Legal
Last updated September 16, 2026
This page describes the technical and organisational measures Spectry maintains to protect personal data processed on behalf of customers, as required by Article 32 of the GDPR. It forms Annex II of our Data Processing Agreement.
It is written to be verifiable: each measure names the mechanism that implements it, rather than asserting a general intention.
Visitor IP addresses are never stored.
An IP address is used transiently at request time to resolve an approximate geographic region, then discarded. It is not written to any analytics table, log or backup. Our analytics datasets therefore contain no direct network identifier for end visitors — a stronger position than the common industry practice of storing IP addresses with optional truncation.
Visitors are identified by pseudonymous identifiers only. Session and visitor identifiers are randomly generated values scoped to a single customer site. They carry no inherent meaning and cannot be resolved to a natural person by Spectry, and they cannot be used to link a visitor across different customer sites. Where a customer supplies its own user identifier through the identify API, that value is supplied and controlled by the customer as controller.
Capture is conservative by default. A customer must actively opt in to broaden it.
| Measure | Default | Detail |
|---|---|---|
| Form input masking in replay | On | All inputs masked before leaving the browser |
| Canvas recording | Off | Canvas content is not captured |
| Cross-origin iframe recording | Off | Third-party frame content is not captured |
| Sensitive-pattern redaction | On | Payment card numbers (validated by checksum to reduce false positives), social security numbers, email addresses and international telephone numbers are redacted from captured text |
| Element-level exclusion | Available | Any element can be marked to mask its text or to be excluded from capture entirely |
Text rendered on the page — as distinct from text entered into form fields — is not masked by default. The sensitive-pattern redaction above catches payment cards, emails, phone numbers and social security numbers, but it will not catch a rendered personal name or postal address.
Customers whose pages display personal data should apply element-level masking to those elements. We state this plainly because a measure that does not exist should not be implied, and because acting on it is the customer's decision to make.
The Spectry browser script does not capture, store or transmit any data, and does not write any identifier to a visitor's device, until the applicable consent signal is present. This is enforced structurally — all capture paths are wrapped in a consent gate rather than relying on configuration discipline.
We also provide a configurable consent banner for customers who do not operate their own consent management platform. Bot traffic and visitors signalling Do Not Track or Global Privacy Control are excluded from capture.
| Area | Measure |
|---|---|
| Transport encryption | TLS for all connections — browser to API, API to datastores, and all administrative access |
| Encryption at rest | All data at rest is encrypted, covering the relational database, object storage and the analytics store |
| Tenant isolation | Every query is scoped by site, and site access is verified against the authenticated user's organisation on every request |
| Internal endpoints | Scheduled jobs and queues use a separate authenticated surface that is not reachable with customer credentials |
| Visual editor credential | The A/B test editor uses a separate scoped, expiring token rather than a customer session credential |
| Administrative access | Governed by cloud IAM with multi-factor authentication enforced. Administrative actions are recorded in an audit log including actor, action and timestamp. |
Application services run on managed cloud infrastructure with autoscaling. All processing and storage takes place in the European Union. The relational database has automated daily backups with point-in-time recovery enabled; the analytics store is protected by automated disk snapshots; session replay recordings are backed up.
Event ingestion and asynchronous work use managed queues with retry and acknowledgement semantics, so transient failures do not silently discard data.
Personal data is retained for a period determined by the customer's plan and is deleted automatically thereafter by a scheduled retention job. On termination, customer data is deleted in accordance with the Data Processing Agreement.
Spectry provides built-in functionality to service data subject requests on a customer's behalf, covering access and portability (Articles 15 and 20) and erasure (Article 17).
A request resolves a data subject through any of the identifiers available — session identifier, customer-supplied user identifier, or pseudonymous visitor identifier — and then acts across every store in which that subject's data may exist: analytics event and session tables, heatmap interaction data, session replay index records and the underlying recordings in object storage, survey and opt-in records, and the relational database.
Erasure removes stored recordings before removing the index records that reference them, so no orphaned recording can survive the deletion. Requests are tracked with a recorded status, so a customer can be given evidence that a request was completed.
We maintain a personal data breach response procedure covering containment, assessment, notification of the competent supervisory authority within 72 hours where required, and notification of affected customers without undue delay. All incidents are recorded in an internal register, including those assessed as not notifiable together with the reasoning.
Spectry engages the sub-processors listed on our sub-processors page, which forms Annex III of the Data Processing Agreement. Customers receive at least 30 days' notice of additions or replacements and may object on reasonable data-protection grounds.
These measures are reviewed at least annually and whenever a material change is made to processing. Questions can be sent to gdpr@spectry.io.