See the session behind every bug report.
Specto records what people actually did on your site — every click, error and request — and attaches it to the feedback they send. Inputs are masked in their browser before anything leaves.
The real thing, on a real checkout.
A small shop with Specto installed, a payment bug, and two dozen visitors. These are Specto’s own screens over what it recorded.
From the first click to the fix.
Session replay
The page itself, rebuilt — clicks, scrolls, console and network, on a timeline you can scrub.
Feedback inbox
A widget on your site; every report lands with the replay, errors and requests attached.
Issues and regressions
Errors grouped into issues, and a heads-up when a resolved one returns in a newer release.
Funnels, paths and retention
Where visitors convert, wander and come back — computed from the sessions themselves.
Heatmaps
Click and scroll maps on the live page, split by device.
Alerts
Error spikes, rage-click surges and funnel drops, by email, Slack or webhook.
AI session summaries
A one-line read of what happened in a session, when you don’t have five minutes to watch it.
Mobile and backend
React Native apps record too, and the Node SDK ties backend traces to the session that made the request.
Masked in their browser, before anything is uploaded.
Inputs, card fields and anything you mark are replaced on the visitor’s device. Specto honors Do Not Track and Global Privacy Control, and you can sign a DPA in the app.
Or run the same build on your own Kubernetes, with your Postgres, your email and your SSO.
<!-- any site --> <script src="https://specto.sh/specto.js" data-key="pk_…" defer></script> // React and Next.js <SpectoProvider apiKey="pk_…"><App /></SpectoProvider>
One line. Recording from the first click.
The key is the whole install. Errors, console and requests are captured from the moment the page starts, even before your app has loaded.
SDKs for the browser, React, Node and React Native. Quickstart →
Alerts that open on the sessions that broke.
By email, Slack or webhook — and new issues and regressions arrive grouped, not one email per error.
Built for the team that has to fix it.
One tool, not four
Replay, feedback, errors and funnels share one timeline, so a bug report, its error and the session that shows it are the same thing.
Masked before it leaves
Inputs and anything you mark are replaced in the visitor’s browser. What never reaches us can’t leak from us.
Yours to run
Open-core. Run the same build on your own Kubernetes with your Postgres, email and SSO.
Pricing you can read
Plans count sessions — not events, not seats on Business. Overage is optional and capped by you.
Ready for your security review.
The controls an IT team asks for, on the Business plan and up — and the same build on your own infrastructure when that’s the answer.
- Single sign-on SAML and OIDC, with SCIM provisioning
- Two-factor and passkeys and an organization rule that requires them
- Audit log streamed to your SIEM
- Access reviews and sign-in limits by IP and session age
- Retention you choose from 30 days to two years, by plan
- A DPA you can sign in the app, with a signed copy by email
Start free. Pay when it’s worth it.
- 5,000 sessions / month
- 30-day retention
- 1 project · 3 seats
- 25,000 sessions / month
- 90-day retention
- 5 projects · 10 seats
- 100,000 sessions / month
- 1-year retention
- Unlimited projects + seats
- Custom session volume
- Custom retention
- Self-hosted license or dedicated
Pro, free for 3 months, for teams who’ll tell us the truth.
We’re looking for early teams to shape Specto with us. You get Pro at no cost; we get 30 minutes of your time once a month.
- 25,000 sessions a month, 90-day retention
- A direct line to the people building it
- No card. Free afterwards, unless you subscribe.
Before you install it.
What counts as a session?
One visitor’s continuous activity on your site. It survives page loads and ends after 30 minutes of inactivity, so ten pages in one visit are one session.
Will it slow my site down?
The script is about 65 KB compressed, records the page’s structure rather than video, and sends in small batches. Sessions from development hosts are tagged so they don’t crowd your data.
What about privacy and GDPR?
Inputs are masked in the visitor’s browser, Do Not Track and Global Privacy Control are honored, consent mode can hold recording until visitors agree, and you can sign a DPA in the app.
Can I self-host it?
Yes. The same open-core build runs on your own Kubernetes with your Postgres, email and SSO. Enterprise features need a license.
What happens when I reach my plan’s limit?
New sessions stop recording until the next month or an upgrade — unless you turn on overage, which keeps recording up to a monthly cap you set. Nothing already recorded is deleted.
Does it work with React, Next.js and mobile apps?
Yes: a script tag, an npm package with a React provider, React Native for mobile apps, and a Node SDK for backend traces.