Skip to main content

​
Default Protection

The Recording SDK captures Document Object Model (DOM) structure and changes. It does not capture raw screen pixels. Configure privacy controls before production use. The SDK applies these controls when you do not supply custom values:
  • It masks values in <input>, <textarea>, and contenteditable elements.
  • It masks text inside elements that match [data-csr-mask].
  • It blocks elements that match [data-csr-block].
  • It blocks <video> elements.
A custom maskSelectors or blockSelectors array replaces the default array. Include the default selectors when you add your own selectors.

​
Mask Text

Masking replaces text while it preserves the page layout. The original text does not leave the browser.
maskInputs is true by default. Password inputs remain masked even if you set maskInputs to false.

​
Block Elements

Blocking replaces an element tree with a placeholder. Text, images, and child nodes inside the blocked element do not leave the browser.
Use blocking for media, third-party widgets, and sections that the SDK must not serialize.

​
Data Included by Default

The SDK can include:
  • DOM structure, attributes, text content, and incremental DOM changes
  • Clicks, input actions, scrolling, tab visibility, and route changes
  • The initial page URL and document referrer
  • Browser, operating system, language, time zone, device, screen, and viewport data
  • Custom context that your application supplies
The initial page URL or referrer can contain a query string. Do not put sensitive data in URLs. Route parameterization changes path segments, but it does not remove query strings or fragments.

​
Optional Diagnostic Data

The SDK disables console and network capture by default.

​
Console Output

Set captureConsoleLogs to true or select specific levels. Console messages can contain personal data, tokens, and internal application details.

​
Network Request Metadata

Set captureNetworkRequests to true to record fetch and XMLHttpRequest metadata. The SDK records the method, full URL, status, duration, request size, response size, and GraphQL operation name when available. The SDK does not send request headers, response headers, request bodies, or response bodies. For GraphQL requests, it reads the request body in the browser only to extract the operation name.

​
Custom Application Data

Your application controls the values passed through context, tags, and measurements. Do not include personal data, access tokens, or secrets. See Custom recording data for usage guidance.

​
Retention and Deletion

Recordings do not expire after a fixed period. Confidence retains them until the customer contract expires or Confidence receives an explicit deletion request.

​
Privacy Checklist

  • Keep maskInputs enabled.
  • Include the default selectors when you add custom selectors.
  • Block a complete element tree when masking does not provide enough protection.
  • Keep personal data and secrets out of URLs, context, tags, and console messages.
  • Enable console or network capture only when you need the diagnostic data.
  • Test masking and blocking in the same application version that you deploy.