Capture everything a dev needs. Nothing a lawyer fears.

Session replay ships with every input and every text node masked by default. You explicitly unmask elements you own — never the other way around. A PII regex pass runs on top, and the reporter can crop the screenshot before sending.

The replay buffer (last 60 seconds, configurable 30s–3min) only leaves the browser when the reporter presses Send. Otherwise it is discarded on the spot.

Cookies, localStorage, and app state are captured onlyif the key is on your site's allowlist — which starts empty. Values are redacted by default and are never visible to the reporter.

The network log records method, URL, status, timing, and size. Authorization and Cookie headers are never captured — stripped in the SDK and re-checked at ingest. Request/response bodies are captured only for allowlisted endpoints.

All SDK code runs error-isolated inside try/catch boundaries with its own Shadow DOM; its failures never bubble into your page. Under 40KB gzipped, loaded async, zero impact on your Lighthouse score, no third-party calls from your page except to our API.

Per-site widget keys are ingest-only and origin-checked — a leaked key cannot read data. API keys are workspace-scoped (read/write/admin) and shown once. Reporter status links are signed, expiring magic tokens limited to that reporter's own request. Attachments are served via signed, expiring URLs. Everything is encrypted in transit and at rest.

Autofix can turn an approved request into a real change — but only inside fences you set, and only after a human says yes. It never merges anything on its own and never invents content: the only text it writes is the reporter's captured edit or your developer's.

• Text only, one exact match. It changes plain text, never markup or layout, and only when the original appears on the page exactly once — otherwise it refuses and files a normal ticket.
• You approve every change. Nothing ships without a developer approving the diff; on GitHub it opens a pull request that your own review and CI still gate.
• Reversible by design. A staged preview link before publish, one-click rollback after, and an automatic post-publish health check that reverts the change if the page regresses.
• Admin fences. Editable-path allow/deny lists, protected pages Autofix can never touch, and a per-site daily AI-spend cap.
• Least privilege on WordPress. The apply endpoint is disabled until you set a shared secret, which is stored encrypted, sent only from our servers, and compared in constant time.

GDPR from day one: a DPA available at signup, data deletion on request (including reporter data), export on request, and masked-by-default capture as the technical measure. A SOC 2 Type II program starts within our first six months; an EU data region ships for Enterprise by month nine.

Subprocessor list — published here before beta opens: cloud hosting, object storage, email delivery, and AI inference providers, each with region and purpose. Placeholder until the list is final; it will be versioned and change-notified.

SiteUpdate targets WCAG 2.2 AA across the widget, dashboard, and reporter pages. The widget is fully keyboard-operable — including pointing at an element (Tab cycles candidates, Enter selects) — with focus-trapped dialogs, screen-reader announcements, targets of at least 24×24px, and a non-visual fallback flow (describe it in words; capture still happens automatically).

Found a barrier? Email accessibility@siteupdate.io and we'll fix it on a priority track.