Security

Production visibility without unnecessary data capture.

HeronSignal is built to help teams debug live website experience while keeping AI and coding-agent access workspace-scoped, least-privilege, and focused on operational signals.

Privacy-conscious by design
Sensitive inputs masked before capture
Least-privilege agent access
Read-only by default; writes are explicit opt-ins
Workspace isolation
Tokens scoped to one workspace
Minimal retention
Raw traces expire per plan window
Data scope

What HeronSignal captures and what it avoids.

Designed around operational signals, not personal data collection.

What HeronSignal captures
  • Page views and navigation timing
  • Core Web Vitals (LCP, FID, CLS)
  • Session interactions and click paths
  • JavaScript errors and stack traces
  • Failed network requests and latency
  • Console logs (when opted in)
  • Custom business events
  • Health check results and alarm events
  • Browser, device type, and geography
What HeronSignal avoids
  • Password or credential field values
  • Payment card numbers or financial data
  • Form field input contents by default
  • Raw page HTML capture
  • User-identified PII without explicit opt-in
  • Sensitive URL parameters (tokens, secrets, emails)
  • Private API response bodies
  • Keystrokes or clipboard content
01 · Telemetry

Privacy-conscious telemetry

HeronSignal focuses on website experience signals: sessions, page views, performance, frontend errors, failed requests, clicks, custom business events, health checks, and alerts. It is designed to avoid form input capture and raw page HTML capture by default.

  • Sensitive inputs are masked before any data leaves the browser
  • URL parameters matching common secret patterns are stripped automatically
  • Teams can extend masking with data-heronsignal-mask or data-heronsignal-ignore attributes
  • IP addresses are hashed for analytics, raw addresses are not stored
02 · AI and agents

Least-privilege AI and coding-agent access

AI assistants, MCP, and Claude Connector integrations are read-only by default. Narrow write scopes can be enabled per token: creating funnels or metrics, updating issue triage status, and none of them touch code. The only code HeronSignal ever writes is a draft pull request from HeronAgent, which you review and merge.

  • MCP tokens are read-only by default: write scopes (funnels, metrics, issue status) are explicit per-token opt-ins
  • Agent tokens are scoped to one workspace and cannot cross workspace boundaries
  • AI analysis runs on aggregated telemetry, not raw session recordings
  • HeronAgent never commits to your codebase: it opens a draft pull request via the GitHub App you install, and you review and merge
03 · Access control

Workspace-scoped access

Monitoring data is scoped to the selected workspace. Agent tokens and dashboard access are designed around workspace boundaries so teams can share context without exposing unrelated data.

  • Each workspace is isolated, data does not bleed between workspaces
  • MCP tokens are issued per workspace and expire on rotation or revocation
  • Role-based access lets teams control who can view, query, or export data
  • Audit logs track agent calls, exports, and configuration changes
04 · Retention

Retention and minimization

Raw diagnostic traces are retained for a limited period while durable analytics and saved AI reports preserve the operational history teams need. This keeps debugging useful without turning HeronSignal into a general-purpose personal-data store.

  • Raw session traces expire per plan retention window (7 or 14 days)
  • Aggregated performance metrics and funnel summaries persist longer
  • Saved AI analysis reports are retained until explicitly deleted
  • Teams can request deletion of workspace data at any time
Masking reference

Mark sensitive areas in your HTML.

HeronSignal respects two data attributes that give teams direct control over what is excluded from capture.

data-heronsignal-mask

Replaces the element's text content with a placeholder before any data is captured.

data-heronsignal-ignore

Prevents the element and its children from being included in session interaction data.

HTML example
<!-- Mask a sensitive display value -->
<span data-heronsignal-mask>user@example.com</span>
<!-- Exclude a section entirely -->
<div data-heronsignal-ignore>
Private content…
</div>
// masking happens in-browser before any network send
Questions

Something not answered here?

Contact the HeronSignal team with specific security, data handling, or compliance questions.

security@heronsignal.io
Free scan

See how HeronSignal reads your site from the outside.

The public scan checks reachability, HTTPS, metadata, and crawler access, no account or installation required.

Run a free scan