> ## Documentation Index
> Fetch the complete documentation index at: https://confidence-auth-testing.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy and Data Masking

> Configure privacy controls and understand the data included in recordings.

## Default Protection

The Recording SDK captures Document Object Model (DOM) structure and changes. It
does not capture raw screen pixels. Configure privacy controls before production use.

The SDK applies these controls when you do not supply custom values:

* It masks values in `<input>`, `<textarea>`, and `contenteditable` elements.
* It masks text inside elements that match `[data-csr-mask]`.
* It blocks elements that match `[data-csr-block]`.
* It blocks `<video>` elements.

<Warning>
  A custom `maskSelectors` or `blockSelectors` array replaces the default array.
  Include the default selectors when you add your own selectors.
</Warning>

## Mask Text

Masking replaces text while it preserves the page layout. The original text does
not leave the browser.

```typescript theme={null}
const recorder = initSessionRecorder({
  clientSecret: '<your-client-secret>',
  maskSelectors: ['[data-csr-mask]', '.pii', '[data-sensitive]'],
  maskInputs: true,
});
```

`maskInputs` is `true` by default. Password inputs remain masked even if you set
`maskInputs` to `false`.

## Block Elements

Blocking replaces an element tree with a placeholder. Text, images, and child
nodes inside the blocked element do not leave the browser.

```typescript theme={null}
const recorder = initSessionRecorder({
  clientSecret: '<your-client-secret>',
  blockSelectors: ['[data-csr-block]', 'video', '.third-party-widget'],
});
```

Use blocking for media, third-party widgets, and sections that the SDK must not
serialize.

## Data Included by Default

The SDK can include:

* DOM structure, attributes, text content, and incremental DOM changes
* Clicks, input actions, scrolling, tab visibility, and route changes
* The initial page URL and document referrer
* Browser, operating system, language, time zone, device, screen, and viewport data
* Custom context that your application supplies

The SDK removes query strings and fragments from the captured page URL and document
referrer. Do not put sensitive data in URL paths.
[Route parameterization](/docs/recordings/route-parameterization) changes dynamic
path segments so that Confidence can group related pages.

## Optional Diagnostic Data

The SDK disables console and network capture by default. These channels can contain
sensitive data from first-party and third-party code. Select a sanitizer
before you enable them in production.

The sanitizer options require `@spotify-confidence/session-recording` version
0.18.17 or later.

### Console Output

Set `captureConsoleLogs` to `true` or select specific levels. These existing settings
capture raw console output.

```typescript theme={null}
captureConsoleLogs: { levels: ['warn', 'error'], sanitize: true },
```

The built-in sanitizer removes query strings and fragments from URLs in captured
console payloads and stack traces. Console messages can also contain personal data,
tokens, and internal application details that are not in URLs. Use a custom sanitizer
for these values.

### Network Request Metadata

Set `captureNetworkRequests` to `true` to record raw `fetch` and XMLHttpRequest
metadata. The SDK records the method, full URL, status, duration, request size,
response size, and GraphQL operation name when available.

Use the built-in sanitizer to remove query strings and fragments from captured
request URLs:

```typescript theme={null}
captureNetworkRequests: { sanitize: true },
```

The SDK does not send request headers, response headers, request bodies, or response
bodies. For GraphQL requests, it reads the request body in the browser only to extract
the operation name.

### Custom Sanitizer

Use a function when sensitive values can occur outside URL query strings and
fragments. The SDK passes each request URL, console payload, and console stack trace
to the sanitizer before the captured data leaves the recorder.

```typescript theme={null}
const redactSecrets = (value: string) =>
  value.replace(/client_secret=[^&\s]+/g, 'client_secret=[REDACTED]');

const recorder = initSessionRecorder({
  clientSecret: '<your-client-secret>',
  captureNetworkRequests: { sanitize: redactSecrets },
  captureConsoleLogs: {
    levels: ['warn', 'error'],
    sanitize: redactSecrets,
  },
});
```

If a sanitizer throws an error or returns a value that is not a string, the SDK drops
that capture event. It does not change the application request or console call, and it
continues to capture later events. When `CSR_DEBUG` is set in `sessionStorage`, the SDK
logs a prominent security warning without the original value.

## Custom Application Data

Your application controls the values passed through context, tags, and measurements.
Do not include personal data, access tokens, or secrets. See
[Custom recording data](/docs/recordings/custom-data) for usage guidance.

## Retention and Deletion

Recordings do not expire after a fixed period. Confidence retains them until the
customer contract expires or Confidence receives an explicit deletion request.

## Privacy Checklist

* Keep `maskInputs` enabled.
* Include the default selectors when you add custom selectors.
* Block a complete element tree when masking does not provide enough protection.
* Keep personal data and secrets out of URL paths, context, tags, and measurements.
* Enable console or network capture only when you need the diagnostic data.
* Sanitize console and network capture before you enable it in production.
* Check requests and console output from third-party code, not only your application.
* Test masking and blocking in the same application version that you deploy.