Cookie policy.
Short version: this website sets no cookies of its own. Strictly necessary storage remembers your choice. Analytics is off until you turn it on, and you can turn it off again at any time.
01 · Summary
This policy covers securityvault.io, the marketing and documentation website of SecurityVault Systems Private Limited, and the browser storage used by the SecurityVault application at app.securityvault.io. It supplements our privacy notice.
- This website sets no HTTP cookies of its own and no advertising cookies.
- The first time you visit, a banner asks whether you allow Analytics. “Accept all” and “Reject all” are equally easy, and nothing optional runs until you choose.
- Analytics is off by default. If you turn it on, the site loads Cloudflare Web Analytics, which is cookieless (section 05).
- You can change or withdraw your choice at any time from Cookie settings in every page footer or in section 10 below.
- The application uses only strictly necessary cookies and functional storage, and no analytics (section 08).
02 · What cookies are
Cookies are small text files a website places on your device. Related technologies — local storage, session storage, pixels — serve similar purposes. India's Digital Personal Data Protection Act, 2023 (DPDP Act), the EU ePrivacy rules, the EU/UK GDPR and US state privacy laws (including the CCPA/CPRA) regulate how these technologies may be used, and distinguish what is strictly necessary for a service you request from everything else.
03 · Categories
| Category | Default | What it covers |
|---|---|---|
| Strictly necessary | Always on | Storage needed to run the site and the application securely and to remember your cookie choice. It cannot be switched off. |
| Analytics | Off | Cookieless page measurement with Cloudflare Web Analytics on securityvault.io, only after you turn it on. |
04 · What this site stores
The complete inventory of browser storage used by securityvault.io:
| Key | Type | Category | Purpose | Lifetime |
|---|---|---|---|---|
| sv-consent | Local storage | Strictly necessary | Records your cookie choice: whether Analytics is on, the version of this policy you chose against, and when you chose. If this policy changes, we ask again. | Until you change it or clear browser data |
The entry stays on your device, is never sent to us or anyone else, and contains no identifiers. Older entries named sv-cookie-ack or sv-theme are removed automatically.
05 · Analytics (optional)
Only if you turn on Analytics, this website loads Cloudflare Web Analytics from Cloudflare, Inc., our edge provider and a listed subprocessor. Until then the script is not loaded at all.
- What it collects: the address of the page you view, the referring page, your browser's user agent and page-load timings. Your IP address is processed by Cloudflare to deliver the measurement.
- What it does not do: it sets no cookies, does not use local storage, does not fingerprint your device, does not follow you across sites and is not used for advertising.
- Why: to see which pages are useful and keep the site fast. We see only aggregate reports.
- Turning it off: open Cookie settings and switch Analytics off. The page reloads without the script.
06 · Edge security
Cloudflare protects this site and the application against attacks and automated abuse. As part of that it may run a brief bot-detection check in your browser and may set its own strictly necessary security cookies (for example __cf_bm) when it needs to tell people from automated traffic. These are not used for analytics or advertising.
07 · What we do not use
- No advertising or cross-site tracking. No ad pixels, no remarketing tags, no social-media embeds.
- No cookie-based analytics. We do not run Google Analytics or any similar service.
- No third-party fonts or tag managers. Fonts, styles and our own scripts are self-hosted.
- No fingerprinting. We do not derive device fingerprints or probabilistic identifiers.
08 · Application storage
The SecurityVault application at app.securityvault.io runs no analytics or advertising code. It sets only the strictly necessary, first-party cookies below:
| Cookie | Purpose | Lifetime |
|---|---|---|
| refresh_token | Keeps you signed in. HttpOnly (not readable by page scripts), Secure, SameSite=Strict, sent only to the sign-in endpoints. | 7 days, or until you sign out |
| csrf_token | Protects session renewal against cross-site request forgery (double-submit check). Secure, SameSite=Strict; readable by the application so it can echo the value back. | 7 days, or until you sign out |
| sv_sso_<id> | Set only while you sign in with single sign-on; binds the sign-in attempt to your browser. HttpOnly, Secure. Deleted when sign-in completes. | 10 minutes at most |
| esos_auditor_session | Set only for external auditors using the auditor portal; holds the portal session. HttpOnly, Secure, SameSite=Lax, sent only to the auditor portal. | 4 hours, or until sign-out |
SecurityVault's internal administration consoles set their own strictly necessary session cookies; they are not set when customers use the application.
The application also keeps these functional entries in your browser. They stay on your device and are not used for tracking; sign-in credentials are never kept in browser storage.
| Key | Type | Purpose |
|---|---|---|
| sv-consent | Local storage | Your cookie-notice choice, with policy version and time |
| organizationId | Local storage | The organisation you last selected |
| themeMode | Local storage | Light or dark appearance |
| sv-locale | Local storage | Interface language |
| notificationPreferences | Local storage | Notification settings saved on this device |
| sv.persona.<org>, sv.workspace.override.<org>.<persona> | Local storage | Your workspace view for each organisation |
| sv-favorites-v2:<org>, sv-sidebar-favorites-collapsed, sv-sidebar-collapsed-v4 | Local storage | Favourites and sidebar layout |
| sv-tour-dismissed-<tour>, sv-announcement-dismissed, sv-changelog-last-seen | Local storage | Tours, announcements and release notes you have dismissed or read |
| sv:resume-history:v1, sv:logout_warning, sv-changelog-auto-modal-shown-session, sv:preload-error-reloaded | Session storage | Recently visited pages, sign-out notices and one-time reload guards for this tab; cleared when the tab closes |
09 · Legal basis
Strictly necessary storage — including the record of your cookie choice and the application's sign-in cookies — is needed to provide the service you asked for and does not require consent under the EU ePrivacy rules. Analytics runs only on your consent: under section 6 of the DPDP Act (and the GDPR, where it applies), your consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. Refusing or withdrawing it never affects how the site works for you.
10 · Cookie settings
- Change or withdraw — use the button above or Cookie settings in any page footer. Your new choice applies immediately.
- Clearing storage — deleting site data for securityvault.io removes your choice; you will be asked again on your next visit, and Analytics stays off until you answer.
- Global Privacy Control — we do not sell or share personal information. If your browser sends a GPC signal, Analytics stays off unless you turn it on yourself. See Your privacy choices.
11 · Changes
If we change what this site stores, we update the inventory and the version above before the change ships, and ask for your choice again where it affects optional categories. Material changes are announced on the changelog.
12 · Contact
Questions about this policy: privacy@securityvault.io. Our Privacy & Grievance Team's contact details are in the privacy notice.