Why one layer is not enough
A client-only anticheat misses abuse of your server events. A server-only anticheat misses client cheats such as silent aim and noclip, which never touch a server event. Raven runs both, so each layer covers what the other cannot see.
What the client layer covers
Cheats on the player's machine: Lua executors, injected mod menus, NUI DevTools and attempts to tamper with Raven itself. Every ban carries its evidence, and admins review it in the dashboard.
What the server layer covers
Your economy and game state: server events a player should not be able to fire, entity spawn floods and known cheat-menu exploits. It keeps running even if every client check is bypassed.
How the two layers back each other up
Heartbeat anti-tamper links the two. A client whose anticheat stops responding or has been tampered with gets the action you set, kick or ban, so switching Raven off on a player's machine is not a way around it.
Does Raven Anticheat run client-side or server-side?
Both, on every plan. The client layer catches cheats on the player's machine, the server layer protects your events and game state, and heartbeat anti-tamper links the two.