Redaction and sensitive data

Bug reports are full of screens you'd never want to store: payment forms, login pages, personal profiles. Tirs redacts sensitive data before anything leaves the browser — masking is on by default in the SDK, and in the extension it's a single toggle in settings, with no changes to your code.

What's masked by default

Out of the box, Tirs masks:

• Card numbers
• Passwords and password fields
• Tokens and API keys
• Other sensitive fields on your pages

Masking covers the console and network logs attached to recordings, typed input in Rewind captures, and the logs that ride along with the recordings your customers send through customer care links. For customer care captures it is on by default; for your team's captures from the Chrome extension, turn on Redact Sensitive Data in the extension's settings.

Masking happens in the browser

This is the part that matters. Redaction runs inside the browser, before upload. A masked card number is never transmitted, never stored, and never shows up in a replay, a console log, or a network request body. There is nothing to delete later, because the sensitive value never reached Tirs in the first place.

Control what gets captured

Every product has its own sensitive fields: a national ID, a salary, a medical record number. Add your own rules from workspace settings:

1. Sign in at app.tirs.dev and open your workspace settings.
2. Go to Redaction.
3. Add a rule — for example, hide a field by its name, like national-id or salary.
4. Save. The rule applies to all future captures from everyone in the workspace.

• Rules are no-code — nothing to deploy and no changes to your site.
• Rules cover customer care recordings too, so your customers' captures follow the same policy.

Why this matters for PDPL

Saudi Arabia's Personal Data Protection Law (PDPL) expects you to collect no more personal data than you need. Because Tirs masks sensitive values before upload, a bug report never turns into an accidental store of card numbers or passwords — that data is simply never collected. Your debugging workflow stays inside your data-minimization story instead of fighting it.

Your data stays in the Kingdom

Everything Tirs stores — recordings, logs, tickets, environment details — lives inside Saudi Arabia, in the Riyadh region. Nothing leaves the Kingdom. If your organization needs even tighter control, enterprise plans can deploy Tirs on-premise.

Next steps

Redaction also protects the recordings your customers send you. Read Customer care links to see how one-time recording links work.