Skip to main content

​
Record everything - except what you’re not allowed to record

A session recording platform that captures everything on screen is useful - until the moment it captures a customer’s credit card number, an employee’s social security number, or a password in plain text. Suddenly every recording is a PCI DSS violation, a GDPR breach, or a HIPAA incident waiting to happen. The same data the recording is meant to protect now lives in your monitoring database, replicated to every backup. The usual workaround is to record selectively - disable monitoring on certain applications, certain users, certain time windows - and hope nothing sensitive shows up where you’re still recording. That trades coverage for compliance. Enterprise DLP tools can detect sensitive data in motion, but they don’t help with screen recordings already captured. Syteca Sensitive Data Masking masks sensitive data at recording time, on the endpoint, before it ever reaches the database. You define custom regex patterns for the data you can’t legally store - passwords, credit cards, SSNs, anything else - and the Windows Client blurs matching values in the screen captures and replaces them with asterisks in the metadata grid. The result: full session coverage with no PII or PCI data ever recorded in clear text.
Use Sensitive Data Masking when you need to:
  • Comply with PCI DSS requirements that forbid storing full credit card numbers (PAN) in any system - including monitoring systems.
  • Comply with GDPR, HIPAA, and other privacy laws that restrict storage of personally-identifiable information without consent or legitimate purpose.
  • Maintain full session recording coverage without redacting recordings after the fact.
  • Block passwords from appearing in screen captures even when users type them outside the dedicated password fields where Keystroke Logging Password Masking already protects them.
  • Detect and mask custom organization-specific patterns (account numbers, case IDs, project codes) using regex.
Pair it with the Pseudonymizer - Sensitive Data Masking hides specific data values; Pseudonymizer hides the identity of the people whose sessions are recorded. GDPR-conscious deployments often use both.
Windows Clients only. Currently supported in Google Chrome, Microsoft Edge, Microsoft Outlook (new and classic), Microsoft Word, and Notepad++. Sensitive Data Masking is not supported on macOS or Linux Clients, and is not supported in Full Motion Capture mode (only Interval Capture).
This feature requires the User Activity Monitoring application to be enabled in your license serial key.

​
How masking works

When the Syteca Client detects clear text on screen matching any configured regex pattern, the data is masked immediately - including in live sessions still in progress - and encrypted in the database. Two visible forms:
In some cases the entire screen is blurred instead of just the matching region - this happens when the system detects the regex pattern in the active window but can’t pinpoint the exact location quickly enough. The masking is preserved either way.

​
Configure Sensitive Data Masking

1

Open the Client or Client group

Click Clients in the left navigation. On the Clients page, click the Client (or Client Groups tab and the group) you want to configure.
2

Enable Capture Active Window Only

On the User Activity Recording tab, in the Screen Capture Settings section, select Capture active Window only.
Sensitive Data Masking cannot be enabled unless Capture active Window only is already enabled - this is a hard prerequisite.
3

Enable Sensitive Data Masking

Switch to the Privacy Settings tab. Move the Enable Sensitive Data Masking toggle to the right.
4

Add regex rules

Click Add to define new regex policy rules, or click the Edit icon to modify existing ones. For each rule:
  • Enter a Name (e.g. “Credit card numbers”, “US SSNs”).
  • Enter a Regex value matching the pattern to mask.
  • Click the Checkmark icon to validate the regex syntax. If invalid, a red error message appears and the rule can’t be saved until the syntax is fixed.
Multiple rules combine with OR logic - if the system detects any one rule’s pattern, the matching data is masked.
Use several simple rules instead of one complex rule - the endpoint Client consumes fewer resources processing several straightforward patterns than one complex catch-all.
5

Save

After adding all required rules, click Finish in the bottom right.
Privacy Settings tab showing Enable Sensitive Data Masking toggle and a list of regex rules

The Privacy Settings tab with multiple regex rules configured for masking.

​
Example regex patterns

Common starting patterns for the most-regulated data types (test these against your actual data before deploying):
These examples are illustrative. Tune them to your organization’s actual data formats - for example, if you process European IBANs, AmEx 15-digit cards, or custom internal account formats, write rules specifically for those patterns.

Pseudonymizer

Hide the identity of monitored users (GDPR-style) - pairs naturally with this feature.

Keystroke logging & password masking

The complementary feature that masks passwords typed into known password fields.

Recording parameters

Other session recording configuration - Capture Active Window Only, Full Motion Capture, etc.

Session Player

Where masked data appears (or doesn’t) in recorded sessions.