Add-on · Session replay
Masked before it is recorded, not after
Redaction on a vendor's servers is a promise about what they will not look at. Ours happens in the visitor's browser, so what they typed never reaches us to be looked at.
Verified September 2026
The design
Where the redaction happens decides everything
Almost every replay vendor records the real DOM, ships it to their servers and redacts on the way in or on the way out. That holds right up until a rule is misconfigured, a new field ships without the right class, or somebody with database access goes looking. By then the sensitive text has been transmitted and stored, and only a policy is keeping it unread.
Our recorder replaces field contents inside the mutation serialiser, before a payload is built. A masked value leaves the browser as a run of bullet characters of the same length. There is no configuration that can turn that off globally, no server-side rule to get wrong, and nothing to leak — because the original characters were never in the request.
- In the browser The recorder walks the mutation, finds every field, and substitutes placeholders.
- On the wire The payload contains bullets. There is nothing to intercept.
- At rest Encrypted, stored apart from analytics, deleted on the schedule you set.
- Masked by default. Every form field on the page is redacted in the browser, before anything is sent. You turn individual fields back on one at a time, deliberately.
- Never recorded: keystrokes, clipboard contents, file pickers, or anything inside an area you have marked private.
The same keystroke, on the wire
One visitor types their email into a checkout. This is the event both recorders put on the network.
{
"t": "input",
"node": 148,
"value": "a.reinholt@example.com"
}The real characters crossed the network and landed in their store. Whether you ever see them is a matter of their configuration and their access control.
{
"t": "input",
"node": 148,
"value": "••••••••••••••••••••••"
}Substituted inside the mutation serialiser, in the visitor's browser, before a payload exists. Same length, so the replay still looks right. Nothing to leak.
Guarantees
What the recorder cannot capture
These are not defaults you can switch off by accident. There is no code path in the recorder that reaches any of them.
- KeystrokesWe observe DOM mutations, never key events.
- Clipboard contentsCopy and paste events are not listened for.
- File picker contentsOnly that a file input changed, never which file.
- Password fieldsMasked even if you explicitly try to unmask them.
- Cross-origin iframesNot accessible, and we do not try.
- Anything you mark privateA whole area of the page, replaced with a plain grey box before it leaves the browser.
For whoever edits your HTML: mark an area private with
data-aa-block on any element, and opt a single field back in with
data-aa-unmask. Both are plain attributes — no configuration, no
redeploy of anything but your own markup.
Use
Go straight to the sessions that went wrong
Nobody watches recordings at random. Replay is only useful if it hands you the broken ones, so that is what the inbox is sorted by.
Rage clicks
284
Dead clicks
1,187
JS errors seen
92
Rageless, dropped anyway
614
Every one of those numbers is a filter. Click it and you get the recordings behind it, newest first, already scrubbed to the moment it happened.
Questions
Replay questions, including the awkward one
What exactly is masked?
Every form field on the page — text boxes, text areas, dropdowns and rich-text editors — plus anything else you choose to mark. Masking happens in the visitor's own browser: the characters are replaced with a placeholder of the same length before the recording is packed up, so the real text never enters the payload and never reaches us.
Can I unmask a field?
Yes, deliberately, one field at a time — it is a single attribute on the element, and there is a line for your developer further up this page. It is opt-in rather than opt-out on purpose: the default has to be the safe one, because the failure mode of getting it backwards is a card number sitting in a recording.
Do you record keystrokes?
Never. We record DOM mutations, not key events. There is no keylogger path in the recorder at all, so there is nothing to misconfigure. Clipboard events and file picker contents are likewise never captured.
Does session replay need a cookie banner?
Realistically, yes — and we will not pretend otherwise. A replay is a recording of one person's visit, so most regulators treat it as personal data even when the fields are masked. Our recorder ships with a consent gate: call aa.replay.allow() after the visitor agrees and recording starts then, not before. Pageview analytics and heatmaps still need no banner.
How long are recordings kept?
30 days by default, and you can set it as low as 24 hours. Recordings are stored separately from your analytics, encrypted at rest, and deleting one deletes it — there is no soft-delete tier and no backup that quietly outlives it.
How is it billed?
from $19 a month — priced by your volume rung, because the included allowance of recorded sessions scales with it. Sessions you sample out are not recorded and not counted, and recordings sit in their own allowance rather than drawing down the one your plan meters.
Will it slow the page down?
The recorder is around 11 KB gzipped and loads lazily after your page is interactive, never on the critical path. It uses a single MutationObserver, batches to an idle callback and stops recording entirely on a hidden tab.
Read next
Watching what people do
- Cookieless heatmaps and scroll mapsClick, scroll and attention maps from the script you already installed.
- How to read a heatmapThree kinds of map, and the three findings worth acting on.
- What session replay actually recordsNot a video — and the difference is where the risk lives.
- Dead clicks and rage clicksThe two findings in a click map worth acting on the same afternoon.
- What scroll depth measuresThe bottom of the window against the height of the document, in tenths.
- Which form field loses peopleFocus counts, focus time and edits, and the field somebody left on.
Ready
Watch the session. Never read the data.
from $19 a month on any plan, priced by your rung because the allowance of recorded sessions scales with it. Masked by default, consent-gated, and deletable in one click.