Skip to content

docs(telemetry): document BAA category restrictions #446

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Sayan- wants to merge 2 commits into from
Closed

docs(telemetry): document BAA category restrictions #446

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cb9916f
docs(telemetry): document BAA category restrictions
Sayan- Jul 14, 2026
44f6dd7
docs(telemetry): clarify BAA restriction wording
Sayan- Jul 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion browsers/telemetry/categories.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,12 @@ Captured events are persisted and can be replayed by [resuming the stream](/brow

Some exposure is reduced for you automatically: input into sensitive fields such as passwords is suppressed (`interaction_key` isn't emitted for them, and `interaction_click` omits the element text). Beyond that, because selection is opt-in, the most effective control is to capture only the categories you need - enable `network`, `console`, `page`, `interaction`, or `screenshot` deliberately, and prefer the operational categories when you only need session health.

### Restrictions for organizations with a BAA

If your organization has signed a business associate agreement (BAA) with Kernel - the contract required to handle data under HIPAA - the `network`, `console`, and `screenshot` categories are blocked and can't be captured. These are the categories most likely to record protected health information (PHI): full request and response data, anything the page logs, and rendered images of the screen.

The restriction is enforced when you create a session (`POST /browsers`) or update one (`PATCH /browsers/{id}`). Enabling any blocked category returns a `400` response with the code `telemetry_category_restricted`, and the session's telemetry config is left unchanged. The remaining browser-activity categories (`page` and `interaction`) and all operational categories stay available.

@cursor cursor Bot Jul 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dense BAA enforcement prose

Low Severity

The new BAA enforcement paragraph packs several separable facts—create/update routes, the 400 / telemetry_category_restricted response, unchanged telemetry config, and which categories stay allowed—into one dense sentence. A short lead-in plus bullets would match the guide scannability rule.

Fix in Cursor Fix in Web

Triggered by learned rule: Use bullet lists when covering multiple distinct points in guides

Reviewed by Cursor Bugbot for commit cb9916f. Configure here.


<Warning>
If you operate under HIPAA, GDPR, or similar obligations, be deliberate about the browser-activity categories: pointing them at a site that handles regulated data captures that data into storage. If you have compliance requirements around what Kernel may process, [contact us](mailto:security@kernel.sh) before enabling them.
If you operate under HIPAA, GDPR, or similar obligations, be deliberate about the browser-activity categories: pointing them at a site that handles regulated data captures that data into storage. `page` and `interaction` stay available under a BAA but can still carry personal data. If you have compliance requirements around what Kernel may process, [contact us](mailto:security@kernel.sh) before enabling them.
</Warning>
Loading