> ## Documentation Index
> Fetch the complete documentation index at: https://docs.germainux.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Security

> GermainUX provides context-aware access controls that decide which users and teams can view collected data points, called facts, and Session Replay.

Service
`Management`

Availability
2021.2 or later

> [card] [Session Replay Security](#session-replay-security)
>
> Restrict replay by context

> [card] [Fact-Level Security](#fact-level-security)
>
> Rules per data point

> [card] [Example: Financial Organization](#example-financial-organization)
>
> Separate access by product

> [card] [Implementation Summary](#implementation-summary)
>
> Test before production deploy

GermainUX provides dynamic, context-aware access controls that determine which users and teams can view specific collected data points—called **facts**—and Session Replay recordings.

Unlike Data Privacy controls, which determine whether sensitive information is collected, masked, or anonymized, Data Security controls **who can access the data after it is collected**.

This enables organizations to restrict visibility according to application context, transaction type, user role, team membership, or other business-specific criteria.

### Key Capabilities

| Capability | Description |
| - | - |
| **Fact-level control** | Visibility can be assigned to individual data points. |
| **Session Replay control** | Access to recorded sessions can be restricted according to the activity captured in each session. |
| **Team-based access** | Data can be made visible only to designated GermainUX teams. |
| **Context-aware rules** | Access can depend on application, transaction, user role, business area, or other collected context. |
| **Custom security logic** | Organizations can implement custom scripts that define visibility according to their own requirements. |
| **Dynamic assignment** | Access metadata is assigned as data is collected and used to enforce visibility in GermainUX. |

## Session Replay Security

Session Replay access can be restricted according to the context of the recorded activity.

For example, a financial organization may permit different teams to view sessions involving different financial products or transactions.

Custom access logic can be added through the RUM JS initialization script.

Use:

```text theme={null}
settings.application.metadataProviders['access']
```

The metadata provider assigns the appropriate access information to the recorded session. GermainUX then uses that information to determine which authorized teams can view the replay.

## Fact-Level Security

Fact-level security applies visibility rules to individual data points, such as:

```text theme={null}
UxConsoleEvent
```

Custom logic can be added through:

```text theme={null}
settings.application.factProcessor
```

The processor evaluates each applicable fact and assigns its visibility expression before the data becomes available to GermainUX users.

### Access Expressions

Visibility is defined through team-based access expressions.

| Expression | Meaning |
| - | - |
| `t0` | Visible to Team 0. |
| \`t0 |   |
| `t1 && t2` | Visible when the applicable Team 1 and Team 2 access requirements are satisfied. |

Team identifiers and expressions should be configured according to the organization’s GermainUX team and authorization model.

## Example: Financial Organization

Consider an organization in which access to recorded activity must be separated by financial product.

| Team | Authorized data |
| - | - |
| **Team A** | Sessions and facts related to Stock ABC. |
| **Team B** | Sessions and facts related to Stock DEF. |

The custom security logic evaluates the monitored application context and assigns visibility based on criteria such as:

* Financial product
* Transaction type
* Business function
* User role
* Organizational team

As a result, each team can access only the sessions and facts it is authorized to review.

## Implementation Summary

| Security scope | Configuration mechanism | Purpose |
| - | - | - |
| **Entire Session Replay** | `settings.application.metadataProviders['access']` | Controls which teams can view a recorded session. |
| **Individual facts** | `settings.application.factProcessor` | Controls which teams can view specific data points. |
| **Team visibility** | Expressions such as `t0`, `t1`, or \`t0 |   |

Test all custom security logic before deploying it to production. Confirm that unauthorized users cannot retrieve protected data through dashboards, searches, reports, exports, Session Replay, or other supported interfaces.

## Related Documentation

This page focuses on access to collected facts and Session Replay recordings. Related capabilities are documented separately:

> [card] [Compliance, Data Privacy and Security Overview](https://docs.germainux.com/main/compliance-privacy-and-security.md)
>
> Compliance, Data Privacy and Security Overview

> [card] [Data Privacy](https://docs.germainux.com/main/data-privacy.md)
>
> Data Privacy

> [card] [Cookie Consent and User Privacy](https://docs.germainux.com/main/cookie-consent.md)
>
> Cookie Consent and User Privacy

> [card] [Certifications and Policies](https://docs.germainux.com/main/compliance.md)
>
> Certifications and Policies

## Get Help

> [card] [Contact GermainUX Support](https://docs.germainux.com/main/support.md)
>
> The GermainUX team helps you get up and running faster, empower your team, turn data into actionable insights, and optimize performance to deliver measurable business outcomes.

> [card] Can't find what you need?
>
> Search all GermainUX docs with **Ctrl + K**, or use the feedback buttons at the bottom of this page to tell us what is missing.

The content of this document is proprietary to GERMAIN SOFTWARE.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.