Legal · SecureByte
Cookie Policy
What cookies the SecureByte service sets, why each one is needed, and how to control them. We deliberately do not use advertising or cross-site tracking cookies.
Draft — pending counsel review. This document is a working template published in good faith during the SecureByte beta. It is not a substitute for independent legal advice and is subject to change. For procurement-grade documents, request the executed copy via legal@securebyte.co.za.
01Overview
A “cookie” is a small text file stored in your browser by a website. This policy lists every cookie SecureByte sets, the purpose of each cookie, and the lifetime of each cookie. We update this document whenever the platform’s cookie set changes.
This Cookie Policy is issued by SecureByte Consulting (Pty) Ltd (“SecureByte”). SecureByte uses only the cookies required to run the application securely, plus optional first-party telemetry cookies that help us keep the product reliable. We do not set advertising cookies. We do not set cross-site tracking cookies. We do not embed third-party advertising or social-media trackers.
02Strictly necessary cookies
These cookies are required for the SecureByte application to operate. They are set the first time you authenticate, and they cannot be disabled without making the application unusable. All are first-party cookies set on the SecureByte application domain.
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
| access_token | Holds your signed access token after you sign in. Required to make authenticated API calls and to gate access to the dashboard. | HttpOnly, Secure, SameSite=Lax | 15 minutes |
| refresh_token | Lets the application transparently rotate your access token so you stay signed in without re-authenticating. Single-use and rotated, with theft detection. Scoped to the authentication path (/api/auth). | HttpOnly, Secure, SameSite=Lax | 7 days (30 days with “remember me”) |
| _csrf | Double-submit anti-CSRF token used to verify that mutating requests originated from the SecureByte web app and not from a malicious site. Readable by the app (it is echoed back in a request header), so it is intentionally not HttpOnly. | Secure, SameSite=Lax (readable by the app) | 24 hours |
| sb_auditor_session | Signed, stateless session for external auditors who access a time-boxed auditor portal. Only set for invited auditor users, never for regular customer accounts. | HttpOnly, Secure, SameSite=Lax | Tied to the auditor invite (capped at 30 days) |
Cookie flags reflect the standard production configuration. In hardened deployments the SameSite attribute may be set to Strict, and all cookies are always marked Secure over HTTPS.
03Product & performance telemetry
To keep the application fast and reliable, SecureByte uses operational monitoring. When browser monitoring is enabled, the Datadog Real User Monitoring (RUM) SDK runs in the application and sets a first-party session cookie to stitch together the events of a single browsing session.
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
| _dd_s | Datadog RUM session identifier used to correlate performance metrics, errors, and a sampled session replay (about one in five sessions) for the in-app experience. Set only when browser monitoring is configured for your deployment. | First-party, Secure | Session (refreshes while you are active) |
This telemetry is privacy-protective by design: form fields are masked by default, so passwords, one-time codes, and billing inputs never leave your browser, and URLs and error messages are scrubbed of tokens and other sensitive values before transmission. We also run server-side error and performance monitoring (Sentry and Datadog) that relies on request and trace identifiers rather than browser cookies. The processors involved are listed on our sub-processors page.
04No advertising or third-party tracking
SecureByte does not embed advertising networks, retargeting pixels, social-media widgets, or cross-site analytics on the application or the marketing site. We deliberately exclude this entire category of cookies because it is incompatible with the compliance posture we ask our customers to trust. We do not sell or share cookie-derived data with advertisers.
05Third-party (payment) cookies
When you start a subscription payment, you are redirected to PayFast, our payment gateway. PayFast may set its own cookies on its checkout domain to operate the payment securely. Those cookies are controlled by PayFast under its own privacy and cookie policy, not by SecureByte. SecureByte does not set any payment cookie of its own, and no card data passes through SecureByte.
06Managing cookies
Because every cookie SecureByte sets is either strictly necessary for the application or a first-party operational telemetry cookie, there is no advertising opt-out to configure. If you wish to remove the cookies, the simplest path is to:
- Sign out — this clears the authentication and CSRF cookies immediately.
- Clear your browser’s site data for SecureByte — every modern browser exposes a per-site “Clear cookies” control.
Blocking the strictly necessary cookies via your browser settings will prevent you from signing in or making mutating API calls.
07Changes to this policy
We will update this policy whenever the platform’s cookie set changes. Material changes will be announced via the in-app changelog and via email to the primary contact on your Subscription. The version label at the top of this page identifies the current revision.
08Contact
Questions about this policy or about the cookies you observe in your browser? Reach the SecureByte privacy team at privacy@securebyte.co.za.