Open Source Session Replay: Self-Hosting Options and Trade-offs

Open source session replay means using software whose code is public and can run on your own servers. The common foundation is the rrweb library, which records DOM changes and replays them in a browser. It gives you control over data location, but you take on storage, upgrades, masking and the work of building a usable analysis layer.

The building block: rrweb

rrweb is an open source library that serialises a page’s DOM and then records mutations, inputs, scrolls and pointer events as a stream. A separate player rebuilds the page and plays the events back. Many hosted tools, including the recorder described on BusinessMCP’s session replay page, build on this style of capture, so learning how it works helps you evaluate any product.

What the library gives you is capture and playback. What it does not give you is everything around it: ingestion servers, storage, search, filtering by page or device, frustration scoring, access control, retention jobs and consent handling. Those are the parts that take time.

What self-hosting involves

Task	What it means in practice
Ingestion	An endpoint that accepts chunks of events, handles bursts and rejects bad data
Storage	Events are text but add up; you need lifecycle rules to delete on schedule
Playback UI	A viewer, timeline, markers and a way to search sessions
Masking	Configuration in the recorder, plus tests after every site change
Bot filtering	Headless browsers and automation inflate data; hosted tools often reject them at ingest
Security	Recordings are sensitive; restrict access, encrypt and audit
Upgrades	Recorder versions and browser changes can break replays

None of these is exotic, but together they are a product. Estimate it honestly in engineer-weeks before comparing against a subscription.

Reasons to self-host

• Data residency. Recordings stay in a region or network you control.
• Contractual constraints. Some organisations cannot send behavioral data to third-party processors.
• Customisation. You can capture or mask exactly what you want and integrate sessions with internal tools.
• Scale economics. At very large volume, running your own storage may cost less than per-session pricing, though only if you count engineering time.

Reasons not to

• Hidden labour. The first version is quick. Keeping masking correct, replays accurate and storage tidy is ongoing work.
• Analysis gap. Without frustration scoring and filtering, recordings pile up unwatched. See how to analyze session recordings.
• Compliance is still yours. Self-hosting removes a processor from the chain but does not remove the need for a legal basis, notice and retention policy. See session replay and GDPR.
• Free hosted alternatives exist. Free session replay tools such as Microsoft Clarity, which BusinessMCP’s comparison lists as free with no traffic limit, may meet your needs without any build.

Key takeaway: open source is free like a puppy is free. Choose it for control, not for savings, unless you have the engineering capacity to run it well.

A decision framework

1. Do you have a hard residency or contractual requirement? If yes, self-hosting or a vendor with the right region is on the table.
2. Do you have engineers who will own it? If not, skip self-hosting.
3. How much will you actually review? If the answer is a few sessions a week, a hosted free tier is almost certainly enough.
4. Do you need identification, heatmaps or testing? Building these yourself multiplies the work. A product like BusinessMCP bundles heatmaps and replay on its Growth plan at $79 a month and adds A/B testing on Scale, per its page, though it is hosted, not self-hosted.

If you do build

A sensible minimum:

• Start with a single flow, such as checkout.
• Mask all inputs and explicitly exclude sensitive pages from the start.
• Sample rather than recording every visitor.
• Set a short retention window and automate deletion.
• Add a way to find sessions by page, device and error before you add anything else.
• Test the player against your site on mobile and desktop.

Plan for the recorder script’s effect on page speed. A recorder should load after the page is interactive and send data in chunks, which is how BusinessMCP describes its own approach. Measure the effect on your own pages with and without it.

Hosted does not mean locked in

If you start hosted and later want control, the capture style is similar across rrweb-based tools, but stored recordings are generally not portable between vendors. Check export options before committing, as covered in session replay software. For cost context, compare the hosted plans in session replay pricing against your engineering estimate.

Bottom line

Open source session replay is a strong fit for teams with strict data control needs and engineers to spare. For everyone else, the real cost is time. Be honest about that before you start.

Self-hosted analytics versus self-hosted replay

Teams sometimes conflate the two. Running your own web analytics is a well-trodden path with many mature options, and BusinessMCP’s PostHog alternative page is one vendor’s view of that landscape, written from a competitor’s seat. Replay is heavier: recordings carry far more data per visit than page-view counters, include potentially sensitive content, and need a viewer that rebuilds pages faithfully. If you already run self-hosted analytics, adding replay is an extension of an existing operational habit. If you do not, it is a new one.

A related consideration is ad blockers. A recorder served from your own domain tends to be blocked less often than one served from a well-known third-party domain, which affects coverage. BusinessMCP’s guide on first-party analytics and ad blockers discusses the idea for analytics generally. Higher coverage is not automatically better for privacy: if visitors have used a blocker to opt out, bypassing it deserves its own legal and ethical thought.

A cost sketch for a self-hosted setup

Without inventing prices, list the cost lines so you can fill them in with your own numbers:

1. Engineering time to build or deploy ingestion, storage and a viewer.
2. Ongoing maintenance: upgrades, incident response, browser-compatibility fixes.
3. Storage and bandwidth, scaled by sampling rate and retention.
4. Security work: access control, encryption, audit logs.
5. Compliance work: masking tests, notice, retention automation.
6. Analyst time to review recordings, which does not shrink by self-hosting.

Add the first five, divide by the number of useful sessions you expect to review, and compare with the per-session cost of a hosted plan from session replay pricing. Teams are often surprised that the engineering line dominates, which is why modest-traffic sites rarely come out ahead by self-hosting.