Session replay · Tier 2
Watch the visit,
never the keystrokes.
Session replay is Observer's consent-gated tier: full rrweb capture for visitors who explicitly opt in, with input values masked at source — they never leave the browser. Playback runs in a sandboxed iframe with no network access and no storage, over recordings that expire after 30 days.
The player
Playback in a sandbox, not a window.
Recorded sessions play inside a sandboxed iframe — allow-scripts only, no network access, no cookie or storage leakage — running the full rrweb replayer: play, pause, scrub and speed control. Around it, the recording browser lists every recording by date, session key, chunk count and size; click to watch, delete when done.
No leakage surface
The player iframe gets allow-scripts and nothing else — no network, no cookies, no storage. What plays back cannot phone home.
Full transport
Play, pause, scrub and speed — the complete rrweb replayer, driven from your own dashboard.
30 days, then gone
Recordings TTL out at 30 days — enforced in the schema — and every deletion is audit-logged.
Masking
Masked at the source, not after upload.
maskAllInputs is applied in the visitor's browser, before a frame is serialized — input values never leave the page. There is no clear text in transit, none at rest, and nothing to redact later. Publishers extend the masking with a three-class DOM contract:
<!-- values never leave the browser -->
<input class="obs-mask"> text masked in the recording,
layout preserved
<section class="obs-block"> element redacted from the
recording entirely
<aside class="obs-ignore"> element skipped by the recorder,
never captured
<!-- maskAllInputs covers every field, by default -->
Masking happens before serialization, inside the visitor's browser — the collector never sees the clear text, so no pipeline stage, log file or backup can leak what was never sent.
Lifecycle
10-second chunks to audit-logged deletion.
A recording is a pipeline, not a video file — every stage has a stated behavior, and every stage is testable.
| Stage | What happens |
|---|---|
| Capture | rrweb frames serialized in the visitor's browser — inputs masked at source; canvas, fonts and images excluded |
| Chunking | 10-second gzip chunks, uploaded with per-site recorder tokens |
| Sampling | deterministic per-session sampling — enabled per site, applied per session |
| Retention | 30-day TTL enforced in the schema, not by policy |
| Deletion | automatic at TTL or manual from the recording browser — every deletion audit-logged |
| Withdrawal | consent withdrawal stops capture immediately |
Setup
What recording requires.
Replay is off until a site deliberately turns it on — three switches, all per site, all configurable via the add-website wizard or the API.
| Requirement | Scope | What it means |
|---|---|---|
| Tier T2 — Consented | per site | explicit opt-in per visitor; collection starts only after consent. Tiers are enforced server-side by the collector — the snippet cannot upgrade itself. T2 also unlocks a 13-month localStorage visitor id for consenting visitors, never auto-extended on visits |
recorder_sample > 0 | per site | recording sampling enabled, with deterministic per-session selection |
recorderToken | per site | upload tokens gate every chunk the recorder sends |
DNT, Global Privacy Control and an explicit observer('optOut') silence the SDK unconditionally — no tier and no setting overrides them.
Replay that survives
your privacy review.
Replay is the one Observer capability that asks permission — and it behaves accordingly: masked at the source, sandboxed at playback, expired on a TTL, audited on every deletion. Access is granted after an NDA, and deployment happens together with your DevOps team.