Cookies
Last updated: 28 October 2026
What this site uses
This page lists every cookie and similar browser storage item that the Vortalis website and dashboard set or load. We do not currently use analytics cookies or advertising cookies, and the site loads no analytics, advertising or tag-manager code. Everything below is either strictly necessary to provide the service or a preference stored when you choose it.
If we add an optional tool in future, we will ask for your consent before it sets anything or runs, and we will update this page first. See the Privacy Policy (section 8) for how this fits with how we handle personal data.
You can review your choices at any time:
Cookies and storage items
| Name | Type | Purpose | Set by | Category | Lifetime | Where it appears |
|---|---|---|---|---|---|---|
next-auth.session-token__Secure-next-auth.session-token on HTTPS; may be split into numbered chunks | Cookie | Keeps you signed in to the dashboard. Holds an encrypted sign-in token. HttpOnly, SameSite Lax. | NextAuth (library inside our own application) First party | Strictly necessary | Expires 24 hours after it was last refreshed (session maxAge of 24 hours in src/lib/auth.ts). The application also treats a sign-in as expired 12 hours after it was issued. | Set only after you sign in. Sent on dashboard and API requests. |
next-auth.csrf-token__Host-next-auth.csrf-token on HTTPS | Cookie | Protects the sign-in form against cross-site request forgery. Holds a random value and its hash. HttpOnly, SameSite Lax. | NextAuth (library inside our own application) First party | Strictly necessary | Session cookie (no expiry set; the browser normally removes it when it closes). Read from the library source and observed on a local production build, not on the live site. | Set by the authentication routes. Because every page checks for a session, this can be set on your first page view, signed in or not. |
next-auth.callback-url__Secure-next-auth.callback-url on HTTPS | Cookie | Remembers the page to return to after signing in. HttpOnly, SameSite Lax. | NextAuth (library inside our own application) First party | Strictly necessary | Session cookie (no expiry set; the browser normally removes it when it closes). Read from the library source and observed on a local production build, not on the live site. | Set by the authentication routes, on the same pages as the CSRF cookie. |
nextauth.message | localStorage | Lets open tabs tell each other that the sign-in state was checked, so they stay in step. Holds an event name and a timestamp, no personal data. We classify it as strictly necessary; this is our own classification and has not yet been reviewed by counsel. | NextAuth session provider (library inside our own application) First party | Strictly necessary | No expiry. Overwritten each time the session is checked; stays until you clear site data. | Every page, because the session provider is mounted in the root layout. |
Cloudflare Turnstile (challenges.cloudflare.com) | Cookie | Anti-abuse check on the sign-up, readiness scan and free-scan forms, to tell people from automated traffic. Cloudflare serves the script and widget. We classify it as strictly necessary; this is our own classification and has not yet been reviewed by counsel. | Cloudflare, Inc. Third party | Strictly necessary | Not verified. Cookie or storage names and lifetimes are set by Cloudflare and cannot be read from our code; see Cloudflare's Turnstile documentation. | Only /signup, /scan and /discovery/free-scan, and only when the site is configured with a Turnstile key. |
vortalis_viewer_role | localStorage | Remembers the role you chose on the home page so the page text matches it. | Vortalis website (RoleSelector) First party | Functional | No expiry. Written when you pick a role; removed when you pick it again to deselect; otherwise stays until you clear site data. | Home page. Written only when you choose a role. |
vortalis_investor_gate_accepted_v1 | sessionStorage | Remembers that you accepted the investor eligibility statement during this visit. | Vortalis website (InvestorEligibilityGate) First party | Functional | Cleared when the tab or browser session ends. | Investors page. Written only when you accept the statement. |
vortalis_onboarding_dismissed | localStorage | Remembers that you dismissed the dashboard onboarding wizard. | Vortalis dashboard (OnboardingWizard) First party | Functional | No expiry. Stays until you clear site data or reset it from the dashboard help page. | Dashboard (signed-in users). Written only when you dismiss it. |
vortalis_setup_checklist_dismissed | localStorage | Remembers that you dismissed the dashboard setup checklist. | Vortalis dashboard (SetupChecklist) First party | Functional | No expiry. Stays until you clear site data. | Dashboard (signed-in users). Written only when you dismiss it. |
Dashboard guidance banner flags (nine keys)instructions-guidance, vortalis_policy_documents_guidance, vortalis_anomalies_guidance, vortalis_custom_connector_guidance, vortalis_agents_guidance, vortalis_policy_editor_guidance, vortalis_services_guidance, vortalis_policies_guidance, vortalis_authority_guidance | localStorage | Each remembers that you dismissed the guidance banner on one dashboard page. | Vortalis dashboard (GuidanceBanner) First party | Functional | No expiry. Stays until you clear site data. | The matching dashboard page (signed-in users). Written only when you dismiss a banner. |
vortalis_cookie_consent | localStorage | Remembers that you have seen the cookie notice and your choices for optional cookies, with a version number and the time you chose. It exists only to honour your choice; we treat it as exempt storage, a classification still to be reviewed by counsel. | Vortalis website (cookie notice and settings) First party | Strictly necessary | No expiry. Stays until you clear site data. We ask again if the consent version changes. | Written when you dismiss the notice or save a choice in Cookie settings. |
Categories
- Strictly necessary: items we classify as needed to provide a service you ask for, such as signing in or protecting a form from abuse. We treat these as not depending on consent; this is our own classification and has not yet been reviewed by counsel.
- Functional: a preference or dismissal stored in your browser only when you choose or dismiss something.
- Analytics and marketing: none in use today. Both are denied by default, and we would ask before using either.
What we have not been able to verify
- The names and lifetimes of anything Cloudflare Turnstile stores. Those are set by Cloudflare and cannot be read from our code.
- Whether Turnstile loads on the live site (the site's content-security-policy may block it).
- Error monitoring (Sentry) may receive technical error reports from the site; it sets no cookies in our configuration and is not used for analytics. Whether it is enabled in production is not verified.
- Cookies that a hosting or network provider in front of the site may set for security or load balancing. Our application code sets none of these, but we have not inspected every response from the live deployment.
- Lifetimes marked as read from library source are taken from the NextAuth code we ship. The sign-in security cookies were also observed on a local production build, not on the live site.
This page describes what the site does. It is not legal advice.
Contact
Questions about cookies or your data can go to hello@vortalis.ai.