Open-source alternative to VWO Insights heatmaps and recordings

Masking and retention are where a self-hosted replacement for VWO Insights either protects respondents or quietly records what it should not. OpenReplay offers the most documented capture-time controls: according to its README, it masks or skips data before it reaches the server, supports masking by CSS selector and input redaction, and provides a private mode that masks all text and inputs by default. Start from private mode, then open the specific pages in your application that show account numbers, health data, card fields or personal identifiers, and confirm that each one is covered by a selector rule. Test with a real-looking but synthetic session, then review the stored replay in the player, because a rule that misses a dynamically rendered field will not raise an error.

PostHog and Matomo take a different route, and you should confirm their settings in your own configuration rather than assume a default. PostHog's session replay and autocapture options, including how input fields and text are recorded, are set per project, and the same applies to Matomo's heatmap and session recording plugin. Whichever tool you choose, record the masking configuration as a controlled setting in version control or your change log, and repeat the test after every release of the front end. Retention is also an operator decision on self-hosted instances: you set how long replays, events and heatmap data are kept, and you should align those periods with your own retention schedule instead of a vendor's plan tiers. Ask your privacy team to confirm the period in writing before the first production recording.

Consent is the point most teams miss. Matomo's ePrivacy FAQ explains that France's CNIL treats some audience measurement trackers as exempt from consent when they are limited to purposes such as performance measurement, collect only anonymous statistics and exclude marketing measurement. The same FAQ states that adding features such as User ID, heatmaps or session recordings removes that exemption. If your analytics currently relies on the exemption, enabling heatmaps or recordings in any of the three tools means you need a consent mechanism before collection starts, and the legal review should happen before the configuration goes live. Confirm the current position with your data protection officer or counsel, and check the CNIL guidance for any other jurisdictions where your visitors are located.

Choose the tool by the job you need done first, because the three options overlap less than their feature lists suggest. Pick PostHog if experiments, product analytics, feature flags and session replay should share one tool and one data store. Its free self-hosted deployment is an MIT-licensed Docker Compose setup, but the repository's ee/ directory carries a separate license and premium features require a PostHog license. Self-hosted deployments are officially unsupported, so your team carries the operations. Confirm which features you need sit outside ee/ before you commit, and check the scale guidance in the README, which points open-source deployments toward PostHog Cloud at roughly 100k events per month.

Pick OpenReplay if replay quality, DevTools data and cobrowsing matter most. Its README describes capture-time sanitization, CSS selector masking and a private mode that masks all text and inputs by default, which is the control set to test first against your own pages. Most of the monorepo is AGPLv3 and the ee/ directory is commercial, so check the license terms with counsel before you modify or offer the platform to others. Matomo fits when web analytics governance, existing Matomo reporting and a stable on-premise base already matter. Its Heatmap and Session Recording plugin is paid and licensed under the InnoCraft EULA, not the GPL, and it is sold per number of users.

Treat the consent question as a point for legal review, not a conclusion. Matomo's ePrivacy FAQ says France's CNIL may exempt some analytics trackers from consent only when they are limited to measurement purposes and collect anonymous statistics, and that adding User ID, heatmaps or session recordings removes that exemption. Heatmaps and recordings are the features this page is about, so a Matomo setup with the paid plugin likely needs a consent review, and the same question applies to PostHog and OpenReplay. Ask your data protection officer or counsel to confirm how each option is configured in your jurisdictions, including Italy, the Netherlands and Spain, before you choose.

The license of each candidate decides which features you can run without a further agreement. PostHog's repository is under the MIT Expat license, but everything in its ee/ directory is covered by a separate license, and the README says that premium features from that directory on a self-hosted instance require a PostHog license. If you need fully free software, the posthog-foss repository is purged of all proprietary code and features, so confirm which features your heatmap and replay plan depends on before choosing it. OpenReplay follows the same pattern: most of its monorepo is AGPLv3, some directories are MIT, and everything under ee/ falls under a commercial license. Matomo's core is GPLv3, but its Heatmap and Session Recording plugin is sold under the InnoCraft EULA, so the heatmap and replay capability you were paying VWO for is the part with a non-open license.

Support is the second term to read closely. Free editions come with community support: PostHog's self-host documentation states that self-hosted deployments are officially unsupported and that PostHog does not offer customer support for product, infrastructure or other questions on self-hosted instances. OpenReplay's pricing page lists community support for its open-source edition, with a custom SLA and dedicated support reserved for the self-hosted Enterprise edition, priced on multi-year contracts. Matomo's On-Premise Community edition includes forum support. None of these sources gives a response time, so if a production replay tool is business critical, ask each vendor in writing what support, uptime commitment and incident response it offers, and budget for an operations partner or internal on-call cover to fill the gap.

Before you commit, write down the license and support position for the exact feature set you need, not the product headline. Check whether the heatmap or replay module you rely on sits in a commercially licensed directory or plugin, confirm whether your legal team accepts AGPL obligations if you modify the code, and decide who owns upgrades and security patches. Those answers determine whether the open-source edition is enough or whether a paid tier or implementation contract is part of the cost model.