Know exactly what happened.
Reconstruct production incidents from user sessions, logs, metrics and traces — with evidence your team can trust.
Stop investigating incidents across five different tools.
PII is redacted before it leaves the browser, every access is written to an immutable, hash-chained audit trail, and the model can be your own — so six months later you can still prove what happened, and to whom the data was shown.
Checkout button unresponsive after promo code applied
- 1.Open /checkout
- 2.Apply promo code LAUNCH20
- 3.Click 'Complete purchase'
- 4.Button unresponsive, 422 in console
Promo validation diverges between client cache and the charges API (POST /v1/charges → 422).
✕ api.ts:88 POST /v1/charges → 422 ✕ checkout.tsx:208 ValidationError
Two problems, stacked on top of each other.
QA writes a ticket. Engineering writes back. Three days pass.
Most bug reports are vibes — a vague title, a screenshot, no reproduction steps, no environment, no console output. Engineers spend half their week reverse-engineering what the tester saw.
* Illustrative figures
Regulated teams can't centralize context that's full of PII.
Session replays and logs carry PII/PHI. Shipping them to a vendor cloud — or storing a log an auditor can't trust — is an instant security-review failure. So teams fly blind, or build the compliance scaffolding themselves. Both are expensive.
Ten questions per incident. Today they are answered by ten tools, a Slack thread and someone's memory.
Dashboards answer is it broken and where. These are the questions that start after — and the last one decides whether any of the others can be trusted six months later.
AI triage over the session, the console and the server's own log lines for the same trace
Dedupe counts every sighting of one failure — ×N and last-seen on the bug
Replay with steps, console and network on one timeline
One click from the failing request to /app/logs?trace_id=…
Build and feature flags captured with the session
W3C traceparent attached at capture, echoed back on the request
Every row scoped per tenant, enforced by PostgreSQL row-level security
Class, surface, source and field — counted, never stored
Two-way sync to 7 trackers; raw capture gated by its own permission
Hash-chained audit log, anchored off-database
Capture & ingest → contextualize → govern → deliver.
Sessions via one embeddable script tag (steps, console + network timeline, environment — input values never read) and application logs — OTLP, JSON/NDJSON, syslog, CEF, LEEF, GELF — normalized to one canonical OpenTelemetry model, correlated by trace_id.
Your LLM or ours (OpenAI/Anthropic-compatible, incl. Ollama/vLLM in your VPC): TL;DR, likely cause, suggested fix, affected files. Documented no-train policy.
PII redacted server-side before storage; immutable hash-chained audit on every access; data pinned to a region; RBAC gates sensitive captures; retention + right-to-erasure enforced.
Fix-ready report to Jira/Linear/GitHub with two-way status over HMAC-signed webhooks; triage it from the Slack thread; nothing leaks that shouldn't.
Three ways in. One chain of evidence.
A bug nobody can reproduce, an incident in the log stream, and an auditor asking who saw what are the same problem arriving through different doors. None of them can be answered by one signal alone — which is why this is one pipeline and not three tools.
A bug report nobody can reproduce
An incident the model found in your log stream
Who saw the sensitive data, and can you prove the record is intact
- SessionLogsMetricsTraces01 Capture
Sessions, logs, metrics and traces arrive from the browser agent, your SDKs and your OpenTelemetry collector.
- 02 Correlate
Joined by trace id where one exists, by time window where it does not — before anyone asks.
- 03 Analyse
Your model, not ours, reads the correlated window and names the likely cause.
- 04 Reconstruct
One timeline across every signal, with the cause, the evidence and the affected service.
- JiraSlackGitHub05 Deliver
To the tracker as a ticket with the evidence attached, and to Slack where it can be triaged.
- 06 Prove
Every access and every change on a hash-chained audit trail, anchored off-database.
The join is the part that has no shortcut: the browser agent attaches a W3C traceparent to the request it captures, your services already propagate it, and the log line and the span carry the same id. That is what makes the reconstruction possible before anyone goes looking.
Everything an engineer asks for — governed before it's stored.
One script tag captures console, network timing, and user steps — input values never read. Report from a button or auto on uncaught errors. React and Vue adapters catch what error boundaries would otherwise swallow.
Go, TypeScript, Python, Ruby, PHP, Java, C#, Elixir. Batched log shipping that never blocks your request path, plus errors reported with the stack and the log trail that led to them. No third-party dependencies in any of them — and all open source under MIT at github.com/InsightRecorder, so you can read what runs inside your application before installing it.
