The platform

Both products sit on the same three things: collection in the session, a baseline, and a notification that names what changed.

Collection

A small script you add once. It observes what else loads and executes on the page, and reports it — the source, the timing, what it touched, and what changed relative to the last time. It does not read form values and it does not need to; the question it answers is about code, not about customers.

It runs asynchronously and does not sit in front of anything. If our collection endpoint is unreachable, your checkout is unaffected, because nothing on the page is waiting on us.

Baseline

An inventory with a decision attached to each entry. This is the part that requires a person, once, and the part that makes everything afterwards specific — "changed" only means something when there is an agreed version of "unchanged".

Baselines are versioned. When you approve a change, that becomes the new baseline and the previous one stays readable, which is most of what you need when somebody asks what the page looked like in November.

Detection and notification

A deviation from the baseline produces an alert that names the script, the vendor, and the nature of the change. Not a severity score. Severity scores are a way of appearing to prioritise while moving the judgment to a number nobody can audit.

What we deliberately do not do

We do not block. An automated block will eventually be wrong, and it will be wrong during your highest-traffic hour, and the failure will look like a checkout outage rather than like a security product making a decision. The long version.

We do not scan on a schedule. A weekly crawl finds a change up to seven days late, and the people writing skimmers know exactly what a crawl looks like and when it runs.

We do not collect payment data. Not a policy choice we could reverse — the collection layer has no access to form contents.

Data handling

What we store is code metadata: script sources, hashes, timing, and change records. Retention is configurable. More detail on the trust page.