Interactive Demo Security: What Actually Leaves Your App
August 19, 2026
Demo tools capture your product while you are logged into it. That is the whole point, and it is also the reason this deserves five minutes of thought before you record anything containing customer data.
The risk is rarely the vendor being careless. It is that a published demo is a public URL, and whatever was on your screen is now on it.
What a capture actually contains
- Everything visible on screen, including the parts you stopped noticing -- the customer name in the header, the account balance in the corner, the support ticket in a sidebar.
- Sometimes more than is visible. A tool capturing the page structure rather than pixels can pick up text that was scrolled out of view or hidden behind a panel.
- Your own identity. The logged-in user's name, avatar and email are in almost every screenshot of almost every product.
- URLs. Query parameters routinely carry account IDs, and sometimes tokens.
The questions worth asking a vendor
- Where is the capture stored, and is a published demo a public URL? Almost always yes -- that is what makes it shareable -- which means treat it as public from the moment you publish.
- Can you redact after recording, and does redaction destroy the original? Blurring an image that keeps an unblurred copy on the server is not redaction.
- Does the demo run any of your product's code when someone views it? It should not. A captured page rendered with scripts stripped and sandboxed is inert; anything live is a much larger surface.
- Who on your team can publish? Recording is safe. Publishing is the irreversible step, and it is worth knowing who can take it.
The practical habit that solves most of it
Record from a dedicated demo account with invented data. Not a scrubbed real account -- a separate one, populated with obviously fictional names and plausible numbers.
This removes the entire class of problem instead of managing it. It also produces better demos: real data is messy, inconsistent and full of distractions, while a demo account can be arranged to show the product at its most legible.
If you must record against real data
- Redact immediately after capture, before the demo is shared with anyone internally.
- Check every step, not the first one. The account name in the header appears on all of them.
- Watch for hover states and tooltips that expose an email on capture.
- Have a second person review before publishing. You stop seeing the customer name in the corner after the fourth screenshot.
Regulated industries
If you handle health, financial or legal data, a demo account is not a nice-to-have. Real records in a public demo is a disclosure event, regardless of how briefly it was up or how few people saw it.
The good news is that this is a solved problem: build the demo account once, keep it populated, and every future demo is safe by construction rather than by vigilance.
Frequently asked questions
- Is it safe to record a product demo with real customer data?
- It is safer not to. A published demo is a public URL, and everything visible when you recorded is on it, including account names in headers you stopped noticing. Record from a dedicated demo account with invented data instead.
- Does redacting a demo actually remove the data?
- It depends on the tool. Redaction that destroys the original text or pixels is genuine; blurring that keeps an unmodified copy on the server is not. Ask specifically which one you are getting.
- What should I check before publishing a demo?
- Every step rather than just the first, since identifying details in headers and sidebars repeat across all of them. Check hover states and tooltips too, and have a second person review it -- you stop noticing familiar details after a few screens.
Keep reading
This is what Demorta does
Click through it — the same kind of demo you can record of your own product.
Try it on your own product
Record your first interactive demo free.
Five demos on the free plan, forever. No credit card, no trial countdown, no sales call. Install the Chrome extension, click through your product once, and you have a shareable link in about ten minutes.
Start free →