Security
Your events, kept on your terms
A replay store holds the most detailed record of your system that exists. It should pass the same review as the database it records — so here is everything, in plain words.
Choose a retention policy per service
Set once per service, changed at any time. The policy decides what a replay of that service can and cannot reconstruct.
-
Full100% kept
Every event, every field except those you name. The only policy under which a replay reconstructs state exactly at any offset.
-
Redacted100% kept
Everything, minus the field paths you list. They are dropped inside your process by the recorder, so they never cross the wire.
-
Sampled10% kept
One event in ten, chosen before sending. Shows the shape of an incident; the product refuses to print a state table it cannot trust.
-
None0% kept
The service records nothing. There is no window and nothing to replay, and the app says so instead of showing an empty console.
Controls
- Encryption
- TLS 1.3 in transit; AES-256 at rest with per-workspace keys.
- Regions
- London or Frankfurt, chosen at sign-up. Events are never copied out of the region.
- Access
- SAML SSO and SCIM on Enterprise; every read of an event is written to the audit log.
- Audit
- SOC 2 Type II, renewed each March. The report is available under NDA.
- Deletion
- Any window on request, and the whole account within one hour of closing it.
- Training
- We never train anything on your events, sell them, or use them as an example.
What cannot be replayed?
Third-party responses — a card network, an address lookup, anything behind someone else's API — were never yours to record. They are re-fetched at replay time and marked on screen, beside the number.
- Recorder overhead
- < 0.3 ms — p99, flushed off the request path
- Export
- Unlimited — Newline-delimited JSON, gzip
- Deletion
- Within 1 hour — On request and on cancellation
- Ingest availability
- 99.9% — Per calendar month, or the next month is free
Send us your security questionnaire
We answer vendor questionnaires within five working days and share the SOC 2 report under NDA.
npm install @fenwright/recorder