Reflectiz has become an important part of our ecommerce security and monitoring suite.

We use it to monitor the scripts running across our website, understand what information is being collected, and pinpoint where data is being shared with second-, third-, and fourth-party services. It also provides the documented evidence we need to support PCI compliance.

One of the biggest benefits has been the reduced effort required for PCI audits. What used to take several weeks can now be handled far more efficiently by giving auditors a folder with the weekly reports, supporting details, and documented justification for each script.

Reflectiz has also helped us build a regular review process, rather than treating compliance as a once-a-year exercise. On several occasions, its scans have alerted us to issues we might not otherwise have identified.

Elinor and Luke have been a breeze to work with as well. They’re responsive, helpful, and make the overall experience with Reflectiz straightforward and positive.

Overall, Reflectiz is an excellent tool for improving visibility, supporting PCI compliance, reducing audit preparation time, and strengthening ongoing website security monitoring. Review collected by and hosted on G2.com.

There’s a significant learning curve, with lots of rabbit holes to go down, so it’s worth setting time aside to really learn how to make the most of Reflectiz. Review collected by and hosted on G2.com.

We highly appreciate that Reflectiz helps us meet PCI compliance requirements effortlessly, as it does not require embedding any code into our pages—making the entire process seamless and passive. The prompt alerts for any changes occurring on our pages provide us with great confidence that only the expected scripts are being loaded, enhancing our security posture significantly.

The Risk Factors dashboard is particularly valuable, offering clear indicators that allow us to drill down for deeper insights and take informed actions quickly. Additionally, it is very reassuring to have visibility into the external sites our pages communicate with, which adds an important layer of transparency and control.

Overall, Reflectiz delivers excellent value and has proven to be a worthwhile investment for our organization. Review collected by and hosted on G2.com.

Script approvals needs to be optimized bit more. Generally speaking about the same script file which has different query parameters. Review collected by and hosted on G2.com.

What I appreciate most about Reflectiz is the simplicity and actionable visibility it brings to managing JavaScript security across our many websites. The user interface is straightforward, making it easy to monitor and approve scripts, which was previously unmanageable with other tools. The onboarding was smooth, and the tool provided immediate value by giving us awareness and governance over third-party scripts—something we never had before. Review collected by and hosted on G2.com.

The main challenge we faced was not with Reflectiz itself, but with the process of identifying the owners of specific JavaScript within our organization. While Reflectiz gives us the visibility, the responsibility to map ownership remains on us, which can be complex in a large company. Additionally, I would like deeper benchmarking features to compare our exposure more transparently against specific sector peers, though I understand the privacy limitations. Review collected by and hosted on G2.com.

I really appreciate how Reflectiz gave us visibility we never had before. Without needing to be a developer, I can clearly see every third-party risk and security issue on our website. The real-time monitoring, easy deployment, and the ability to hold vendors accountable have been game changers for us. It integrates smoothly with our security stack and genuinely saves us time and resources by highlighting exactly where to focus. Review collected by and hosted on G2.com.

We did have to whitelist some IP addresses during setup due to multiple vendors being involved with our website, which took a day or two to resolve. But beyond that minor hurdle, I haven't encountered any significant drawbacks. Review collected by and hosted on G2.com.

Reflectiz made our PCI DSS 4.0.1 compliance seamless, especially with requirements 6.4.3 and 11.6.1. The onboarding was incredibly fast—less than 24 hours from providing details to having a working dashboard. Very less efforts required from our side, which saved us significant time and effort. The platform's automation, script inventory, third- and fourth-party mapping, and exportable reports made the audit process smooth. Support was very responsive and emphatetic, and the tool required minimal back-and-forth for setup. Smart approval automation is useful, and the weekly monitoring cadence is easy to maintain. Review collected by and hosted on G2.com.

The only real limitation is budget: expanding Reflectiz monitoring to all and/or non critical assets is challenging due to costs. While Reflectiz provides strong value, justifying ROI or budget spend is difficult without a clear, demonstrated risk. Additionally, I haven't compared it directly with other vendors, so can't speak to relative advantages beyond our use case. Review collected by and hosted on G2.com.

I like the PCI DSS addon for providing a detailed overview of where we stand and the overall insights Reflectiz gives to truly understand what's going on with the website. It's good to have everything in one place where it's automated. I also appreciate Reflectiz's insights into every application and domain, and how it interacts with our first-party apps. The initial setup was relatively easy. Review collected by and hosted on G2.com.

Perhaps the ability to run a scan ad-hoc or integration with SIEM solutions would be nice to haves. Review collected by and hosted on G2.com.

I definitely like the ease of use of Reflectiz. It's very much a hands-off technology, which is great for companies with small teams as it works really well. Reflectiz does not leave holes in the PCI DSS requirements, providing a sense of confidence that we are meeting those requirements and ensuring customer safety. It's very easy to set up too. We just provided emails and got started, then it’s a matter of monitoring and maintaining. Additionally, we can print reports to show as evidence during PCI audits. Review collected by and hosted on G2.com.

I really don't have anything to add here. Review collected by and hosted on G2.com.

The solution works really well for tracking PCI DSS 4+ compliance and maintaining general script hygiene across our web applications. This is the only use case we currently have, and we haven’t explored the product’s other functions or features yet. That said, it provides a lot of detail, which helps us feel confident we’re making the right decisions. Review collected by and hosted on G2.com.

The pay-to-unlock-more-scans option feels more like a commercial decision than a real product feature. I think the app should allow more frequent scanning out of the box, without needing an extra unlock. Review collected by and hosted on G2.com.

The support from the staff at Reflectiz is top-tier. You would be hard-pressed to find better, and I've been in IT for nearly 30 years and I've dealt with many, many vendors. We're a smaller customer of theirs, but it has never felt like it. Implementation was near zero-touch from our side, which is amazing. Also, we found a small bug in the Reflectiz web platform a while back and they had it fixed within days. Really, really impressive. Review collected by and hosted on G2.com.

I honestly don't have anything bad to say. We're in the platform every week and we've had no issues. Review collected by and hosted on G2.com.

Reflectiz has been instrumental in maintaining our payment page script inventory and meeting PCI DSS requirements. Its intuitive interface makes navigation effortless, and its temper detection reliably surfaces new. Unapproved scripts with clear,actionable alerts-significantly reducing risk and operational overhead. I highly recommend Reflectiz and their team their responsiveness, efficiency, and deep technical knowledge make them a reliable partner for any security or compliance initiative. Review collected by and hosted on G2.com.

Very satisfied. The product is strong; I'd appreciate more granular alert tuning and slightly faster onboarding documentation for new users. Review collected by and hosted on G2.com.