From browser events to session replay

key management service that wraps/unwraps per-session data keys (GenerateDataKey / Decrypt).

a visitor on the customer's website whose browser session is recorded by the embedded posthog-js SDK.

a PostHog user who watches session replays to debug issues and understand user behavior.

posthog-js + rrweb embedded in customer websites

records DOM mutations, clicks, console and network, batched as $snapshot / $performance_event events.

high-throughput /s/ capture endpoint; validates, rate-limits and collapses $snapshot events into $snapshot_items Kafka messages.

kafka_session_replay_events (Kafka engine) → session_replay_events materialized view; stores block metadata, counts, surfacing_score, is_deleted.

session_recordings REST API;

HogQL list & metadata queries against ClickHouse, snapshots streaming via the Recording API.

keystore of per-session data keys wrapped by AWS KMS.

Session recordings scene

lists/filters recordings and replays rrweb events in a sandboxed iframe via the rrweb Replayer.

message bus:

session_recording_snapshot_item_events (capture → ingester), clickhouse_session_replay_events + clickhouse_session_replay_features (ingester → ClickHouse).

• consumes $snapshot_items
• validates headers, resolves retention, gates/rate-limits sessions, resolves per-session data keys, buffers encrypted blocks, streams them to S3 and publishes block metadata to ClickHouse.

serves encrypted blocks:

S3 byte-range read → sodium decrypt (KMS-unwrapped key) → optional snappy decompress; block lists from ClickHouse; crypto-shred deletes.

shared cache:

• token-bucket session gating and 'seen' marking during ingestion
• RedisCachedKeyStore used by the Recording API.

sodium-encrypted, snappy-compressed recording blocks partitioned by retention period.