Privacy Policy
Last Updated: July 30, 2025
Hobbes is designed for teams that work with sensitive data, complex workflows, and strict compliance requirements. From the ground up, we’ve built the platform with a focus on security, privacy, and operational transparency - giving our customers confidence in how their data is handled. This document outlines our deployment model, data controls, and security practices.
Deployment & Integration
Hobbes supports two integration methods:
CDN injection: Fast and easy to implement (2-line script)
NPM install: Statically bundled, version-locked, and auditable
Data Access & Privacy Controls
Both options provide full control over how and when Hobbes code is loaded. Hobbes does not require elevated permissions nor access internal application state unless explicitly configured.
Hobbes is built to operate securely in environments with strict privacy boundaries. By default, it does not collect page content, tokens, or app state unless explicitly enabled.
Key privacy features include:
Page-level exclusions: The widget can be disabled on any route or surface (e.g., internal tools or admin views)
DOM redaction: Sensitive elements can be excluded from capture using attribute flags or selector-based rules
No implicit access: The widget does not access user content, authentication tokens, or APIs unless configured to do so
Blinded recordings: Sensitive text / images can be masked before leaving the browser with configuration options available
Data retention & deletion: Customer data is retained only as long as required to support product functionality. Deletion can be requested at any time, and retention periods can be customized.
Customer Data Isolation
Hobbes enforces strict tenant separation by default:
Dedicated storage buckets per customer
Logical access boundaries at the infrastructure and application level
Audit trails for all data collection and access operations
Security & Compliance
We are currently undergoing SOC 2 Type II certification and follow security best practices in how we develop and operate the platform. Our approach includes:
TLS encryption in transit and AES-256 encryption at rest
Secure secrets management using AWS Secrets Manager
Role-based access control and internal audit logging
Isolated production and development environments
Scoped access to customer data with clear internal review paths
