Security

Last updated 2026-09-29

Architecture

The whole product runs on Cloudflare. The recorder posts to an edge worker that validates and stores; a second worker serves this site and the dashboard. Recording data lives in object storage, compressed, with metadata in a serverless SQL database. There are no long-running servers to patch and no separate analytics pipeline holding a second copy of anything.

Data minimisation, enforced in the browser

The most important protections happen before anything is transmitted, which means they cannot be undone by a mistake on our side:

Typed form-field values (text inputs, text areas, dropdowns and passwords, hidden and file inputs included) are replaced with asterisks as the page is serialized. There is no unmask feature because there is nothing to unmask. Which checkbox or radio button is ticked is recorded, so put a sensitive one inside an element with data-sr-block. Text typed into a rich-text (contenteditable) editor is page text, not a form field: it is masked only where the editor has class="sr-mask".
Shopify checkout URLs, and any URL whose path has a /checkout or /checkouts segment, abort recording entirely.
Sensitive URL parameters are redacted in the address, and also inside every attribute of the page that carries a URL — links, images, stylesheets, form actions.
The redaction runs again server-side on arrival, because the ingest endpoint is public by design and client-side sanitisation alone can be bypassed.

Access control

Passwords hashed with PBKDF2-SHA256 at the platform's maximum iteration count. Session tokens are stored only as SHA-256 hashes, so a database copy cannot be replayed as a login.
TOTP two-factor authentication on any account, free, with single-use recovery codes stored hashed. The second factor applies to social sign-in too.
Four roles, and per-site grants: a member or viewer sees only the sites they are assigned. That is enforced in the database query, not in the interface.
What your team does with recordings is written to an append-only audit log kept for two years, longer than any recording it describes: each replay opened (one entry per person, recording and day), each share and share-link open, each deletion and each role change — in the dashboard or with your workspace's API keys.
Share links carry a hashed 160-bit token, are scoped to one recording, expire, and are revocable.

Handling hostile input

The recording endpoint is public by design — the site key ships in your page source — so everything it stores is treated as attacker-controlled in every place it is later displayed. Compressed uploads are bounded on their decompressed size, not just their transfer size, because a compressed-size cap is not a size cap. Site and session identifiers are pattern-validated before they are ever used to build a storage path.

For your PCI assessor

If you are assessed under PCI DSS 4.0.1, requirements 6.4.3 and 11.6.1 ask you to inventory and justify every script on a payment page. Ours makes that straightforward:

Script URL: https://cdn.replayfy.com/t.js
Purpose: user-experience session replay for the merchant's own analysis.
Payment pages: the recorder stops on Shopify checkout URLs and on any URL whose path has a /checkout or /checkouts segment (/checkout, /en/checkout/payment, /checkouts/…). If your payment page lives at another address, leave the snippet off it. It should not be present in your payment-page inventory at all; if it is, tell us and we will help you work out why.
Integrity: the script is versioned and served from a single origin under our control, so you can pin it in your CSP and monitor it for change.

Reporting a vulnerability

Email support@appifycommerce.com with "Security report" in the subject. We will acknowledge within one business day. Please give us a reasonable window before disclosing publicly; we will not take legal action against good-faith research that stays within your own account.

What we do not claim

We are a small team and we would rather be exact than impressive. We do not hold SOC 2 or ISO 27001 today, and we will not imply otherwise on a sales call. What we do have is a small attack surface, a short sub-processor list, a recorder that masks typed form-field values in the visitor's browser before anything is sent (a rich-text editor needs class="sr-mask"), and the ability to delete any single recording without touching the rest.

Check it yourself

The free plan has every security feature above — two-factor sign-in, per-site access, the audit log and single-recording delete — so you can verify each one before you pay anything.

Start free Watch a real replay