Every log and request on one timeline — method, URL, status and timing, never bodies or headers — replayed frame by frame in-app.
TL;DR, likely cause, suggested fix, affected files — from your model (OpenAI/Anthropic-compat, incl. Ollama) in your VPC.
The model scans the ingested log stream and flags the real incident — DDoS, DB pool exhaustion, auth abuse, error spikes — with severity, evidence, and a Slack message you can resolve from the thread.
Query by field and full text — service:payments level:error http.status_code:>=500 "connection refused" — over an index, not a scan. Histogram of the matches, a field sidebar built from your own attributes, term highlighting, and the lines that surrounded any record.
The agent masks before it transmits — the raw value never reaches us. The server masks again before storage. Email, card (Luhn), CPF/CNPJ, SSN, IBAN + custom regex, versioned per-tenant policy, fail-closed at every step.
Append-only, SHA-256 hash-chained, externally anchored. Tamper-evident on every access — even against a DBA.
Pin a tenant's data to us / eu / ap. Out-of-region writes are blocked at the boundary.
OTLP (HTTP + gRPC), JSON/NDJSON, syslog, CEF, LEEF, GELF → one canonical model, correlated by trace_id.
OTLP spans over HTTP and gRPC, stored the way metrics are — partitioned by day, retention by dropping partitions. The waterfall shows where the request went and where it stopped, with self time per span, and a partial trace still renders because a missing exporter is normal while something is on fire.
One incident, one timeline: the session that captured it, the server's own log lines, the failing traces — correlated by trace id and time before anyone goes looking. With the likely cause, the affected service, and a button that turns it into a ticket carrying the evidence.
One window for the workspace, capped by plan, applied to captures and to the log stream alike — including the raw input that failed to parse and never became a record. Metrics and traces drop whole day partitions, which is the only way retention keeps up with ingest.
OTLP metrics over HTTP and gRPC — containers, PostgreSQL, MySQL — into day partitions with five-minute rollups. Retention drops whole partitions instead of deleting rows, and a query tells you which resolution answered it, so a chart never passes bucket averages off as measurements.
A distinct permission gates sensitive captures and logs; the API redacts when it's missing. Every view audited.
Jira, Linear, GitHub, Notion, Asana, ClickUp, Trello over signed webhooks; status flows both ways. Each tenant's own encrypted credentials, never in env. Triage from the Slack message itself.
Rolling in-memory buffer of the last few minutes (configurable), flushed only on a real bug — no always-on recording, and older context is dropped before any trigger.
A production error hitting a thousand sessions files one ticket, not a thousand. Repeat captures fold into the open bug — severity escalates, never de-escalates — and cost no alert and no quota. A fixed bug that recurs opens a new one, because a regression is news.
Draw, redact and highlight on the captured screenshot before it is attached.
Enterprise identity with auto-provisioning and domain-locked workspaces.
Every signal you have, normalized to one model.
correlated by trace_id · dead-letter on invalid input
One capture pipeline, five teams.
- → Catch bugs in staging with a single capture
- → Auto-generated reproduction steps
- → Mark severity, assign, ship — from one place
- → Console + network captured even on production
- → PII masked before anything is stored
- → No more 'what browser version?'
- → Replay every issue in the real user environment
- → AI detects DDoS, pool exhaustion & auth abuse in the logs
- → Correlate captures to server logs by trace_id
- → Source-mapped traces with full code context
- → Click a log line, jump to that frame in the replay
- → BYO-LLM triage that runs in your own VPC
- → Immutable, exportable audit trail on every access
- → Pin data to a region; redact PII before storage
- → Your model in your VPC; documented no-train policy
The compliance layer nobody built for this workflow.
Most tools bolt on an "export logs" button and call it compliance. InsightRecorder enforces governance at the write path — before storage, on every access.
Append-only, SHA-256 hash-chain with external anchoring. Tamper-evident even against a DBA.
Per-tenant pin to us / eu / ap. Out-of-region writes are blocked.
Separate permission for sensitive captures & logs. API redacts on missing scope.
Postgres row-level security under every query, not just careful code. A query that forgets its tenant filter returns nothing — and we test that with a SELECT that has no WHERE clause at all.
Masked in the browser before transmission, and again before storage. Default-deny, versioned per-tenant policy.
