Install Cortality in about ten minutes.

Cortality is a guided engagement, not self-serve. Every client gets a siteId, a submission key, and a dashboard login, provisioned by us at onboarding. If you don't have yours yet, email colton@cortality.com or reply to your Cortality contact; we typically provision the same day.

Paste this immediately before your page's closing </body> tag, using the siteId and submission key from your onboarding email:

<script src="https://cdn.cortality.com/c.js" async></script>
<script>
  window.addEventListener('load', function () {
    if (window.Cortality) {
      Cortality.init({
        siteId: 'op_yourcompany',
        secret: 'your-submission-key',  // publishable, submit-only — see note below
        endpoint: 'https://ingest.cortality.com/v1/sessions'  // stated explicitly so installs never depend on defaults
      });
    }
  });
</script>

If anything mangles the copy-paste, the two hostnames are cdn.cortality.com (script) and ingest.cortality.com (endpoint).

Prompt for AI site builders

If your site is built and edited through an AI tool, paste this to it, with your real values substituted:

Add Cortality analytics. In index.html, immediately before the closing
body tag, add exactly this, and do not wrap it in a React component,
useEffect, or any loader:

<script src="https://cdn.cortality.com/c.js" async></script>
<script>window.addEventListener('load',function(){if(window.Cortality){
Cortality.init({siteId:'YOUR_SITE_ID',secret:'YOUR_KEY',
endpoint:'https://ingest.cortality.com/v1/sessions'});}});</script>

Then add the attribute data-cortality-conversion to our primary
call-to-action button, passing it through to the real DOM element.
If index.html or hosting config sets a Content-Security-Policy, add
https://cdn.cortality.com to script-src. Do not modify the snippet
in any other way.

1. Open your site in a normal browser window.
2. Right-click → Inspect → Console.
3. Look for: [Cortality] session started

If the message doesn't appear

• A CSP error in the console mentioning cdn.cortality.com → see Content Security Policy.
• No error at all → the tag likely isn't in the served HTML. View source and search for cortality; if it's missing, the change didn't deploy.
• [Cortality] path not in allowedPaths → working as configured; you're on a route outside your allowlist.
• Anything else → email colton@cortality.com; we answer same-day and will get on a screen-share if needed.

Add one attribute to the element that counts as the win on your page: the form submit button, the booking button, the sign-up link.

<button data-cortality-conversion>Request a Demo</button>

In React and similar frameworks, make sure the attribute reaches the real DOM element. On a plain <button> it passes through automatically; on a custom component, the component must spread extra props onto its underlying element. On visual builders (Webflow, WordPress page builders), use the element's custom-attribute setting; if your builder doesn't expose one, tell us which button is the win and we'll suggest the cleanest alternative for your setup.

Single-page applications serve everything from one index.html, so a root-level tag would execute on every route, including logged-in product areas. If your app has authenticated routes, restrict collection to your public marketing routes with allowedPaths:

Cortality.init({
  siteId: 'op_yourcompany',
  secret: 'your-submission-key',
  endpoint: 'https://ingest.cortality.com/v1/sessions',
  allowedPaths: ['/', '/pricing', '/about', '/blog/*']
});

The behavior is fail-closed in both directions:

• Landing outside the list (a deep link into the app, a bookmark, a login page): the snippet initializes nothing. No session, no listeners, no collection.
• Navigating from a listed route into an unlisted one (marketing page → logged-in app): the snippet sends what it collected on the marketing page, then permanently stops all collection for the rest of that browser tab's life. It does not re-arm if the visitor returns to a marketing route.

How it detects navigation: the snippet monitors the browser's history API (pushState, replaceState, and back/forward), which is how SPA routers change routes without reloading, so client-side route changes are caught without any integration work in your router.

Matching rules: entries are pathnames. Exact entries match exactly (trailing slashes tolerated). A trailing * matches a whole section: '/blog/*' covers /blog and every post under it. Anything not listed is out of scope by default, so new product routes are excluded without you maintaining a blocklist.

Programmatic stop

Belt and suspenders for auth boundaries or consent controls: calling Cortality.disable() immediately and permanently stops collection for the tab and sends what the current page has collected. Call it from your sign-in handler if you want a hard guarantee independent of routing:

onLogin() {
  window.Cortality && Cortality.disable && Cortality.disable();
}

Mark any element with data-cortality-ignore and it is excluded from observation, along with everything inside it:

<div data-cortality-ignore>
  <!-- live chat widget -->
</div>

Use this for anything that renders visitor-entered or personalized content outside a form field. Automatic masking covers form input values everywhere, but content your page renders elsewhere, a live-chat transcript, a "welcome back" banner, a quote-calculator result, is page content and will be captured unless you exclude it. Chat widgets are the most common case; we check for them at onboarding, but new widgets added later are on you to mark. See the masking model for exactly what is and isn't covered automatically.

If your site sends a Content-Security-Policy header, two directives matter:

One subtlety: the capture module fetches your page's images to include them in page captures. If your images are served from a different origin (a CDN or image host), that origin needs to be in connect-src too, unless https: is already allowed. If you're not sure where your CSP is configured, it's usually your hosting config or server middleware; send us the header and we'll tell you the exact change.

Your dashboard lives at app.cortality.com. At onboarding we issue two credentials: an access code (your account identifier, like a username) and a password, scoped to your site(s). There's no self-signup, and no automated password recovery by design: if credentials are lost, email us from your registered address and we revoke the old login and reissue a new one, typically the same day. Sessions typically appear within about a minute of a visit ending. The dashboard shows your page section-by-section with attention scores, your conversion funnel, and the current recommendations; your written reports are built from the same data.

The short version: mouse, scroll, touch, and click behavior with page coordinates; periodic images of the page as the visitor's browser rendered it; a sanitized copy of the page's HTML; and basic session context. No cookies, no keystrokes, no form values, no cross-visit identification, no biometrics.

The complete, versioned statement, including the masking model and its limits, IP handling, retention schedules, subprocessors, and the deletion process, lives in the Trust Center. That page is the authoritative reference; this section is only a summary.

Delete the two script tags. That's the entire removal; no cookies were set, and nothing persists in visitors' browsers beyond the current visit's crash-protection buffer, which clears itself. To also delete collected data, see Retention & deletion.