Security + Privacy: Security practices

Replay recordings can contain everything your app did in a browser session, so security covers product design, server architecture, and employee access. We monitor our posture continuously with Vanta against formal policies.

Replay has a SOC 2 Type 2 attestation for Security, Confidentiality, and Availability. Email security@replay.io for a copy of the report or for more detail than this page gives. Our public Security and Privacy page covers software development, encryption, authentication, and access control.

Security baseline

Identity and access management

Employees access the AWS console and APIs through SSO. Workloads use IAM roles rather than long-lived IAM user credentials.

Monitoring

CloudTrail, GuardDuty, and Vanta report on and monitor our cloud posture.

Vulnerability scanning

Dependabot and Snyk track dependency vulnerabilities and tell us when to patch. Semgrep runs static analysis for security and quality problems.

Patching and updates

Replay Browser is built on Chromium and Replay Node on Node.js, so both inherit the security work of those projects. The replayio CLI notifies you when a new Replay Browser build is available and installs it with replayio update.

Beyond the baseline

Isolation when viewing a recording

Viewing a recording does not make real network connections, touch the filesystem, or issue other syscalls: the recorded browser is replayed from its captured inputs. Each recording being viewed runs in its own container, isolated from other customers' recordings.

Anonymized data in staging

Production data is fully anonymized of PII before it is used in staging to test database changes.

Network perimeter

Internal services sit behind a Tailscale VPN.

Customer-controlled features

Recordings are private by default and belong to you. Replay DevTools teams on enterprise plans can bring their own storage bucket for recording data. SSO and OIDC are available to all Replay DevTools teams at no extra cost.

Reporting security problems

If you find a security issue in a Replay product, email security@replay.io. We do not run a bug bounty program, but we do coordinate directly with researchers who report problems.