Co-Browse runs in the browser, off the one Velaro snippet your site already has. Visitors install nothing. You add nothing. The agent requests it from the chat, the visitor clicks Allow, and the agent watches the real page update live.
The agent asks from inside the active conversation. The visitor decides. Sharing is live relay only, and it stops the moment either side ends it.
From a live conversation, the agent clicks Request Co-browse. The visitor sees an Allow or Decline prompt in the chat widget. Requests older than 3 minutes are dropped.
One click. No download, no extension, no screen-share permission dialog. There is no always-allow setting, so every session asks again. Nothing is captured before Allow.
The agent sees the visitor's real page, not just the chat widget: their fonts, charts, mouse movement and clicks, updated in under a second. A bar stays on the visitor's screen while sharing is on, and they can stop it any time.
Most co-browse tools need a visitor download or a second script on your site. Velaro's runs from the same widget embed that powers your chat, so turning it on is a seat assignment, not a deployment.
No app, plugin, extension or screen-share permission. Co-Browse covers only the browser tab that has the Velaro widget. It can't see other tabs, other apps, the operating system, cookies, localStorage or network traffic.
You add nothing beyond the Velaro widget embed your site already has. Every existing Velaro widget picks it up when you buy seats.
The visitor's browser streams page changes as they happen. The agent sees custom fonts, canvas charts and the visitor's pointer, with sub-second updates.
Velaro runs the engine itself. No outside co-browse service, no third-party CDN, and no new sub-processor added to your list.
On Pro the agent watches. On Plus the agent can also point at things and suggest a value for a field. Agents can never click, navigate or run anything on the visitor's page, and the visitor does all the acting.
Same inbox, same thread, same agent. No separate tool to log into and no session link to send.
Visitors sharing their screen shouldn't expose passwords, PII, or internal data they didn't intend to share. Velaro gives site owners three levels of control, applied before any data leaves the visitor's browser.
Add sensitive to any element and its text content is replaced with placeholder characters before it's streamed to the agent. The element's position and size are still visible — useful for input fields and account numbers.
Add no-record to completely remove an element from the recording stream. The agent sees a blank region in its place. Ideal for sensitive panels, payment iframes, or anything that should never leave the browser.
Add ignore-record to include an element in the initial snapshot but suppress any future changes to it. Useful for live data feeds or counters that would otherwise flood the event stream.
Sharing never starts without the visitor clicking Allow. Requests older than 3 minutes are automatically discarded so a stale consent prompt doesn't appear if the visitor navigates away and back. The visitor can stop sharing at any time from their own UI.
Every Co-Browse plan includes automatic pattern-based redaction of card numbers and SSNs from the visible page before they're streamed. Co-Browse Plus widens that net to also redact email addresses and phone numbers — useful when agents routinely see contact details on screen, not just payment fields.
On every plan the visitor has Pause, Resume and Stop buttons in the chat widget. While paused, nothing at all is captured. Stop ends the session and closes the agent's view. These controls can't be switched off.
Pages such as checkout, payment, billing, account, login and password are protected by default. When the visitor lands on one, capture stops, the agent sees "Visitor is on a protected page", and sharing resumes when they leave. You can edit the list.
Consent, masking, who has a seat, how much it's used and what gets logged are all in your hands, not the agent's and not a vendor's.
Allow or Decline on every request. No always-allow. The visitor can end a session from their own screen and the agent's view closes.
Every form input is masked, always. Card numbers (Luhn-checked) and US Social Security numbers are scrubbed from page text inside the visitor's browser. Tag your own sensitive areas with sensitive, no-record or ignore-record. Other personal data shown as plain text, like names or addresses, should be tagged by your team.
Only the agent assigned to that conversation can open the view, enforced on the server. Sites are isolated from each other. If the page origin can't be validated, Co-Browse refuses to start.
Buy N seats and assign them to specific agents or to everyone. An agent without a seat can't start a session. The check runs on the server.
A monthly session counter sits on your account usage page. Set an optional monthly session cap per site if you want a ceiling.
Each start, accept and stop is logged in the conversation thread. A durable session record keeps who ran it, when, for how long and the outcome. The page content itself is never stored.
The view is a live relay between two open browsers. There is no replay archive, so there is nothing to retain, produce or delete afterward. Consent is per session, which supports GDPR-style consent requirements.
Every form input is already masked and card and Social Security numbers are already redacted. For anything else on your pages, such as account numbers, names, addresses or health details, add one of these classes to the element. It's a plain CSS class on your own page. There is nothing to install and the Velaro snippet doesn't change.
sensitiveThe text is shown to the agent as stars. The agent still sees where it sits on the page. Use it for account numbers, names, balances or addresses inside an otherwise useful page.
