Documentation
Retention and limits
How long reports are kept, quotas per plan, maximum sizes and abuse protection.
Retention
Each project has its own retention period: 7, 14, 30 (default), 60, 90, 180 or 365 days. It's changed in the project settings.
- Each report's deletion date is set when it's received (received date + project retention). Changing the retention affects new reports.
- An automated process checks for expired reports and deletes the files first (replay, console, network, screenshot and video) and then the database records, with their comments and messages.
- Uploads that never completed are deleted after 1 hour.
- When you delete a team, all its projects, reports, recordings and integrations are deleted. When you delete your account, your tokens and memberships are deleted, along with the teams where you were the only person.
The maximum history depends on the plan (see pricing).
Quotas per plan
Quotas are counted per project, in UTC calendar periods.
| Plan | Reports per month | Reports per day | Automatic per day | Max size per report | Storage |
|---|---|---|---|---|---|
| Free | 100 | 30 | 10 | 50 MB | 1 GB |
| Team | 2,000 | 300 | 100 | 150 MB | 25 GB |
| Business | 20,000 | 3,000 | 1,000 | 185 MB | 250 GB |
When a quota is reached, the API responds with 429 and the quota type (month, day, auto or storage), and the widget tells the person that the report couldn't be sent. Owners and admins receive an email at 80% and 100% of the monthly quota.
Each project can have limits that are stricter than the plan's (never higher). They're configured under Project → Settings → Limits and protection, where you can also see usage for the month, the day, automatic reports and storage. Only owners and admins can change them; changes apply in under a minute. An empty field uses the plan's limit.
Size of each file
| File | Maximum |
|---|---|
| Replay | 30 MB |
| Console | 5 MB |
| Network | 10 MB |
| Screenshot | 10 MB |
| Screen recording | 100 MB |
Replay, console and network are sent gzip-compressed.
Abuse protection
The project key is public, so the API applies several layers:
- Allowed origins: only accepts reports from the domains you configure. You can require the list to be non-empty and reject requests without an
Originheader. - Blocklists: IPs or CIDR ranges (IPv4/IPv6) and origins that can't send reports, under Project → Settings → Limits and protection. Blocked requests are rejected without explaining why.
- Rate limit: 60 reports per minute per IP overall, and a per-IP limit within each project (30 per minute by default).
- Duplicates: the same IP can't send more than 3 identical reports in 10 minutes (1 if automatic).
- Pending uploads: at most 10 reports with unfinished uploads per IP and project.
- Signed URLs: files are uploaded directly to storage using URLs that expire in 10 minutes and have the size signed.
IPs are only used in temporary counters for these protections; they aren't stored in reports.