablecoins or other instant payment rails.
- You need the payee swap blocked in real sessions, without waiting for a periodic assessment.
- You want protection and evidence for requirements 6.4.3 and 11.6.1 from a single install, with no deployment project.
Both together
An operation with mobile apps in Feroot's scope can keep that coverage and add Proteside to the web payment page to check the payment itself. The two scripts coexist.
Frequently asked questions
Does Feroot cover Pix, boleto or QR codes?
Not found in the public information consulted in October 2026. Feroot's material describes scripts, card data, page content and headers.
Can Feroot and Proteside be used together?
Yes. They are two independent scripts on the payment page. Proteside does not alter legitimate payments and does not interfere with another tool's inventory.
Which of the two meets PCI DSS requirements 6.4.3 and 11.6.1?
Both describe inventory, authorization, change detection and a report for the QSA. The difference is in what else each one checks: Proteside includes the payment itself.
Does Proteside replace fraud prevention?
No. Fraud prevention assesses whether the buyer is trustworthy. Proteside ensures the page and the payment details were not swapped. They are different layers.
How do I try Proteside?
Sign up for fourteen days free, add one line of code to the payment page, and within minutes the dashboard shows the scripts, the payment methods and the blocked attempts.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.