Security

Quality sits on top of your website, so it is built to collect what your team needs to fix a bug and nothing more. This page explains what that means in practice.

Recordings leave private data behind

Session replays and screen recordings are cleaned in the browser, before anything is uploaded:

• Typed text is hidden. Every form field is recorded as ***, including fields that were already filled in. Button labels stay readable.
• Credentials are removed. Authorization, cookie and API-key headers, and fields such as password, token or secret in requests, responses, URLs and console messages are replaced with [REDACTED].
• You choose what else stays out. Add data-quality-mask to an element to hide its text, or data-quality-block to leave it out of recordings entirely. See Session playback.

Quality's servers apply the same rules again when a recording is stored and when it is played back.

Who can see what

• Workspace members see the projects they belong to. Guests see only the projects they were added to, and never the console, network or action logs behind a replay.
• Thread links. By default, anyone with a thread's link can open it. The console and network logs stay hidden unless you choose to share them. On paid plans, workspace owners can limit links to signed-in members.
• The script tag only runs, and only signs people in, on the sites you list for a project.

What Quality's team can see

• The tools Quality's team uses to run the service show accounts, plans and usage counts. They have no way to open a thread, read a comment, play a replay or see console and network logs.
• Your projects' addresses and the sites the script runs on are hidden from those tools.
• Signing in to them takes a password and an emailed code, sessions end after 12 hours, and every change made with them is recorded.
• When you send a problem report, Quality's support team sees the message and the files you attach.
• For files Quality never holds, connect your own S3-compatible bucket: uploads go from the browser straight into it and never pass through Quality's servers. Contact us to turn it on.

Signing in

• People sign in with a one-time email code or with Google. There are no Quality passwords to leak.
• Codes expire after 15 minutes, are limited per email and per network, and lock after repeated wrong guesses.
• Every session is checked on each request, so signing out or removing someone takes effect at once.

Connections and secrets

• Everything travels over HTTPS, and Quality's database only accepts encrypted connections.
• Tokens for Slack, Jira, Linear, GitHub and other connections, and keys for your own storage, are encrypted (AES-256-GCM) before they are stored.

Keeping software up to date

• The API server runs on Go 1.26.10, the latest patch of Go 1.26, and every change is checked against Go's vulnerability database before it ships.
• The dashboard, extension, script tag and websites are built on Node.js 22, and their dependencies are kept on patched versions.

Your data

• Export. Settings → Account → Your data downloads everything Quality holds about you as a file.
• Delete. The same page deletes your account. You leave every workspace and are signed out everywhere, and your comments stay with their workspaces as "Deleted user".
• Workspaces. Deleting a workspace deletes its files from Quality's storage too.

Reporting a problem

If you find a security issue, use Report a problem in the dashboard sidebar and describe what you saw. Please don't test against other people's workspaces.