> What the LiveDemo Chrome extension can access and why, what the demo player tracks, where data is stored, GDPR requests and self-hosting.

Canonical: https://livedemo.ai/docs/account/security-and-privacy/

# Security & privacy

## Chrome extension permissions

Chrome warns that LiveDemo can "Read and change all your data on all websites". That's because a demo can be captured on any site you open. The extension captures screens only after you click **Start recording**, and stops when you stop the recording.

| Permission | Why LiveDemo needs it |
| --- | --- |
| Access to all sites | Record clicks and page content on the site you're demoing |
| `tabs` | Take a screenshot of the tab at each click |
| `tabCapture` | Record the tab's video (no audio, no microphone) |
| `scripting`, `webNavigation` | Keep recording when the page navigates |
| `storage` | Keep you signed in and hold the recording until it's uploaded |

Close tabs you don't want captured, and blur sensitive data afterwards with **Edit → Blur element** in [HTML demos](https://livedemo.ai/docs/edit-a-livedemo/how-to-edit-a-livedemo/#edit-page-content-html-demos).

## What the demo player tracks

For each viewing session LiveDemo records the steps viewed, time spent, leads submitted, and the viewer's IP address with its approximate location (country, region, city). This powers [Analytics](https://livedemo.ai/docs/capture-a-livedemo/analytics/).

- The player doesn't set cookies or use local storage to identify viewers.
- Viewers whose browser sends **Do Not Track** aren't recorded.
- Exclude your own team's IPs in **Settings → Analytics → Excluded IP addresses**.
- Lead form data is only collected when the viewer submits a form you added.

## Where data is stored

The app runs on Google Cloud Platform. Demo screenshots, videos and audio are stored on AWS S3 (`us-east-1`) and served through a CDN. All traffic is encrypted with TLS.

## GDPR and data requests

To get a Data Processing Agreement, or to export or delete your data or a viewer's data, email [support@livedemo.ai](mailto:support@livedemo.ai).

## Single sign-on and API access

- On the Growth plan, require your team to sign in with Okta, Entra ID or Google Workspace. See [Single sign-on](https://livedemo.ai/docs/account/sso/).
- API keys and connected MCP apps act as you but can't change your password or email, delete workspaces, or manage webhooks, keys, SSO or the custom domain. See [MCP server](https://livedemo.ai/docs/integrations/mcp-server/#security).
- GA4 secrets, Segment write keys and webhook secrets are stored encrypted.

## Webhooks

Webhook requests are signed with HMAC-SHA256 in the `X-LiveDemo-Signature` header so you can verify they come from LiveDemo. See [Webhooks & Slack](https://livedemo.ai/docs/ai-demo-agent/webhooks-and-slack/).

## Self-hosting

LiveDemo is open source under the MIT license. To keep all data on your own servers, run the full stack with Docker Compose from the [livedemo-deploy](https://github.com/exploitx3/livedemo-deploy) repository. Self-hosting is free on every plan. Whitelabel and dedicated support are part of the Business plan.

## Report a vulnerability

Email [security@livedemo.ai](mailto:security@livedemo.ai). Please don't post it publicly. We reply within 24 hours.

---

Next: [Create an AI Demo Agent](https://livedemo.ai/docs/ai-demo-agent/create-an-ai-demo-agent/)