Security

OnProd records what happens on your website, so it holds data your visitors trust you with. This page describes how we protect it. It is a summary: the binding commitments are in our data processing agreement.

Hosting in Australia

OnProd runs on Amazon Web Services in the Sydney region (ap-southeast-2): the servers, the database, the replay storage and the backups. AWS is responsible for the physical security of its data centres. Every request reaches our servers through Cloudflare’s network, from a Cloudflare data centre near the visitor, and the servers accept web connections only from Cloudflare. Data leaves Australia only for the services on our sub-processors page: in transit through Cloudflare, and for AI Insights through the Anthropic API when a customer chooses it.

Less data in the first place

• Inputs are masked in the browser. By default, values typed into form fields are replaced before anything leaves the page. Site owners mask more text with data-at-mask, leave elements out with data-at-block, or mask all text with maskAllText.
• URLs are redacted in the browser. Sensitive parameters, such as tokens, codes, e-mail addresses and passwords, are replaced before page addresses, referrers and errors are sent, and again on our servers.
• No IP addresses in your data. A visitor’s country comes from Cloudflare or from a database on our own servers, and their network from that database. The IP address is not stored with events or sessions; it appears only in our server logs.
• Counted only, where the law asks for consent. With the stricter privacy settings, visitors in opt-in regions are only counted, with no replay, no visitor or user IDs and nothing stored in the browser, until your site records their consent.
• AI Insights are on by default, and can be turned off for each site. The evidence for an Insight is built without session or user IDs, IP addresses, locations, network names, full user agents or form values, and is checked for IDs and network names before it is sent. It does include page text your site didn’t mask. Every Insight shows exactly what was sent.

Encryption

• Every connection to OnProd, from the dashboard, the API and the script on your sites, uses HTTPS (TLS 1.2 or later), from the browser to Cloudflare and from Cloudflare to our servers, which present a certificate Cloudflare checks.
• Server disks (including the database’s own volume), replay storage and backups are encrypted at rest with keys managed by AWS. Replay storage and backups accept only encrypted connections.
• API keys are stored as SHA-256 hashes. A key that can only send data is also kept readable, because it sits in your site’s pages anyway.

Sign-in and accounts

• Sign in with your own e-mail address and password, stored only as a scrypt hash, or, once we offer it, with Google, GitHub or Microsoft. A provider is connected to an existing account only by you, from your account page, and you are told by e-mail when one is added.
• E-mail addresses are verified before they can see any data.
• Two-factor authentication with an authenticator app, with single-use recovery codes. Its secrets are encrypted with AES-256-GCM, and you are told by e-mail when it is turned on or off or a recovery code is used.
• Accounts are locked for 15 minutes after 10 failed sign-in attempts, and sign-in is rate-limited per connecting address.
• Dashboard sign-in sessions are random tokens stored only as hashes, sent in cookies that page scripts can’t read, only over HTTPS with the SameSite=Lax setting, and they last at most 7 days. Your account page lists your sessions, and you can end any of them.
• Requests that change data must come from the dashboard’s own origin, against cross-site request forgery.
• Workspace roles: owners, admins and members. Invitations are single-use links that expire after 7 days and only work for the address they were sent to.
• An audit log of sign-ins, security changes and who changed what in a workspace, and when.
• API keys are limited by scope: the key in your site’s page can only send data, and keys that can read your analytics are shown once. Creating or deleting sites and managing keys, members, retention and user data needs a dashboard sign-in with the right role. No API key can do it, except that a key with the erasure scope can ask for one person’s data to be deleted, and can read nothing.

Separating customers’ data

Every request is checked, in one place, against the workspace that owns the site it names. An API key works only for the site it was created for: whatever site a request names, the server uses the key’s own. Automated tests run every API route as another workspace’s owner and check it can’t read or change anything.

Deleting data

• Deleting a site or a workspace stops its data collection at once, and its events, sessions and replays are erased 7 days later.
• You can delete your account from your account page. Workspaces you were the only member of are deleted with it.
• Site owners can export everything recorded about one of their users, delete it (or everything recorded from one browser), and set how long data is kept.
• Deleted data stays in our backups until they expire, as described under Operations.

Application security

• Security headers, including a content security policy that stops the dashboard being framed by other sites.
• Parameterised database queries throughout.
• Rate limits on the API and on data collection.
• [Confirm the dependency update process, for example automated alerts for vulnerable packages.]

Operations

• Production access is limited to [named staff], [with multi-factor authentication on AWS]. The servers have no SSH: their shell is reached only through AWS Systems Manager Session Manager. Server secrets are kept encrypted in AWS Systems Manager Parameter Store.
• The database is backed up every night to a separate, encrypted S3 bucket in the Sydney region, which the server can add to but not delete from. Each backup is kept for 30 days and removed for good 7 days later. Replay storage keeps old versions, so a deleted recording can be recovered for 30 days before it is removed for good. [How often a restore is tested.]
• Server logs record request addresses and IP addresses for troubleshooting and are rotated within [14] days.

Incidents and breach notification

If we find or are told about a security incident, we investigate it, contain it and fix the cause. If it affects your data, we tell your workspace owners without undue delay and within [48] hours of becoming aware of it, with what we know and what we are doing, and we keep you updated. We help you meet your own obligations, such as the 30-day assessment under Australia’s Notifiable Data Breaches scheme and the 72-hour notification under the GDPR, and we notify the Office of the Australian Information Commissioner and affected people ourselves when the law requires us to.

Reporting a vulnerability

If you think you have found a security problem in OnProd, e-mail [email protected] with the details and how to reproduce it. We’ll confirm we received it within [3] business days and keep you informed while we fix it. Please give us reasonable time to fix it before telling anyone else.

When you test, don’t access or change other customers’ data (use your own workspace), don’t degrade the service for others, and don’t use social engineering or physical attacks. [We won’t take legal action against research done in good faith under these rules: confirm.] We don’t run a paid bug bounty at the moment.

Certifications

OnProd doesn’t hold its own security certification, such as SOC 2 or ISO 27001, yet. Our infrastructure provider, AWS, holds these; its reports are available through AWS Artifact. For security questionnaires, e-mail [email protected].