Session replay with privacy masking built in
Watch exactly what a user saw and did before an error or slowdown, with sensitive input masked by default and every replay linked to backend traces.Why teams use Session Replay in Obseria
Reproduce bugs instantly
See the clicks, inputs and page states that led to an error instead of asking users for screenshots.
Privacy by default
Text input, form fields and marked elements are masked in the browser before any data leaves the device.
Full-stack context
Each replay links to RUM metrics, JavaScript errors and the distributed traces of its requests.
Session Replay in three steps
- Step 1
Enable replay in the RUM agent
Session replay is part of the Obseria RUM agent; turn it on and configure sampling and masking rules.
- Step 2
Mask and capture
The agent records DOM changes rather than video, masks sensitive content in the browser and sends compressed events.
- Step 3
Replay with context
Open a replay from an error, a slow page or a user journey and follow it alongside the network and trace timeline.
Capabilities
- DOM-based recording. Lightweight capture of DOM snapshots and mutations, rendered as pixel-accurate playback.
- Masking levels and rules. Mask all text, only inputs or custom selectors; block elements entirely from recording.
- Error and frustration signals. Jump to errors, rage clicks, dead clicks and slow interactions on the replay timeline.
- Network and trace timeline. See requests, their timing and the backend traces behind them next to the playback.
- Sampling controls. Record a percentage of sessions, or always keep sessions that contain errors.
- Search and segment replays. Find sessions by page, user attribute, browser, release or error type with OQL.
Session Replay: what you need to know
What is session replay?
Session replay reconstructs a user's visit to a web application so that engineers, designers and support teams can see what happened, step by step. Instead of recording a video, modern session replay captures the structure of the page, the Document Object Model, together with every change, mouse movement, scroll and click. The replay player rebuilds the page from these events, which keeps data volume small and makes masking of sensitive content possible.
Session replay answers the questions that metrics and logs cannot: What did the user click before the error? Did the button render at all? Did a layout shift move the target away? Was the spinner visible for twelve seconds?
Why session replay matters
Frontend bugs are notoriously hard to reproduce. They depend on browser versions, screen sizes, extensions, timing and the exact sequence of user actions. Support tickets rarely contain enough detail, and developers lose hours trying to recreate a state that existed only once.
- Faster debugging: a replay attached to a JavaScript error shows the full path to the failure.
- Better UX decisions: rage clicks, dead clicks and hesitation reveal confusing interfaces that never throw an error.
- Efficient support: support engineers can see the problem a customer describes without screen-sharing sessions.
- Shared understanding: product, design and engineering look at the same evidence instead of debating assumptions.
Privacy masking: how to replay sessions responsibly
Session replay touches personal data, so privacy is not an add-on but a design requirement, especially under GDPR. The most important principle is that sensitive content must be masked in the browser, before it is transmitted, rather than filtered later on the server.
- Mask inputs by default: all form fields, including passwords, payment fields and free-text inputs, are replaced with placeholders.
- Mask text where needed: for pages showing account data, mask all text and show only layout and interactions.
- Block elements entirely: exclude components like payment iframes or document previews from recording.
- Respect consent: start recording only after the user has given consent where required, and keep sampling rates proportionate.
- Limit access and retention: restrict who can view replays and keep them only as long as needed.
Session replay with Obseria
Session replay in Obseria is part of the RUM agent, so there is no second script to deploy. Masking is applied in the browser with secure defaults: inputs are always masked, and you can mask all text or specific CSS selectors and block elements from capture. Obseria Pipeline adds a second layer by masking PII in URLs and attributes at ingest, and field-level access controls determine who may open replays. Data can be kept in the EU (Frankfurt, Dublin), the UK or your own cloud account, and customer data is never used for AI training.
Every replay sits on the same timeline as RUM data: Core Web Vitals, JavaScript errors from the Errors Inbox, network requests and the backend distributed traces they triggered. From a failed checkout you can move from the click to the API call, to the slow database span and to the logs of the service involved. Sampling rules let you record a fraction of all sessions while always keeping sessions that contain errors.
Session replay best practices
- Start with strict masking and relax it only for pages where you are sure no personal data is displayed.
- Prioritize error sessions in your sampling configuration to get the most diagnostic value per recorded session.
- Link replays to issues so that each bug report carries visual evidence.
- Review frustration signals regularly to find UX problems before users report them.
- Document your setup in your privacy notice and data processing records.
- Combine replays with metrics. A replay explains one session; RUM shows how many users share the same problem.
Frequently asked questions
Session replay can be operated in line with GDPR when you mask personal data, obtain consent where required and limit access and retention. Obseria masks inputs in the browser by default, masks PII at ingest and offers EU data residency.
No. Obseria records DOM snapshots and changes and rebuilds the page in the player. This keeps data volumes small and allows masking before data leaves the browser.
Yes. You can mask text in elements matching CSS selectors or block elements completely, for example payment widgets or document previews.
RUM measures performance and errors across all users, and session replay shows individual sessions in detail. In Obseria both come from the same agent and every replay links to its RUM metrics, errors and traces.
Recording is lightweight because only DOM changes are captured and sent compressed in the background. Sampling controls let you limit how many sessions are recorded.
Ready for observability that delivers answers?
Try every feature free for 14 days, no credit card and no proprietary agents.