LayerT whitepaper
Recording sessions responsibly
Recording what people do at work is sensitive, and it should be. LayerT can record sessions on shared accounts, because for a finance portal or a company’s social account, “who did what” sometimes needs more than a log line. This paper is for the people who have to decide whether that’s acceptable: privacy officers, legal counsel, works councils and the employees themselves.
The principles
- Off unless you decide otherwise. No account records until your organisation has attested to a lawful basis and switched recording on for that specific account.
- Narrow. Only shared-account sessions, only on that account’s own site. Never general browsing.
- Visible. The person always knows a session is being recorded.
- Minimal. What people type is masked. Sign-in fields are left out entirely. No images, fonts, request bodies or headers.
- Protected. Encrypted on the device before it leaves, stored as ciphertext, decrypted only for someone allowed to watch.
- Accountable. Every viewing needs a reason and is logged. Recordings delete themselves on schedule.
Before anything is recorded
Recording needs two separate decisions.
The Owner’s attestation. Before any account in your organisation can record, the Owner must state in writing:
- the lawful basis for recording,
- that a data protection impact assessment has been done, and
- whether worker representatives were consulted, or aren’t required to be.
The attestation, and who made it, is written to the audit log. Withdrawing it switches recording off on every account at once.
Switching it on per account. An Owner or IT Admin then chooses which shared accounts record. Attesting on its own records nothing.
What’s recorded
LayerT uses rrweb, a widely used open-source library, to capture a replay of the page rather than a video. A replay is a record of the page’s structure and the changes to it. Played back, it looks like the page did.
| Recorded | Never recorded |
|---|---|
| The account’s own site, in the tab where it’s used | Other tabs and other sites |
| Page structure, text and styles | Anything typed: every input field is masked |
| Clicks, scrolling and mouse movement | Password, one-time-code and sign-in fields, which are left out completely |
| Which network requests were made, their status and timing | Request and response bodies and headers |
| Images, fonts and canvas drawings | |
| LayerT’s own prompts, and anything outside the browser |
Recording also pauses while LayerT fills a sign-in form, so the fill never appears in a replay.
Telling the person
- While a session is recorded, the LayerT session chip on the page reads “recording”.
- The first recorded session shows a notice that doesn’t go away by itself. It stays until the person closes it.
- If recording can’t start, the chip says “recording off” and the person’s work carries on. LayerT doesn’t block the session because recording failed.
How recordings are protected
- BrowserSession keyA fresh AES-256 key for this recording, held in the browser’s session memory only.
- BrowserEncryptEvents are compressed and encrypted in chunks, each with its own random nonce, before upload.
- LayerT cloudWrap the keyThe key is sent once and immediately wrapped. Only the wrapped key is stored.
- StorageCiphertext onlyThe storage bucket never holds a readable recording.
Chunks that can’t be uploaded yet wait on the device, still encrypted. The key-encryption key is held on LayerT’s servers today, and is moving into a managed cloud key service Coming soon.
Who can watch
- Only your organisation’s Owner, IT Admins and Compliance Officers.
- Each viewing requires a typed reason, which is written to the audit log with the viewer’s name.
How long recordings are kept
90 days by default. The Owner can set anything from 7 to 365 days. A daily job deletes expired recordings (the stored data first, then the index) and logs each deletion.
The watermark
For accounts where screenshots are the concern, LayerT can draw a faint watermark over the vendor’s site with the person’s name, email, a session reference and the time. It doesn’t block anything, it comes back if the page removes it, and it prints. It’s deterrence and attribution, not prevention: DevTools, switching the extension off or a phone camera all defeat it, and it’s faint on dark pages.
Honest limits
- A recording is evidence, not proof. The recorder runs inside the vendor’s page, which could in principle interfere with it. Use recordings alongside the audit log.
- Some pages can’t be recorded, for example where the site’s security settings stop the recorder loading. The chip says so.
- The last moment before leaving a page can be lost.
- The recording notice describes the default 90-day retention. If you change retention, tell your people.
- Rights requests. There’s no self-service tool for people to request their recordings yet. Your Owner can handle requests with LayerT’s help.
Questions for your impact assessment
- Which accounts need recording, and why is the audit log alone not enough?
- Does the vendor’s site show personal data about customers or colleagues? If so, switch on text masking.
- Do the vendor’s terms allow recording their interface?
- What retention period is justified? Shorter is better.
- Who should be able to watch, and should that include IT?
- How will you tell employees and, where needed, consult their representatives?
If your privacy team would like to see recording and its controls in action, ask for it in a demo.