Security

Encryption at Rest and in Transit

All data is encrypted using industry-standard encryption:

• TLS 1.3 for data in transit
• AES-256 encryption for data at rest

Secure Infrastructure

Our infrastructure is built with security in mind:

• Hosted in the EU on dedicated servers
• Automated dependency vulnerability scanning
• Rate limiting on the reporting API
• Regular security patches and updates

Authentication & Authorization

We implement strict access controls:

• Role-based access control within a team
• Secure password policies and encrypted password storage
• Sign-in with Google or GitHub, so we never handle those passwords
• Per-site API keys for report submission
• Session management and automatic timeouts

Data Privacy & Retention

Your data is protected through:

• Configurable data retention policies
• Automatic expiration of shared replays
• Secure data deletion on request
• Regular database backups
• GDPR and privacy regulation compliance
• All data stored in the EU

Secure Development

We follow security best practices:

• Secure coding standards
• Code review and static analysis
• Dependency vulnerability scanning
• SQL injection and XSS protection
• CSRF protection
• Content Security Policy (CSP)
• Regular security training for developers

Security Incident Management

We have a comprehensive incident response plan:

• 24/7 security monitoring
• Rapid incident response team
• Transparent communication during incidents
• Post-incident analysis and remediation
• Regular incident response drills

Report a Vulnerability

We appreciate responsible disclosure of security vulnerabilities. If you discover a security issue, please report it to us at:

Email:security@session-replay.com
We commit to:

• Acknowledging your report within 24 hours
• Providing regular updates on the investigation
• Recognizing your contribution (with permission)
• Not pursuing legal action for responsible disclosure