LayerT whitepaper
Recording sessions responsibly
Recording what people do at work is sensitive, and it should be. LayerT can record sessions on shared accounts, because for a finance portal or a company’s social account, “who did what” sometimes needs more than a log line. This paper is for the people who have to decide whether that’s acceptable: privacy officers, legal counsel, works councils and the employees themselves.
The principles
- Off unless you decide otherwise. No account records until your organisation has attested to a lawful basis and switched recording on for that specific account.
- Narrow. Only shared-account sessions, only on that account’s own site. Never general browsing.
- Visible. The person always knows a session is being recorded.
- Minimal. What people type is masked where they type it, in form fields and rich-text editors. Sign-in fields are left out entirely. No images, fonts, request bodies or headers. A recording still shows what the page shows back.
- Protected. Encrypted on the device before it leaves, stored as ciphertext, decrypted only for someone allowed to watch, or for the Owner’s export of the organisation.
- Accountable. Every viewing needs a reason and is logged. Recordings delete themselves on schedule.
Before anything is recorded
Recording needs two separate decisions.
The Owner’s attestation. Before any account in your organisation can record, the Owner must state in writing:
- the lawful basis for recording,
- that a data protection impact assessment has been done, and
- whether worker representatives were consulted, or aren’t required to be.
The attestation, and who made it, is written to the audit log. Withdrawing it switches recording off on every account at once.
Switching it on per account. An Owner or IT Admin then chooses which shared accounts record. Attesting on its own records nothing.
What’s recorded
LayerT uses rrweb, a widely used open-source library, to capture a replay of the page rather than a video. A replay is a record of the page’s structure and the changes to it. Played back, it looks like the page did.
| Recorded | Never recorded |
|---|---|
| The account’s own site, in the tab where it’s used | Other tabs and other sites |
| The page as displayed: its structure, text and styles, unless text masking is on. That includes what the page shows back after it was typed | What people type, where they type it: form fields (inputs, text areas and selects) and rich-text editors are always masked, whatever the account’s text-masking setting |
| Clicks, scrolling and mouse movement | Password, one-time-code and sign-in fields, and hidden form fields, which are left out completely |
| Which boxes were ticked, which radio option was chosen, and the name of a chosen file | A chosen file’s contents, and which option was picked in a drop-down list |
| The addresses of pages and network requests, with each request’s status and timing | Request and response bodies and headers |
| Images, fonts and canvas drawings | |
| LayerT’s own prompts, and anything outside the browser |
Recording also pauses while LayerT fills a sign-in form, so the fill never appears in a replay.
Telling the person
- While a session is recorded, the LayerT session chip on the page reads “recording”.
- The first recorded session shows a notice that doesn’t go away by itself. It stays until the person closes it.
- If recording can’t start, the chip says “recording off” and the person’s work carries on. LayerT doesn’t block the session because recording failed.
How recordings are protected
- BrowserSession keyA fresh AES-256 key for this recording, held in the browser’s session memory only.
- BrowserEncryptEvents are compressed and encrypted in chunks, each with its own random nonce, before upload.
- LayerT cloudWrap the keyThe key is sent once and immediately wrapped. Only the wrapped key is stored.
- StorageCiphertext onlyThe storage bucket never holds a readable recording.
Chunks that can’t be uploaded yet wait on the device, still encrypted. The key-encryption key is held in a key service, where it can be used but not extracted. The key service is built and in use in LayerT’s test environment, but no recording has been stored there: recording has been tested in development only. Production, which will use Google Cloud’s key service in the EU, is not deployed.
Who can watch
- Only your organisation’s Owner, IT Admins and Compliance Officers.
- Each viewing requires a typed reason, which is written to the audit log with the viewer’s name.
How long recordings are kept
90 days by default. The Owner can set anything from 7 to 365 days. A daily job deletes expired recordings (the stored data first, then the index) and logs each deletion.
The watermark
For accounts where screenshots are the concern, LayerT can draw a faint watermark over the vendor’s site with the person’s name, email, a session reference and the time. It doesn’t block anything, it comes back if the page removes it, and it prints. It’s deterrence and attribution, not prevention: DevTools, switching the extension off or a phone camera all defeat it, and it’s faint on dark pages.
Honest limits
- A recording is evidence, not proof. The recorder runs inside the vendor’s page, which could in principle interfere with it. Use recordings alongside the audit log.
- Some pages can’t be recorded, for example where the site’s security settings stop the recorder loading. The chip says so.
- The last moment before leaving a page can be lost.
- Typing is masked in the box, not in what the site does with it. A sent message, a search heading or a preview is page text, and text masking is what hides it. Addresses are recorded as they are, whatever the setting.
- Terminals aren’t recognised as editors. Commands typed into a web terminal are recorded as page text unless text masking is on. The same goes for a region made editable by styling alone.
- The recording notice describes the default 90-day retention. If you change retention, tell your people.
- Rights requests. There’s no self-service tool for people to request their recordings yet. Your Owner can export the organisation’s recordings, decrypted, and handle requests from that export. Keep in mind that the export holds everyone’s recordings, so store it with the same care.
Questions for your impact assessment
- Which accounts need recording, and why is the audit log alone not enough?
- Does the vendor’s site show personal data about customers or colleagues, or show back what people write there (a message thread, a search heading, a web terminal)? If so, switch on text masking.
- Do the vendor’s terms allow recording their interface?
- What retention period is justified? Shorter is better.
- Who should be able to watch, and should that include IT?
- How will you tell employees and, where needed, consult their representatives?
If your privacy team would like to see recording and its controls in action, ask for it in a demo.