---
title: "Privacy and redaction"
description: "What Faylee hides from a capture before it leaves the browser, and how you and your workspace keep fields, headers and whole sites out of recordings."
canonical: https://faylee.app/docs/workspace/privacy
---
# Privacy and redaction
Faylee captures a lot about a page so a developer can fix the bug: requests with their headers and bodies, console output, and every click and keystroke. Some of that is private. Faylee hides secrets in the browser, before anything is uploaded, so they never reach Faylee's servers, your bucket or the assistant.
There are three layers:
- **Redaction** replaces secret values in the captured data with `[redacted]`.
- **Masking** blurs or hides parts of the page itself, in videos, screenshots and the page replay.
- **Blocking** keeps whole sites out of captures.
## What is hidden automatically
These rules always apply. Nobody can turn them off.
### Headers
The values of these request and response headers are hidden:
- `authorization` and `proxy-authorization`
- `cookie` and `set-cookie`
- `x-api-key`, `x-auth-token`, `x-csrf-token`, `x-xsrf-token` and `x-amz-security-token`
### Fields and keys
Faylee hides the value of any key in JSON bodies, form bodies, query parameters, console objects and app metadata when its name looks sensitive. A name is compared in lowercase with everything but letters and digits removed. It is hidden when it:
- is `auth`, `pin`, `session` or `sid`,
- contains `password`, `passwd`, `secret`, `apikey`, `privatekey`, `cardnumber`, `ccnumber`, `cvv`, `cvc` or `ssn`, or
- ends with `token`, `cookie`, `sessionid`, `otp`, `iban` or `authorization`.
So `access_token`, `X-Session-Id` and `cardNumber` are all hidden.
### Values that look like credentials
Wherever they appear in addresses, header values, bodies, console messages, error messages and socket messages, Faylee also hides:
- JSON Web Tokens.
- `Bearer`, `Basic` and `Token` credentials.
- A user name and password inside an address, as in `https://user:password@example.com`.
### What redaction leaves alone
Redaction does not change the device details, Web Vitals, page titles, or console and error stack traces. The page's DOM is protected by masking instead, described below.
## Masking parts of your page
Masking hides what is on the page itself. A masked element is blurred on screen while Faylee records a video or takes a screenshot, so it is blurred in the image. Its text is masked in the page replay, and anything typed into it is recorded as a hidden value in the steps.
These are always masked:
- Password fields.
- Fields whose `autocomplete` is a credit card value (`cc-number`, `cc-csc` and the other `cc-` values), `one-time-code`, `new-password` or `current-password`.
To mask anything else on your site, add the `data-faylee-mask` attribute or the `faylee-mask` class. It masks the element and everything inside it.
```html
Balance: $12,480.00
IBAN: DE89 3704 0044 0532 0130 00
jane.doe@example.com
```
This works for the extension and the [site widget](https://faylee.app/docs/support/widget.md). People recording can also blur parts of the page by hand while they record, and pixelate parts of a screenshot before they share it. See [Recording tools](https://faylee.app/docs/capture/recording-tools.md).
## Your own rules in the extension
Each person can add to the built-in rules in the extension's settings, under **Privacy**:
- **Never capture these sites**: one host per line, such as `bank.example.com`. Subdomains are included.
- **Also hide these headers**: one header name per line.
- **Also hide these fields**: JSON keys, form fields and query parameters, one per line.
The same page lists what your workspace adds, under **Your workspace also blocks** and **Your workspace also hides**.
Before sharing a capture, you can also leave out its console, network or steps entirely, or remove single failed requests. See [Review and share](https://faylee.app/docs/capture/review-and-share.md).
## Workspace privacy rules
Workspace admins set rules that every member's extension applies, under **Settings**, **Privacy**, **Privacy rules**:
| Rule | What it does |
|---|---|
| **Never capture these sites** | Hosts that are never captured, one per line. Subdomains are included. |
| **Always hide these headers** | Header names hidden in every capture, one per line. |
| **Always hide these fields** | JSON keys, form fields and query parameters hidden in every capture, one per line. |
| **Allow instant replay** | When off, no member's extension keeps a rolling replay of pages. Recordings and screenshots still work. |
Press **Save rules** to apply them. Changes are recorded in the [audit log](https://faylee.app/docs/workspace/security#audit-log).
Members can add to the workspace's rules in their own extension, but they can't remove them. Each extension fetches the rules when it starts, when it connects to your workspace, and every hour after that.
The site widget applies the workspace's header and field rules to every report too.
## Sites Faylee never captures
On a site in **Never capture these sites**, the extension captures nothing at all: no console, no network, no steps, no replay. Opening the popup there says that Faylee is off on this site, and whether you or your workspace's policy blocked it.
The extension also never captures browser pages, such as settings and the new tab page, or the Chrome Web Store.
## Incognito windows
The extension never keeps an instant replay in an incognito window, even when instant replay is on. Whether Faylee runs in incognito at all is up to you: Chrome runs an extension there only when you allow it in the extension's details.
## Retention
Admins can also have old recordings deleted automatically. See [Storage and retention](https://faylee.app/docs/workspace/storage#retention).
## Related
- [Security and SSO](https://faylee.app/docs/workspace/security.md)
- [Recording tools](https://faylee.app/docs/capture/recording-tools.md)
- [Review and share](https://faylee.app/docs/capture/review-and-share.md)
- [The assistant](https://faylee.app/docs/viewer/assistant.md)