> For the complete documentation index, see [llms.txt](https://docs.supademo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.supademo.com/workspace-settings/security.md).

# Security

The Security page lets you manage AI enhancement and workspace tracking controls. From here, you can decide whether AI improves hotspot descriptions during demo capture, and how analytics tracking behaves across your demos and showcases.

## Security Settings

### Hotspot Enhancement with AI

**Recommendation: On**

When enabled, Supademo uses AI to improve hotspot descriptions during extension capture. As you record a demo with the Chrome Extension, the AI reads context from the element you clicked, the page HTML, and any pre-set use case or language preferences, then generates polished, relevant hotspot text automatically — so you don't have to rewrite annotations after the fact.

This toggle controls the underlying capability. Per-recording configuration (use case, language, desired outcome, additional context) happens inside the Chrome Extension via the **Enhance with AI** option when starting a recording.

{% hint style="info" %}
**Why keep AI Enhancement on:** AI-generated hotspot text is a major time-saver and typically produces cleaner first drafts than auto-captured click descriptions. You can still override or rewrite any individual hotspot in the editor.

**When to turn AI Enhancement off:** If you record demos containing sensitive content that shouldn't be processed by external AI models, or if your workspace policy requires manual control over every hotspot description, turn this off. Recordings will still capture clicks and steps — you'll just get the raw click-based annotations rather than AI-enhanced versions.
{% endhint %}

### GDPR Tracking

**Recommendation: On**

When enabled, Supademo collects analytics on demo and showcase activity — step completions, hotspot clicks, CTA clicks, viewer sessions, and engagement data — to populate your Analytics dashboard.

The "GDPR Tracking" name is a reminder: under GDPR, CCPA, and similar privacy regulations, companies must obtain user consent before using cookies or similar tracking technologies. If your viewers are subject to those regulations, you should only have this enabled when you've already secured viewer consent.

{% hint style="info" %}
 **When to keep GDPR Tracking on:** If your demos are shared internally, your viewers aren't subject to GDPR/CCPA, or your parent website's cookie consent flow already handles tracking permission for embedded demos, keep this on so you get full analytics.

**When to turn GDPR Tracking off:** If your demos are embedded on a site that requires cookie consent (and the consent flow hasn't been wired up to Supademo), turn this off to remain compliant. You can then selectively enable tracking on a per-viewer basis using the consent integration below.
{% endhint %}

#### **Enabling tracking on viewer consent (for embedded demos)**

If you embed Supademos on a site that requires GDPR-style cookie consent, you can keep GDPR Tracking off in Supademo and selectively enable tracking only for viewers who accept your cookie policy.

This requires a small JavaScript snippet on your parent site:

1. Turn off **GDPR Tracking** in Supademo to disable tracking by default.
2. On your website, run the following JavaScript when a user clicks "Accept" on your cookie consent banner:

javascript

```javascript
const supademos = document.querySelectorAll("iframe[src*='/embed'], iframe[src*='/demo'], iframe[src*='/showcase']");
supademos.forEach(function(supademo) {
  supademo.contentWindow && supademo.contentWindow.postMessage({ type: 'consent' }, '*');
});
```

3. This signals every embedded Supademo on the page that the viewer has consented, and tracking will begin sending event data to Supademo's servers for that viewer.

If the viewer clicks "Decline" instead, no action is needed — tracking stays off by default.

{% hint style="warning" %}
This implementation requires technical/engineering work on your parent website. The snippet only needs to run on pages where Supademos are embedded.
{% endhint %}

### Related

* For more on what AI Hotspot Enhancement does during recording, including how to set context, use case, language, and outcome preferences, see the [Enhance with AI](https://docs.supademo.com/create/by-method/create-with-chrome-extension/enhance-with-ai) page.
* For more on what's tracked by default and how to interpret your analytics, see [General Analytics](https://docs.supademo.com/analyze/general-analytics).

{% @supademo/embed demoId="clsuzaom708nhpemjthyxnty2" url="<https://app.supademo.com/demo/clsuzaom708nhpemjthyxnty2>" %}