Overview

Heap’s session replay privacy and security settings are highly customizable to make sure you don’t capture any sensitive information from your users.

Session replay privacy configurations are environment-specific. We recommend you enable session replay in your development environment first to test your privacy configurations. Once you are satisfied with your privacy settings, you can replicate them in your Production environment. 

You can view the privacy and security settings for session replay by navigating to Account > Manage > Replay & Heatmaps.

Text and form fields

The first question we ask is: What content should Heap mask from session replays?

Mask all text

Mask all text replaces all text content with asterisks, and Heap won’t capture the value of any form fields. This is the most conservative setting, and it is a good choice if you deal with lots of private user information.

This setting will redact all text in your replays and heatmaps, regardless of your broader Heap privacy settings.

Below is a what the Heap homepage looks like with Mask all text selected. This view gives you the “wireframe” or shape of the page so you can still watch replays and view heatmaps without the risk of exposing private information.

When finished, click the Save button at the bottom of the page. It will take between 30 seconds and 1 minute for your new settings to be applied and to take effect.

Mask all form fields and sensitive content

Select this option if you are comfortable capturing other types of content on your website, but don’t want to capture any form fields.

When finished, click the Save button at the bottom of the page. It will take between 30 seconds and 1 minute for your new settings to be applied and to take effect.

Capturing form fields

By default, Heap no longer enables the capturing of form field content in session replays and heatmaps. If you need to capture this data, contact our support team for assistance.

To learn more about how Heap blocks the collection of password and credit card information, see How do I prevent session replay from capturing certain data, such as passwords and credit card numbers?.

Mask additional elements

The second question we ask is: Should Heap mask any additional elements?

Outside of <input> elements, there may be other elements you want to exclude from being captured in session replay. To exclude other types of elements from being captured, list their CSS selectors in this box.

Examples of elements you may want to mask include:

• A billing address on an order confirmation page.
• A user’s first and last name on an account details page. 
• Personal financial information, such as a user’s salary.

Wildcards are not supported here; see the section CSS Class Semantics at the end of this guide to learn which CSS selectors you can use instead.

When finished, click the Save button at the bottom of the page. It will take between 30 seconds and 1 minute for your new settings to be applied and to take effect.

Unmask Additional Elements

The third question we ask is: Should Heap unmask any additional elements?

This is helpful if you have a lot of sensitive information on your pages that require most of the content to be masked using the Mask all text setting described above, but there is still information on the page that would be valuable to capture as part of your session replay.

Examples of elements you may want to unmask include:

• Header text in banner that is often used test different messaging
• Navigation and other product UI elements

Wildcards are not supported here; see the section CSS Class Semantics at the end of this guide to learn which CSS selectors you can use instead.

When finished, click the Save button at the bottom of the page. It will take between 30 seconds and 1 minute for your new settings to be applied and to take effect.

Choosing pages to be captured (Url allowlist / blocklist) 

This setting allows you to create rules for which domains, subdomains, and/or pages you want to capture.

Capture user activity for all domains, subdomains, and pages

This setting is selected by default; replays will be captured for all pages. 

Block user activity for specified domains, subdomains, and/or pages

This selection allows you to create a block list of URLs that you can control from the Heap app, without using code. Replays will not be captured on the URLs that you list here.

This is useful if there are parts of your app that you don’t want data collected. For example, you might not want to capture information on your order confirmation page because it contains customer information such as shipping address and phone number.

Once this radio option is selected, a textbox will appear. In order to add an entry, click inside the box, type the domain, subdomain, and/or pages you wish to block, and then press Enter or Comma on your keyboard.

When finished, click the Save button at the bottom of the page. It will take between 30 seconds and 1 minute for your new settings to be applied and to take effect.

Allow user activity for only specified domains, subdomains, and/or pages

This selection allows you to create an allow list of URLs that you can control from the Heap app, without using code. This option will prevent data from being captured from any location that is not specified. For example, if you only want to capture public pages, you would set up those rules here.

Once this radio option is selected, a textbox will appear. In order to add an entry, click inside the box, type the domain, subdomain, and/or pages you wish to capture, and then press Enter or Comma on your keyboard.

When finished, click the Save button at the bottom of the page. It will take between 30 seconds and 1 minute for your new settings to be applied and to take effect.

CSS Class Semantics

Heap does not support wildcards (*) in CSS selectors added to the inclusion or exclusion lists.

However, all standard CSS selectors are recognized so you may be able to use the ^, $ and * attribute selectors to achieve the same functionality. For example:

• a[class^="patient_name"] Selects every <a> element whose class attribute value begins with “patient_name”
• a[class$="diagnonsis"] Selects every <a> element whose class attribute value ends with “diagnosis”
• a[class*="medication_list"] Selects every <a> element whose class attribute value contains the substring “medication_list”

This may be necessary for customers using a React styling library. See React Styling Libraries & DOM Minification, for ways to automatically generate semantically useful class names when using a React styling library.