Security

Human Behavior is built for product teams that need session replay, analytics, and AI agents without handing their customer data to a black box. The controls below are what we run today — not a roadmap slide.

• Field-level masking. Autocapture respects mask selectors and PII rules before events leave the browser.
• Redaction pipeline. Sensitive payloads are stripped at ingestion — not bolted on in the UI later.
• Row-level security. Every query is scoped to a single project; agents use read-only roles by default.
• Encryption. TLS 1.2+ in transit and AES-256-GCM at rest. Integration tokens, OAuth credentials, and agent DB passwords are sealed before they touch disk.
• SOC 2 Type II in progress. Controls monitored continuously in Vanta. Report available once our audit completes.
• Never train on your data. Your sessions stay yours — not pooled into foundation model training.

Every provider that processes personal data on our behalf is listed on our Subprocessors page, with what it is used for and what data it handles. See also our Privacy Policy and Terms of Service.

For a DPA, security questionnaire, or procurement review, email security@humanbehavior.co or founders@humanbehavior.co.