Enable privacy protection in the Tealeaf iOS SDK
When capturing user behavior data, you must take measures to exclude personally identifiable information (PII) such as credit card numbers or home addresses.
Before you begin
We recommend assigning accessibility labels or IDs to all UI elements that require privacy protection. You can do it programmatically or with the help of the Attribute Inspector in Xcode.
Important:
- Accessibility labels are audible. Accessibility IDs are inaccessible for end users, which makes them useful for internal purposes.
- Using the same accessibility labels across the iOS and Android versions of an app creates consistency and is considered an industry standard. For more information, see Mobile Accessibility at W3C.
- If a UI element isn't assigned an accessibility label, accessibility ID or static ID, Tealeaf uses its XPath. You can enable privacy masking for the XPath, but it will be necessary to convert it to a regular expression first.
Instructions
- In the root project directory, navigate to
PatchTealeafSDK/TealeafLayoutConfig.json
. - In the
masking
object, setHasMasking
totrue
and enter accessibility labels and IDs for masking. - (optional) Enable a custom mask and adjust replacement symbols in the
Sensitive
property. If the custom mask is disabled, fields containing protected data will appear blank in session replays.
{
"Masking": {
"HasMasking": true,
"HasCustomMask": true,
"Sensitive": {
"capitalCaseAlphabet": "X",
"number": "9",
"smallCaseAlphabet": "x",
"symbol": "#"
},
"MaskIdList": [],
"MaskAccessibilityIdList": "pii-08",
"MaskAccessibilityLabelList": [
"Card Number",
"Billing Address"
]
}
}
- Validate the file using a JSON validator (the library may be fail to capture session data correctly if the syntax is invalid).
Scope
You can create a general rule for all screens of your app. In that case, nest the rule into the AutoLayout.GlobalScreenSettings
object. To create a rule for a particular screen, add the AutoLayout.ScreenName
object. Feel free to combine general and screen-specific rules within your TealeafLayoutConfig.json file.
{
"AutoLayout": {
"GlobalScreenSettings": {
"ScreenChange": true,
"DisplayName": "",
"CaptureLayoutDelay": 500,
"ScreenShot": false,
"NumberOfWebViews": 0,
"CaptureUserEvents": true,
"CaptureScreenVisits": true,
"CaptureLayoutOn": 2,
"CaptureScreenshotOn": 0,
"Masking": {
"HasMasking": true,
"HasCustomMask": true,
"Sensitive": {
"capitalCaseAlphabet": "X",
"number": "9",
"smallCaseAlphabet": "x",
"symbol": "#"
},
"MaskIdList": [
"^9[0-9][0-9][0-9]$"
],
"MaskAccessibilityIdList": [
"3",
"myAccessId"
],
"MaskAccessibilityLabelList": [
"SLIDER slider example",
"TRANSITIONS"
]
}
}
},
"PaymentViewController": {
"ScreenChange": true,
"DisplayName": "",
"CaptureLayoutDelay": 500,
"ScreenShot": false,
"NumberOfWebViews": 0,
"CaptureUserEvents": true,
"CaptureScreenVisits": true,
"CaptureLayoutOn": 2,
"CaptureScreenshotOn": 0,
"Masking": {
"HasMasking": true,
"HasCustomMask": true,
"Sensitive": {
"capitalCaseAlphabet": "X",
"number": "9",
"smallCaseAlphabet": "x",
"symbol": "#"
},
"MaskIdList": [],
"MaskAccessibilityIdList": [
"pii-1",
"pii"
],
"MaskAccessibilityLabelList": [
"Card Number",
"Billing Address"
]
}
}
}
Testing privacy settings
To make sure your new rule is working correctly, run the app and enter something into the fields you have masked. Then find the session in Tealeaf and check how the input is displayed.
Summary of configuration parameters
The masking
object in the Tealeaf Layout Configuration file contains all properties related to PII protection.
Property | Nested field | Values | Description |
---|---|---|---|
HasMasking | Boolean | Set the value to true to allow masking. | |
HasCustomMask | Boolean | If a custom mask is enabled, protected text is replaced with symbols. If not, it appears as blank. | |
Sensitive | capitalCaseAlphabet | String | The symbol to display instead of capital letters. Works if HasCustomMask is set to true . |
number | String | The symbol to display instead of numbers. Works if HasCustomMask is set to true . | |
smallCaseAlphabet | String | The symbol to display instead of lower-case letters. Works if HasCustomMask is set to true . | |
symbol | String | The symbol to display instead of other characters. Works if HasCustomMask is set to true . | |
MaskAccessibilityIdList | String or array of string | The accessibility ID assigned to the UI element | |
MaskAccessibilityLabelList | String or array of string | The accessibility label assigned to the UI element (internal) | |
MaskIdList | String or array of string | The IDs of UI elements. All XPath IDs must be converted to regular expressions. For example, you can set the regular expression as ^9[0-9][0-9][0-9]$ to match all the controls whose ID has 4 characters. |
Updated 18 days ago