Reflectiz vs Proteside: a scheduled visit from outside, or a check inside every purchase?
By Laís Peixoto
Growth Marketer, Proteside
Published
Reflectiz watches payment pages from outside: an automated browser visits the URLs on a schedule, with no code, and produces the inventory and evidence PCI DSS asks for. Proteside runs inside the page in every session, checks that the QR code, account ID, bank slip line or wallet address match what the server issued, and blocks the swap before confirmation.
Side by side
- How it describes itself
- Web exposure management platform (Security Hub, Privacy Hub, Offensive Hub); the PCI Module handles payment pages.
- Headquarters
- Tel Aviv, Israel, with hubs in Boston and Sydney. Founding year is not stated on the official site.
- How it enters the site
- Sandboxed automated browser that visits the URLs the customer provides on a configurable schedule, with no code on the site. Blocking uses an idle script activated from the console.
- What it checks on the payment page
- Third- and fourth-party scripts (including inside iframes), per-script approval and justification, HTTP response headers and payment page content.
- PCI DSS
- Requirements 6.4.3 and 11.6.1 with on-demand evidence export for the QSA. Principal Participating Organization of the PCI SSC, per its own site.
Reflectiz PCI Module
- How it describes itself
- Cybersecurity layer for the moment of payment: integrity of what the buyer sees, copies and confirms.
- Headquarters
- São Paulo, Brazil. Operating since 2026.
- How it enters the site
- One line of code on the payment page, or an integration in the platform or payment provider template. No proxy, no DNS or CDN change.
- What it checks on the payment page
- Third-party scripts, card form, Pix QR code and key, boleto (Brazilian bank slip) line, crypto wallet address and the QR codes of eight instant payment rails, matched against what the merchant issued.
- PCI DSS
- Evidence for PCI DSS requirements 6.4.3 and 11.6.1, with an exportable report for the QSA.
Proteside
Criterion by criterion
Marks are based on each vendor's public documentation. Hover over or tap a mark to read the legend.
| Reflectiz | Proteside | |
|---|---|---|
| What is checked on the payer's screen | ||
| Inventory and authorization of scripts on the payment pageThe basis of requirement 6.4.3: know what runs on the page and authorize each script. | Described in public documentation | Described in public documentation |
| Card details typed into the formStop a script from copying the number, expiry date and security code. | Described with a limitation (optional, sampled, requires human action or only in one product tier)3 | Described in public documentation |
| Pix QR code and copy-and-paste code (Brazil)Brazil's most common checkout scam: the QR code shown leads to another account. | Not found in public information | Described in public documentation |
| Boleto (Brazilian bank slip) payment lineA swapped line pays a different payee for the same amount. | Not found in public information | Described in public documentation |
| QR codes of instant payment rails worldwide (UPI, PayNow, DuitNow, PromptPay, QR Ph, FPS, CoDi, Transferencias 3.0)The same swap as Pix, across eight instant payment systems. | Not found in public information | Described in public documentation |
| Stablecoin and crypto wallet address, including when copiedA wallet address swapped on screen or in the clipboard is irreversible. | Not found in public information | Described in public documentation |
| Matches what is on screen against what the merchant issued and blocks the swap before confirmationThe check that defines payment integrity: payee and amount equal to what was issued. | Not found in public information | Described in public documentation |
| How it protects | ||
| Blocks unauthorized scripts in the buyer's browserDetecting after the fact does not bring the copied data back. | Described with a limitation (optional, sampled, requires human action or only in one product tier)2 | Described in public documentation |
| Watches real buyer sessionsTargeted scams do not show up in simulated visits. | The vendor states it does not do this1 | Described in public documentation |
| Works without changing CDN, DNS or proxyDrops into any platform with one line of code. | Described in public documentation | Described in public documentation |
| PCI DSS compliance | ||
| Evidence for PCI DSS requirement 6.4.3Inventory, authorization and integrity of scripts. | Described in public documentation | Described in public documentation |
| Evidence for PCI DSS requirement 11.6.1Unauthorized changes to the page and its headers. | Described in public documentation | Described in public documentation |
| Exportable report for the assessor (QSA)Evidence has to leave the dashboard and reach the assessment. | Described in public documentation | Described in public documentation |
- Described in public documentation
- Described with a limitation (optional, sampled, requires human action or only in one product tier)
- Not found in public information
- The vendor states it does not do this
Notes on the marks
- 1Watches real buyer sessions: Reflectiz describes its own approach as remote and agentless: an automated browser visits the pages on a schedule, with no code installed. The site speaks of simulating user activity rather than observing real shopper sessions.
