[Website Test] Security and performance FAQs

Will the Maze script slow down my website?

The Maze script is designed to have a very minimal impact on the performance of your website. It shouldn’t take more than a few milliseconds to load, and this shouldn’t be noticeable at all to your website users.

Asynchronous loading

The Maze script loads asynchronously. Your website will continue to load while the Maze script is being executed.

This means that, even if the script fails to load (which is unlikely), your website will still continue to render as expected without the script.

Dynamic loading

The Maze tracking code you install on your website is used to dynamically run a loader that powers the testing on your website. The tracking code is less than 1kb.

The dynamic loader is less than 10kb and only runs in specific situations:

• The loader only runs if the API has a valid response;
• The API keys are only valid for each domain you configure;
• The code for either live website testing or the in-product prompt is only triggered if the destination site is opened in a new tab. If this first check is passed, we send a post message to the tab that opened the site, and attach an event listener to wait for the response. The rest of the live website testing code is only triggered if we get the proper response in the first minute. Otherwise, it’ll have no further impact.

If either of the conditions above aren’t met, the script isn’t loaded at all.

Content Delivery Network (CDN)

The dynamic loader is served by a Content Delivery Network (CDN). 

A CDN is a distributed network of servers that delivers content based on a user’s geographic location. It does this by storing copies of the content on servers located in different places around the world. When someone visits a website using a CDN, the content is delivered to their device from the server closest to them. This reduces the distance the content needs to travel, making it load faster.

Using a CDN allows us to serve the loader faster, more reliably, securely, and with reduced data usage.

Session-based caching

The script uses session-based caching. The script is loaded only once, even when the user navigates through multiple pages.

Content Security Policy (CSP) directives

A Content Security Policy (CSP) is a security feature that helps protect websites from security threats and vulnerabilities. It does this by specifying the type of content (e.g. scripts, images, videos) that can be loaded on a website, and from which sources they can be loaded. This helps mitigate certain types of malicious attacks, such as cross-site scripting (XSS), clickjacking, and data injection attacks.

If you have a CSP implemented, you’ll need to add a directive that allows files to be loaded from Maze to allow the Maze script to work on your website.

Default: If using a default CSP, we recommend adding the Maze domain as a trusted source in the default-src rules:

default-src https://*.maze.co/

Stricter: If your organization requires stricter restrictions, we recommend the settings below:

script-src https://*.maze.co/
font-src https://*.maze.co/
style-src https://*.maze.co/
connect-src https://*.maze.co/
img-src https://*.maze.co/
frame-src https://*.maze.co/

Strictest: If your CSP requires additional granularity, the following are the minimum rules required for the Maze script to work. Please note that this list is subject to change as this feature evolves. In that case, you’ll need to update your CSP directives so that the snippet can continue to work.

script-src https://snippet.maze.co/
font-src https://snippet.maze.co/
style-src https://snippet.maze.co/
img-src https://snippet.maze.co/
connect-src https://api.maze.co/ https://prompts.maze.co/
frame-src https://t.maze.co/

What measures are in place to guarantee the security of the script?

Change control

Any changes to the script are subject to Maze’s change control policy.

Access to code changes is restricted to authorized employees only. All changes go through code review and testing before deployment.

Hosting

The script is hosted as part of our general platform infrastructure, with access restricted to authorized employees. 

To learn more about the steps Maze takes to keep your data safe, please check out maze.co/security and compliance.maze.co.

Is the script open-source?

The Maze tracking script is closed-source. By keeping the source code closed, Maze controls how the script is developed and distributed.

What data does Maze collect from my participants?

Our Privacy Policy includes general information about how both customer and participant data is handled. Additionally, here are more details on how the snippet handles participant data:

Snippet usage

The Maze snippet doesn’t collect any information from your website visitors. It simply enables certain Maze features on your website, such as in-product prompts and website tests.

Cookies

We don’t store cookies on your participants’ browsers when they use the snippet, prompts, or website testing.

Local storage for prompts

If a prompt is active, we save a variable in the participant’s localStorage to track if it’s been answered or dismissed. This prevents the prompt from appearing again.

This check happens in the participant’s browser, and isn’t sent to Maze.

Data collected during participation

When someone answers a maze, regardless of the snippet being installed or not, we collect their IP address and user-agent string (information about the device and browser). This is standard for all HTTP requests.

User-agent details appear as participant metadata in the Results dashboard. We don’t use IP addresses.

Is there any tracking in place for general website visitors?

If an in-product prompt or live website test isn’t targeting your website visitors, no information or data will be collected from those users.

What should I consider regarding Privacy Policy requirements when engaging with a website test or a prompt?

You’re responsible for the policies that govern your website and domain—i.e. traffic and journeys directly to your webpages.

Maze’s policies apply when participants interact directly with our endpoints—i.e. when they open a test directly on t.maze.co.

Therefore:

• Website tests: The journey begins at Maze (t.maze.co), and at this point, Maze’s Privacy Policy and Terms of Service are applicable. Once users are redirected to your website as part of the test, your own policies come into effect.
• In-product prompts: For in-product prompts, the journey begins on your website, where your own respective policies apply. If the user is redirected to a Maze test at t.maze.co, or interacts with the Maze widget, then Maze’s policies become applicable.

What measures are in place to protect participants’ privacy when testing live websites?

Website testing happens on your actual live website. Interactions happen in the “real world”; Maze doesn’t create a dummy/test/staging environment for you.

You should therefore be mindful that you may be collecting personally-identifying information (PII) from your participants. For example, if you ask users to log in to their account as part of your test, the screenshots on your Results dashboard may include anything they’ve entered when logging in, as well as any data on their personal area.

To protect the privacy of your participants, Maze offers built-in screenshot anonymization options. Please be mindful that, if you enable Clips, the recording will show all information on the screen—Clips recordings aren’t anonymized.

Additionally, you can set up your own staging environment, and/or give users test credentials to avoid having them reveal their personal data.

If your mazes generally collect or capture personally identifiable information, either through questions, or by using Clips or live website testing, we also recommend you refer to this article: How to honor your GDPR obligations when testing with Maze