Module 2 · merchants
An inventory of the scripts on your payment page
Every script that loads on your checkout page, where it comes from, when it changed, and a dated record you can hand to your assessor. This page is a placeholder: the module is being built, and nothing on it can be bought today. This is not legal advice.
Module 2 is not on sale yet: no checkout and no form on this page.
What the rule asks for
Quoted word for word from our own plan, with the file and its date under each quotation. Check the wording against the current official text before you act on it.
“Since March 31, 2025, PCI DSS 4.0.1 requires merchants to keep an inventory of every payment-page script with a justification and to detect changes at least weekly (Requirements 6.4.3 and 11.6.1); merchants using a hosted payment iframe attest instead that their page is not susceptible to script attacks.”
Source: docs/plan-v2-conformtrail-2026-09-03.md, 2026-09-03
(Anhang A, M2 Mail 1).
“This is evidence for your attestation and your assessor; it is not a substitute for a QSA assessment and does not block scripts.”
Source: docs/plan-v2-conformtrail-2026-09-03.md, 2026-09-03
(Anhang A, M2 Mail 1).
“Continuous inventory, change alerts, evidence report, CSP/SRI guidance”
Source: docs/plan-v2-conformtrail-2026-09-03.md, 2026-09-03
(section 3, positioning).
What this is, and what it is not
What it is
- A weekly re-scan of one checkout page
- An inventory of every script with its origin and a field for your justification
- An alert when a script appears, disappears or changes
- A dated record of the page as it was on each scan date
What it is not
- Not a substitute for an assessment by a qualified assessor
- Not a blocker: we change nothing on your page and stop nothing from loading
- Not a judgement about whether a script belongs there — that is yours to record and your assessor’s to weigh
- Not legal advice
How the page is read
- Public pages only: robots.txt first, at most one request per second, only
GET - No account, no login, no card, no order
- Our crawler names itself as
ConformTrailBot/1.0 (+https://conformtrail.com/bot)— see the crawler page
What it will cost
Payment Page Evidence
$49 per month
Weekly re-scan of one checkout page: script inventory with justification fields, change alerts and a PDF record.
- Weekly script inventory per store
- Change alert when a script appears or changes
- PDF record for your assessor
- Evidence for your attestation, not a QSA assessment, and it blocks nothing
Payment Page Evidence, annual
$490 per year
The same monitoring, paid once a year.
- Everything in the monthly offer
- One payment a year
Module 2 is not on sale yet: no checkout and no form on this page. When it opens, it opens here and in writing — no call. Until then, the module for investment advisers is ready and the free scan is open. This is not legal advice.