Privacy and PII redaction

What the SDK redacts before data leaves the page, and what it does not.

Where redaction happens

All redaction happens inside the SDK, before a log leaves the visitor’s browser or your server. It is on by default. Apperio’s servers don’t redact anything, so logs you send straight to the logs API are stored exactly as you send them.

What is covered

Protection	What it does
Pattern redaction	Replaces emails, card numbers, US Social Security and phone numbers, IP addresses, API keys and tokens, JWTs, bank account numbers, and US driving licence and passport numbers with labels such as [EMAIL_REDACTED].
Field masking	Masks the value of any field whose name contains password, secret, token, key, ssn or email, keeping only the first and last character.
Request URLs	In captured network requests, replaces the token, key, password, secret and api_key query parameters with [REDACTED].
Session replay	Records form field values as asterisks, always masks passwords, and hides the text of anything marked apperio-mask.

Pattern redaction and field masking apply to a log’s message, its data, the context you set, and its metadata. The full list of patterns, and how to add your own, is in Data sanitization.

What is not covered

Some fields are sent as they are:

The error itself: its name, message and stack trace, as stored on the log’s error field. Don’t put personal data or secrets in error messages.
The page address, the referrer and the browser’s user agent. Keep tokens and personal data out of your page URLs.

Patterns are not perfect

Redaction works by matching text. It can miss personal data in a format it doesn’t know, and it can redact harmless text that looks like personal data, such as a nine-digit order number. Don’t rely on it as your only safeguard: avoid logging personal data in the first place.

Cookies and browser storage

The SDK sets no cookies and doesn’t use local storage, session storage or IndexedDB. Everything it keeps, such as the session ID and logs waiting to be sent, lives in memory and is gone when the page closes.

What is sent to the AI model

Commit summaries, change explanations, suspect commit ranking, issue drafts and root cause analysis are written by Anthropic’s Claude. To do that, Apperio sends it:

for commits: the message, the changed file names and an excerpt of the diff;
for errors: the message, the stack trace, the page it happened on, its release and occurrence counts, and the candidate commits’ messages and file names.

How long data is kept

Logs: 30 days by default, adjustable in Settings › Retention.
Session replays: 7 days.