Auto-purge 1–365 days + audited hard-delete. Right-to-erasure enforced.
Your data is never used to train. Documented, per-tenant.
Full disclosure for your DPA / LGPD paperwork.
We mask CPF, CNPJ, cards and e-mail before storing them — then tell you which of your services emitted them, and into which field, so you can fix the source. The value itself is never stored, not even a fragment.
Single self-hostable binary (distroless). Your model, your boundary.
Every tenant's tracker, Slack and LLM credentials are AES-256-GCM encrypted at rest — never in env. The server refuses to boot without the key rather than store them in the clear.
Access review and audit-chain integrity, as a console and a machine-readable endpoint your GRC tool can poll. The evidence pipeline is built; our own certification is not — that one is marked on the roadmap.
Built for engineers. Deploy anywhere.
One self-contained binary and one PostgreSQL. No object store, no queue, no vendor-hosted index — which is why running it in your own account is a deploy flag here instead of a six-month enterprise project.
Region-pinned us / eu / ap
On-premises works too
Capture → redact → triage with your model → send to your tracker
Your data never leaves your environment
- No third-party byte on the page
The capture agent and its redaction engine are served from your own origin, fonts included. The strict CSP allows no external script, style or font host.
- PII masked before it is transmitted
The browser agent redacts CPF, CNPJ, cards, e-mail, phone and IBAN before the request leaves the page, and the server redacts again on ingest — the second pass is the enforced one, because the first runs on a page you control.
- Your model, your network
Point the AI at Ollama, vLLM or any OpenAI-compatible endpoint on the same VPC. Prompts carry capture and log content, so where inference runs is where that content goes.
- Egress you can lock down
One flag rejects any tenant-configured URL pointing at private or metadata address space, and the deployment's outbound surface is the trackers and Slack you configure — nothing else.
Self-host is the Compliance tier — a flat annual licence rather than per seat, because the storage and the inference are your cost, not ours.
Push reports where engineering already works.
Send a fix-ready report into Jira, Linear, or GitHub with a single POST — status flows both ways over HMAC-signed webhooks. In Slack the report is not an alert you read, it is a message you act on. Ingest the rest the same way: logs over OTLP, syslog, CEF, LEEF and GELF; metrics and traces over OTLP.
Incidents and alerts deliver natively to PagerDuty, Opsgenie and Microsoft Teams — the incident fingerprint is the dedup key, so one incident is one page, and closing the Opsgenie alert resolves it back. Anything else that speaks webhook is one signed POST away, and an opt-in push to your public status page (Statuspage, Instatus) is there when you want it.
curl https://api.insightrecorder.example.com/api/bugs/$ID/send \
-H "Authorization: Bearer $TOKEN" \
-H "Content-Type: application/json" \
-d '{"dest":"github"}'Slack is a surface, not a firehose
An alert you can only read makes the channel noise. Every incident and bug arrives with the actions that close it, and the reply lands in the same thread that opened it — so the channel holds the whole story instead of a stream of notifications nobody acts on.
Team and above · the free plan ships without Slack delivery
Metered on bugs, not on traffic.
Always-on replay charges you for every visitor. We capture only when someone reports a bug, so the meter tracks your ticket volume — roughly a thousand a month, not a hundred thousand visits. That is why the numbers below work.
Plans differ by volume, retention and deployment — plus the workflow reach of the paid tiers. What they never differ by is governance: PII redaction, immutable audit, residency, RBAC and your own LLM are on every plan, including Free. Self-host is a flat licence because the storage bill is yours, not ours.
Full product, free for 90 days — then choose a plan.
- → Up to 3 developers
- → 500 bug sessions / month
- → 7 days retention
- → 1M log records / day
- → 10M metric points / day
- → 1M trace spans / day
- → 1 issue tracker, no Slack
Cloud, for teams shipping every day.
- → Unlimited developers
- → 5,000 bug sessions / month
- → 30 days retention
- → 10M log records / day
- → 100M metric points / day
- → 10M trace spans / day
- → All 7 trackers + Slack triage
Annual contract for a whole engineering org.
- → Unlimited developers
- → 50,000 bug sessions / month
- → 180 days retention
- → Unlimited log records / day
- → Unlimited metric points / day
- → Unlimited trace spans / day
- → All 7 trackers + Slack triage
Regulated orgs running it in their own VPC.