- 2Blocks unauthorized scripts in the buyer's browser: Public material describes the Idle Blocking Script: a tag that stays inactive until the security team requests a block from the console, at which point it excludes one domain through a CSP policy. The page itself sums it up as remote monitoring that detects and on-demand blocking that responds.
- 3Card details typed into the form: The inventory and alerts cover scripts that touch the payment page, including inside iframes. Reacting to a script that copies card data depends on a scheduled visit finding it and on a person triggering the domain block; the site does not describe automatic blocking in the buyer's browser.
Where Reflectiz stands out
Nothing to install on the page
Reflectiz describes the PCI Module as running entirely remotely. The customer supplies payment page URLs, and the site says most organizations are operational within 24 hours.
Script approval at scale
Smart Approval clears scripts whose behavior matches patterns already accepted, Bulk Approval applies one decision across many sites, and built-in AI drafts a justification per script for reviewers to accept or edit.
Privacy and offensive testing on one platform
Beyond the PCI Module, the Privacy Hub covers GDPR, CCPA and HIPAA, and the Offensive Hub includes agent-driven penetration testing.
A seat at the PCI SSC
The site states that Reflectiz contributes to the PCI SSC Technology Guidance Groups and to the development of the standard itself.
What Proteside checks that the Reflectiz material does not mention
A merchant in Bangkok shows a PromptPay QR code for 2,400 baht. The shopper opens her banking app, scans, and pays. If a browser extension on her laptop replaced that QR code with one pointing to another account, the automated browser that visited the checkout at 3 a.m. never saw it. The swap existed only in her session, only for her.
Reflectiz is open about its design: a sandboxed browser simulates user activity, the visit repeats on a schedule, and the site states that Reflectiz has no access to payment or session data. Proteside works from the other side. It records what your server issued (QR code, UPI ID, bank slip line, wallet address, amount), compares that with what the buyer sees and copies in every real session, and blocks confirmation when the two differ.
The same line of code keeps the script inventory, watches the card form and stores the change history that requirements 6.4.3 and 11.6.1 call for. An unauthorized script is blocked in the buyer's browser, with nobody opening a console first.
How each one enters your operation
Reflectiz
- You provide the payment page URLs; no code is added to the site.
- A sandboxed automated browser visits the pages on a configurable schedule and repeats the check.
- To block, the Idle Blocking Script is activated from the console and excludes the chosen domain via CSP; a one-click revert undoes it.
Proteside
- One line of code on the payment page, on any platform, or a single integration in the platform or provider template.
- A check in every session of every buyer, with no schedule and no simulated visit.
- Automatic blocking before confirmation; dashboard, API and alerts by email, Slack, Teams and webhook.
When to choose each one
Reflectiz makes sense when
- Internal policy rules out any new script on the payment page and the team accepts detection followed by human review.
- You run dozens of card checkouts and want bulk script approval with AI-drafted justifications ready for the auditor.
- Privacy (GDPR, CCPA, HIPAA) and offensive testing belong to the same web security program.
Proteside makes sense when
- You accept UPI, PromptPay, PayNow, DuitNow, FPS, Brazilian Pix or bank slips, or crypto wallets.
- You need the beneficiary swap blocked in the session where it happens, without waiting for the next scheduled visit.
- You want protection and 6.4.3 and 11.6.1 evidence from one installation, with one line of code.
Both together
A group that uses Reflectiz to inventory many sites from the outside can keep that map and add Proteside on the payment page to check each purchase. The Reflectiz browser will list the Proteside script as one more inventory item, ready for approval.
Frequently asked questions
Does Reflectiz cover Pix, bank slips or QR codes?
Not in the public information we reviewed in October 2026. The Reflectiz material describes scripts, iframes, HTTP headers and payment page content.
Can Reflectiz and Proteside be used together?
Yes. Reflectiz observes from outside with no code; Proteside runs inside the page. The Proteside script shows up in the Reflectiz inventory like any other, and Proteside never alters a legitimate payment.
What is the Reflectiz Idle Blocking Script?
According to the Reflectiz site, it is a tag that sits inactive on the page until the team requests a block from the console. Once activated, it injects a CSP policy that excludes the chosen domain. In Proteside, blocking of unauthorized scripts is automatic and happens in the buyer's browser.
Does monitoring without code satisfy requirements 6.4.3 and 11.6.1?
Reflectiz describes inventory, authorization, header alerts and evidence export, and reports that customers' QSAs accepted the approach. Proteside produces the same evidence from real sessions, including a record of what was blocked.
Does Reflectiz catch a scam that appears for only one shopper?
The Reflectiz site describes simulated visits on a schedule and states that it has no access to session data. A QR code or account ID swapped by an extension in one customer's browser happens outside those visits. Proteside checks it in every session.
See Proteside checking your checkout
Fourteen days free, one line of code, every payment method on your page.