What cookies are

Cookies are small text files a website stores in your browser so it can recognise your device on later visits, for example to remember that you are signed in. Browsers also offer similar storage ("local storage") that stays on your device and is not sent to us.

How we use them

We use cookies only to sign you in, keep you signed in and protect your account. We do not use advertising cookies, analytics or tracking cookies, and we do not track you across other websites.

Cookies we set

Cookie	Purpose	Duration
sso-portal-session	Your signed-in session. Links your browser to your account and to the applications you open through single sign-on.	Up to 120 minutes without activity, or until you sign out
XSRF-TOKEN	Protects forms from cross-site request forgery.	Same as the session
device_session	Identifies this signed-in device, so you can see your devices and sign them out from your profile.	30 days, or until you sign out
otp_device_…	Only if you tick "Don't ask on this device" when entering a sign-in code: lets this browser skip the code.	24 hours
remember_web_…	Only if you tick "Remember me" when signing in: keeps you signed in between visits.	Up to 400 days, or until you sign out

All of these are strictly necessary for the Service to work. Except XSRF-TOKEN, which your browser's scripts must read to protect forms, they cannot be read by scripts on the page. Blocking them stops you signing in or staying signed in.

Storage on your device

• Local storage remembers small interface choices on this device only, such as which menu sections or folders you collapsed, the last settings tab you used, your org chart display options, and a short wait before you can resend a verification email. It is never sent to us, and clearing it only resets those choices. Your theme (light, dark or follow device) is saved with your account instead.
• Push notifications: if you turn on browser notifications, your browser installs a small background script (a service worker) from our site so notifications can reach you when no tab is open. You can turn notifications off in your profile or your browser settings at any time.

Third parties

• If you choose to sign in with Google or Microsoft, those providers may set their own cookies on their sites during sign-in, under their own cookie policies.
• Some page assets (styles, fonts, icons and scripts) and GIFs are loaded from content delivery networks and GIPHY. They receive your IP address and browser details, as with any web request, but we do not ask them to set cookies.

Managing cookies

Most browsers let you see, block or delete cookies in their settings. Because the cookies above are essential for signing in, blocking them will stop you signing in or staying signed in to the Service. Signing out removes your session; "Sign out everywhere" in your profile ends it on all your devices.

Changes to this Policy

We may update this Cookie Policy when the Service changes. Changes are shown by the "Last updated" date above.

Contact

If you have questions about this Cookie Policy, please contact your company administrator or the platform administrator.

See also: Terms of Service · Privacy Policy · Cookie Policy