- → Unlimited developers
- → Unlimited bug sessions / month
- → Unlimited retention
- → Unlimited log records / day
- → Unlimited metric points / day
- → Unlimited trace spans / day
- → All 7 trackers + Slack triage
- → Your VPC, your Postgres, your storage cost
- → Flat platform licence, not per seat
- → BAA* · SSO/SAML* · SOC 2 Type II*
- ✓ PII redaction — in the browser and again on ingest
- ✓ Immutable audit log, hash-chained and externally anchored
- ✓ Data residency: us / eu / ap
- ✓ Granular RBAC over raw session capture
- ✓ Bring your own LLM, no-train by default
- ✓ SOC 2 evidence export
Compliance is where this product competes, so it is not a tier. Charging for the audit trail would mean selling the reason to choose us.
* BAA, SSO/SAML and SOC 2 Type II are on the roadmap — not yet available. Everything unmarked ships today.
Common questions.
01 Do you have an SDK for my stack? + −
Eight server SDKs — Go, TypeScript/Node, Python, Ruby/Rails, PHP (Laravel, Symfony), Java, C#/.NET, Elixir/Phoenix — plus the browser agent with React and Vue adapters. Each ships a copy-ready brief you can hand to a coding agent to install and wire it in your own repo, and every one is open source under MIT at github.com/InsightRecorder. Already on OpenTelemetry? Skip the SDK and point an OTLP exporter at /api/logs/otlp.
02 How does pricing avoid the session-replay trap? + −
By metering the thing you actually have, not the thing you fear. Always-on replay tools charge against traffic, so the bill scales with visitors and the margin collapses. InsightRecorder captures only when a bug is reported, so the meter tracks ticket volume — and on self-host the storage is your own Postgres, which is why that tier is a flat licence rather than per seat.
03 Is this a Sentry replacement? + −
No — they complement each other. Sentry monitors production errors for engineers. InsightRecorder captures sessions and logs across staging, dev, and customer environments, then governs and delivers them as fix-ready, audit-proof reports.
04 Can I run my own LLM? + −
Yes, today. Triage — and AI incident detection over your logs — run against any OpenAI-compatible endpoint (OpenAI, Ollama, vLLM, Groq…) or Anthropic, including local models inside your own VPC, with a documented no-train policy.
05 Can the AI detect incidents in my logs? + −
Yes. On demand or on a schedule, the model scans a window of your ingested logs and flags the single most significant incident — DDoS, database connection-pool exhaustion, auth abuse, error spikes — with severity, confidence, evidence, and a recommended action. Findings are persisted, deduplicated, shown on the dashboard, and posted to Slack with a Resolve button — all running your own model.
06 Where is the data stored? + −
Wherever you pin it. Per-tenant data residency (us/eu/ap) is enforced at the write path today, and InsightRecorder ships as a single self-hostable binary so storage and inference can stay inside your boundary.
07 What about PII and sensitive data? + −
Masked twice, default-deny. The capture agent redacts in the browser before anything is transmitted, so the raw value never reaches us; the server redacts again before storage, because an agent runs on a page we do not control. Email, cards (Luhn), CPF/CNPJ, SSN, IBAN, and your own regex, via a versioned per-tenant policy. Both passes share one test fixture, so they cannot drift apart.
08 Can I prove the audit log wasn't tampered with? + −
Yes. The audit trail is append-only and SHA-256 hash-chained with an external anchor, so any altered or removed row is detectable — even by a privileged database actor. Export to CSV/JSON is built in.
09 Which log formats can I ingest? + −
OTLP (HTTP in JSON and Protobuf, plus native OTLP/gRPC), JSON/NDJSON, syslog (RFC 5424/3164), CEF, LEEF, and GELF — all normalized to the OpenTelemetry Logs model and correlated by trace_id. A turnkey OpenTelemetry Collector ships Docker container logs and metrics with two env vars; Kubernetes and database sources are one receiver away, with ready recipes in the docs.
10 How does it work with our auth & compliance? + −
JWT + per-endpoint permissions, Argon2id, CSRF, and rate-limiting ship today. SSO/SAML + SCIM and SOC 2 Type II are on the roadmap.
Your data never leaves your VPC.
Every access is provably logged.
Capture the session, the logs and the metrics, correlate them, run your own model, and hand your auditors a hash-chained trail. Start with QA — expand to engineering, platform and security.