Frequently Asked Security Questions
If you have any additional questions, we are reachable at security@howdygo.com
For Editors
Does the HowdyGo browser extension always record my screen?
No, unless the HowdyGo Chrome extension is actively in recording mode none of your data will be collected.
How can I secure my HowdyGo publication?
If a publication is not published, it is not accessible to any 3rd party viewers. You can also password protect your demos, and on Pro and Enterprise plans you can restrict which domains are allowed to embed them.
Can I restrict which websites embed my demos?
Yes. On Pro and Enterprise plans, organization admins can configure embed domain restrictions under Settings > Access Controls. When enabled, only approved domains can display your embedded demos.
Can I limit what team members can access?
Yes. On Pro and Enterprise plans, you can assign Admin or Editor roles to team members. Admins have full access to organization settings, billing, and access controls. Editors can create and edit demos but cannot manage organization-level settings. Configure roles from Settings > Team Management.
When was your last third party penetration test performed?
The last third party penetration test was performed on 18th November 2025.
How can I remove an offboarded employee HowdyGo?
HowdyGo does not provide a login mechanism using an email address and password. Therefore, all users require access to the email address used to access HowdyGo. By removing access to their email account, you will automatically remove access to HowdyGo.
If you have separately invited a team member through an email address that is accessible to the user, please contact support@howdygo.com.
For Viewers
Does HowdyGo collect personal data about the people who watch my demos?
No, not by default. Viewers (the prospects and customers watching your demos) are tracked anonymously. We record session events like impressions, engagements, and completions, but we do not collect names, email addresses, IP addresses, or any other personally identifiable information unless you choose to identify them.
See Data Collection for a full breakdown of what is and isn’t collected.
When would a viewer become identifiable?
A viewer only becomes an Identified Viewer if you take a deliberate action: they submit a lead capture form, you share a demo link with ?email=..., or you use the SDK to identify logged-in users in your own product.
Does HowdyGo ingest prospect PII?
Only when you ask it to. Many customers route lead data directly to their CRM via integrations like HubSpot, Salesforce, or Marketo so that no PII is stored in HowdyGo. If you use our built-in lead capture form, the fields you configure are stored in our database and are exportable by your team.
Are viewers tracked across sessions or across different demos?
Anonymous viewers are not tracked across sessions. Each viewing generates a fresh session identifier. If a viewer has been identified (via form submission, URL parameter, or SDK), their sessions are associated with their email so you can see their journey across demos.
Do demo embeds set advertising or tracking cookies on viewers?
No. HowdyGo demo players do not load third-party advertising trackers and do not set persistent cross-site identifiers.