<p>Account: <span class="sensitive">8841-22-9017</span> </p>
no-recordThe element is blanked. The agent sees an empty box and nothing inside it is ever sent. Use it for payment forms, ID uploads, medical panels or anything that should never leave the browser. data-no-record works too.
<div class="no-record" id="payment-form"> ... </div> <section data-no-record>...</section>
ignore-recordThe element shows as it was when sharing started, but later changes to it are not sent. Use it for live tickers, counters and animated feeds that would only add noise. It is not a privacy control, so use sensitive or no-record for private content.
<div class="ignore-record"> Live price ticker </div>
Fields inside sensitive and no-record areas can never be filled by an agent suggestion either. Want everything masked? Turn on strict mask mode in Admin > Co-Browse and all text is masked and images are hidden, so the agent sees layout only.
The agent never controls the visitor's page. Everything that reaches the page is either a drawing the visitor can't interact with, or one value the visitor reads and approves.
| Question | Answer | Plan |
|---|---|---|
| See the visitor's live page | Yes. Only after the visitor clicks Allow, every session. It follows the visitor from page to page on your site without asking again. | Pro and Plus |
| See what the visitor types into forms | Never. Every input is masked. The agent never sees real input values. | All |
| Point, highlight or annotate on the visitor's page | Yes. Drawn on the visitor's real page. The visitor sees an "agent is pointing" notice and the drawing can't be clicked. | Plus (on by default, can be switched off) |
| Suggest a value for a form field | Yes, with approval. The visitor sees the field name and the full value, and must approve each fill. Requests expire after 60 seconds. Off until you switch it on. | Plus (off by default) |
| Fill password, card, one-time-code, hidden, disabled, read-only or file fields | Never. These are blocked outright, as is anything inside a tagged area. | All |
| Click, scroll, navigate or run anything on the visitor's page | Never. There is no control channel and none is planned. | All |
| Keep a recording of the session | Never. The view is a live relay. The session history lists who ran it, when, for how long and the outcome. It holds no page content. | All |
| Visitor pauses or stops | Any time. Pause, Resume and Stop are always on and can't be disabled. | All |
Screen share is a separate feature. If the visitor chooses to share their screen as video, that is their own browser's screen-share prompt and is not Co-Browse.
What your plan includes and what you switch on are separate. On and off settings can follow the Velaro default, or be forced On or Off. Your admins can change them in Admin > Co-Browse, and Moshky can change them for you. Every change is logged.
Masks all text and hides images and media. The agent sees layout only. Off by default.
Capture pauses on pages that match your list, and the agent sees "Visitor is on a protected page". Defaults to checkout, payment, billing, account, login, sign-in, password and secure paths.
Don't offer Co-Browse to visitors on phones and narrow screens. Off by default.
Sessions end automatically after 120 minutes (set 5 to 240), or after 15 minutes of inactivity (set 2 to 60).
Change the consent title, message and Allow button text to match your brand and legal wording. Plain text only.
Limit Co-Browse to certain teams or roles. Administrators are never locked out.
Pointing is on by default for Plus sites. Guided form fill is off until you turn it on. The visitor still approves every single fill.
See who ran each session, when, how long it lasted and how it ended. No screen content is ever stored.
Co-Browse is sold as a per-agent-seat add-on on Starter and above, on top of your Velaro plan. Buy the seats you need and assign them to specific agents, or turn it on for your whole team. Enterprise plans include Co-Browse for every agent at no extra cost.
A view-only live replay of the visitor's page, built into the chat widget, with consent every session and the full privacy masking toolkit.
Everything in Pro, plus agent pointing on the visitor's page, visitor-approved guided form fill, and a wider automatic-redaction net.
When a visitor says "it's not working" — seeing exactly what they see cuts resolution time faster than any transcript.
Visitors abandon carts because something looked broken or confusing. Co-browse lets agents see the exact state of the page — discount applied wrong, shipping option not loading, payment field not accepting input — and walk the visitor through it in real time.
Complex applications, enrollments, and onboarding flows produce support contacts when visitors get confused mid-form. Agents can see where they are, what's filled in, and guide them step by step. On Plus the agent can point at the next field or suggest a value, and the visitor approves every fill. Sensitive fields are masked automatically.
When a customer says their balance looks wrong or a transaction isn't showing, the agent can see the same account view — with SSNs and card numbers automatically redacted, and account-number panels tagged no-record so they never leave the browser at all.
For software products, understanding a bug report requires seeing the exact state of the UI when it failed. Co-browse streams canvas-based charts, dynamic data panels, and live application states accurately — not a blurry screenshot.
Co-Browse is a per-seat add-on starting at $29/agent/mo, available on Starter and above. Start a free trial and run your first co-browse session today. No extensions, no third-party tools, no extra setup.