Session Replay for Fintech Compliance

A fintech team wants to watch users struggle with a KYC form. The compliance officer wants to know what happens to the account number the user typed into it. Session replay for fintech compliance has to satisfy both, and the second question comes first: a recording that captured a card number once is a breach, whatever else it shows.

This page lists the controls AnyReplay provides and is explicit about what it does not. AnyReplay does not hold certifications on your behalf and does not make your product compliant. It gives you controls; compliance with the regimes that apply to you remains your responsibility.

The problem: replay records what users type

A session recorder sees everything the user sees, and by default that is the problem. Account numbers, card numbers, national IDs, balances and transaction descriptions all appear on screen. A tool that records first and masks later has already moved PII off the user's device and onto a server, where it is subject to retention, breach and access questions.

The second problem is proof. Regulated teams need to show who could view a recording, who changed that, and when a recording was deleted. A tool without an audit trail leaves those questions to be answered from memory.

How replay fits a compliance-reviewed workflow

Replay is adopted in regulated environments by deciding the masking before the first recording, not after the first incident, and by writing down every access change. With the default field masking, the engineering team gets recordings of the KYC form with every field replaced by asterisks, which is enough to see that step three loses users. The compliance team gets a short list of settings to review and an audit log to hand to an auditor.

The post on session replay, privacy and GDPR covers the legal framing. The rest of this page is the mechanics.

What AnyReplay does for fintech and compliance teams

Masking at the source

For a fintech app, leave maskAllInputs at its default of true: every form field's value is masked before an event leaves the page and replays as asterisks. Setting it to false would record what the visitor typed. Below that switch is a floor no configuration reaches: passwords, one-time codes, card and CVV fields, IBANs, routing numbers and sort codes are never recorded. For text outside inputs, ar-mask masks the text and ar-block drops the element entirely, so a balance widget or a transaction table need never be recorded.

React Native works the same way: every TextInput is masked by default, and anything with secureTextEntry or an ar-mask testID is masked on the device whatever you configure. The input masking entry and the guide to masking sensitive data cover the details; the privacy page has the full model.

Consent gating

Set requireConsent: true and the SDK records nothing until your page calls anyreplay('consent', true). Nothing is buffered and nothing is uploaded before that call, so a user who declines is never recorded rather than recorded and discarded. See consent.

Retention you set, enforced by the server

Retention defaults to 14 days per organisation and is configurable. The API enforces it on an interval, and deleting a session deletes the recording. Backups keep their own window, BACKUP_KEEP_DAYS, default 30. See data retention.

Append-only audit trail

Permission changes, deletions and project key rotation are written to an append-only audit trail. Entries are not edited or removed, which is what an auditor asking who had access in March needs.

Roles with no privilege escalation

Organisations have five roles: owner, admin, moderator, member and viewer, backed by a tested permission matrix. No role can grant a role at or above its own rank, so an admin cannot create another owner and a moderator cannot make an admin.

Tenant isolation without an existence oracle

Every organisation-scoped route is tested from a foreign tenant. A resource belonging to another organisation answers 404, never 403, so the API does not confirm that a session exists to someone who is not allowed to see it.

Self-hosting, so recordings never leave your infrastructure

AnyReplay documents a single-host deployment on Ubuntu 24.04: PostgreSQL, the API, the ingest service and the dashboard as systemd services behind nginx, with recordings stored on disk under /var/lib/anyreplay/storage. Nothing is sent to AnyReplay. The self-hosted session replay post walks through it.

Encrypted, verified backups

deploy/backup.sh dumps the database and the chunk store, encrypts them with gpg on the host before upload, and ships them to a bucket with rclone on a daily timer. A weekly timer restores the newest backup into a throwaway database and counts rows, so a backup that cannot be restored is noticed before it is needed.

Sandboxed playback

The replay iframe runs without allow-scripts, script bodies are stripped at record time, and a test fails the build if the sandbox is weakened. A recorded page cannot execute code in a reviewer's browser. See sandbox iframe. The same defaults apply to mobile sessions recorded with the React Native SDK.

Getting started

1. Create a project, or deploy AnyReplay on your own host first if recordings must not leave your infrastructure. See pricing for the plans.
2. Install the SDK snippet, or run npm install @anyreplay/react-native. Keep the default field masking and add ar-block to any element that displays balances or identifiers.
3. Set requireConsent: true if your consent flow requires it, and wire anyreplay('consent', true) to your existing banner.
4. Set the retention window to match your policy and give viewer roles to the people who need to watch.
5. Ship, then review the audit trail after the first week to confirm access looks the way you expect.

Frequently asked questions