OpenReplay
self-hostable under agplv3 — and by default it masks emails while leaving card-shaped digit strings alone.
the best answer to data residency here and the weakest default masking of any open-source option — do not install this one and walk away.
self-hosting solves problems the saas tools can only promise around. you choose the jurisdiction, you set retention, and no session data leaves your infrastructure at all. the core is agplv3 — genuine copyleft, so network use of modified code requires releasing source — with some directories mit and the `ee/` enterprise code separately proprietary. the managed dedicated tier starts at $199 a month for a dedicated vm in its own vpc, with unlimited recordings and retention, deployable across 50 regions or bring-your-own-cloud.
the defaults are the problem, and they are worse than they look at a glance. `obscureTextEmails` and `obscureInputEmails` are both true, so emails are masked in text and in inputs. but `obscureInputDates` is false and `obscureTextNumbers` is false — meaning dates and generic digit sequences are not masked unless a developer explicitly turns those options on. `obscureTextNumbers` is the setting that would catch card-number-shaped strings. general non-email text and input content is not masked either.
the description above is ours, condensed from the ranking. pricing moves — check it on the vendor's own page before you rely on it.
- category
- session replay tools
- pricing
- free self-hosted
- website
- openreplay.com
the best answer to data residency here and the weakest default masking of any open-source option — do not install this one and walk away.
we researched this category against vendors' own pricing pages and licence files. that is where this line comes from — not from the vendor, and not from anything they paid for.