Session Recording Privacy

Overview

This document describes how Brainfish handles sensitive data during session recording. Our privacy-first approach ensures that personally identifiable information (PII) and sensitive data are automatically redacted before any data leaves the user's browser.

---

Key Privacy Principles

1. Client-Side Processing: All redaction happens in the user's browser before transmission
2. Automatic Protection: Sensitive data is redacted by default without requiring configuration
3. Granular Control: Multiple methods to customize what gets recorded
4. Opt-Out First: Recording can be disabled entirely or for specific environments

---

Session Recording Privacy

What Gets Masked

Our session recording system automatically protects sensitive user input through the following mechanisms:

1. Input Masking

All user inputs are masked by default (maskAllInputs: true), which means:

• Text input fields: Content is replaced with asterisks (***)
• Password fields: Always masked, regardless of other settings
• Textareas: Content is masked to protect sensitive information
• Select dropdowns: Selected values are masked

2. DOM Element Exclusion

Specific elements can be completely excluded from recording using CSS classes:

CSS Class	Purpose	Effect
bf-nocapture	Complete exclusion	Element and its contents are completely removed from recordings and screenshots
bf-ignore-input	Ignore input changes	Input events are not captured, but the element remains visible
bf-mask	Text masking	Text content is replaced with placeholder characters

Example Usage:

<!-- Completely exclude sensitive section -->
<div class="bf-nocapture">
  <p>Credit Card: 4532-1234-5678-9010</p>
</div>

<!-- Mask text content -->
<span class="bf-mask">John Doe</span>

<!-- Ignore input changes -->
<input type="text" class="bf-ignore-input" />

Recording Console Logs

Console error messages are captured to aid in debugging, but with limitations:

• Only errors are recorded (not info, warn, or debug messages)
• No length limitations on captured logs
• Does not capture network requests or responses

---

Redaction Examples

Example Session Recording

Example web page that the agent will be recording:

sample-page.mp4 832x758

The recorded version after converted to video format:

• Input fields are automatically masked

• Other sensitive elements require DOM Element Exclusion

session-recording.webm 1280x671

---

Environment and Domain Controls

Recording Blocklist

You can prevent recording on specific URL paths using path patterns.

The blocklist uses URL pathname matching (not domain matching). Patterns are matched against window.location.pathname using the path-to-regexp library, which supports:

• Exact paths: /admin/settings
• Wildcards: /admin/*path
• Named parameters: /user/:id
• Optional parameters: /products/:id?

When the current page's path matches any pattern in the blocklist, no recording or screenshots are captured.

To add paths to the blocklist:

1. Navigate to the Agents screen.
2. Select your agent.
3. Under Ambient Settings, add the URL path using the patterns above.

Localhost Recording

By default, recording is disabled on localhost environments.

---

How to Opt Out or Customize Recording

Complete Opt-Out

Option 1: Path Blocklist

Add URL path patterns using the blocklist configuration (see Environment and Domain Controls > Recording Blocklist).

Option 2: Disable Screen Recording

1. Navigate to the Agents screen.
2. Select your agent.
3. Under Ambient Settings, toggle off the Enable observe and learn setting.

Selective Opt-Out

Exclude Specific Page Sections

Add the bf-nocapture class to any element you want to completely exclude:

<!-- This entire section will be excluded -->
<div class="bf-nocapture">
  <h2>Sensitive Information</h2>
  <p>This content will not appear in recordings or screenshots</p>
</div>

Mask Specific Text

Use the bf-mask class to replace text with asterisks:

<span class="bf-mask">Confidential Data</span>

Ignore Specific Inputs

Prevent input changes from being recorded while keeping the field visible:

<input type="text" class="bf-ignore-input" placeholder="Private notes" />

---

Data Retention and Storage

What Gets Transmitted

Only the following data is sent from the user's browser:

1. Redacted session recordings: DOM mutations with all inputs masked
2. Metadata: Page URLs, titles, timestamps, and user interaction events (clicks, scrolls)
3. Console errors: Error messages only (no sensitive console logs)

What Never Gets Transmitted

• Original unmasked input values
• Password field contents
• Elements marked with bf-nocapture
• Recordings from pages matching blocklist paths
• Network request/response data

---

Technical Implementation Details

Session Recording

Built on rrweb (record and replay the web), an open-source session recording library with built-in privacy features:

• Records DOM mutations, not pixel data
• Respects privacy CSS classes
• Configurable masking strategies
• Sampling controls to reduce data volume

---

Compliance Considerations

This system is designed with privacy regulations in mind:

• Minimal data collection: Only captures what's necessary for support and debugging
• Client-side processing: PII redaction happens in the browser before any transmission
• User control: Multiple opt-out mechanisms at different granularities
• Transparency: This document provides full disclosure of data handling mechanisms

---