ShieldReplay security overview

Security architecture overview · Not a certification

This document describes how ShieldReplay protects customer data and supports security evaluations. It is intended for security reviewers and procurement teams.

Trust principles

Tenant isolation — Users access only sites they belong to; ingest tokens are registered per site.
Least privilege — Role-based site membership (owner, admin, viewer).
Encryption — Automation secrets encrypted at rest when AUTOMATION_SECRET_KEY is configured; TLS in transit.
Auditability — Automation and admin actions logged in AutomationAuditLog.

Allowed origins (ingest security)

Important: The site token in your recording snippet is visible in the browser. Anyone can copy it. Protection comes from your allowed domains list, not token secrecy.

ShieldReplay validates the browser Origin (or same-host Referer) on every ingest request. Only origins you explicitly save for a site can send session events. Cross-origin requests from unlisted domains receive 403 Origin not allowed.

Configure domains in Setup wizard step 2 or the admin allowed-origins panel.
Add every URL scheme + host where the snippet runs (e.g. https://app.example.com).
Include staging and preview environments separately if they use different origins.
Rotate the site token if you suspect it was exposed publicly.

SOC 2 readiness mapping (self-assessed)

This mapping describes engineering controls that can support a future audit. ShieldReplay does not claim SOC 2 certification until an independent auditor has issued a report.

Criteria	ShieldReplay control
CC6.1 Logical access	JWT authentication, per-site tokens, optional ADMIN_API_KEY break-glass
CC6.6 Encryption	HTTPS, AES-256-GCM for automation secrets
CC7.2 Monitoring	Security incidents, browser probes, automation run history
CC8.1 Change management	Automation version history and restore
CC9.2 Privacy	IP hashing, configurable retention with automatic purge, session-scoped data

Data collected

Session replay frames, cursor events, DOM mutations, JavaScript errors, security probe signals, and optional custom events. New sites mask form inputs, textareas, selects, editable content, passwords, and explicit data-shield-mask regions by default. Administrators remain responsible for reviewing selectors before production rollout.

Privacy operations and access accountability

Replay views are written to a site-scoped access audit containing user, session, action, and timestamp.
Owners and administrators can export or delete sessions belonging to an identified email or user ID through the privacy API.
Retention cleanup removes expired sessions and their cascade-linked replay data.
Network request bodies and console capture are disabled by default; request headers and traits apply sensitive-key redaction.

Incident response

Security incidents are stored with risk scores and replay deep links. Automations can notify Slack, PagerDuty, Jira, or webhooks with investigator context.

Contact

For security questionnaires, contact your ShieldReplay account team or open a ticket with your deployment environment (cloud/self-hosted).