Cookie & Local Storage Policy
Last Updated: October 22, 2026
1. How We Use Cookies
NoctisID minimizes cookie usage. We only use strictly necessary security and session cookies to facilitate the authentication handshake and protect users against Cross-Site Request Forgery (CSRF).
2. Cookies We Set
| Cookie Name | Purpose | Duration | SameSite Policy |
|---|---|---|---|
| __Host-auth_state | Anti-CSRF state token matching upstream OAuth response | 10 Minutes | Lax / Secure |
| ua_session | Encrypted JWT session for portal access | 14 Days | Strict / Secure |
| ua_act_as | Admin Impersonation tracking token | 1 Hour | Strict / Secure |
3. No Third-Party Advertising Cookies
We do not deploy marketing, retargeting, or advertising tracking cookies. The tokens generated by our platform exist purely to authorize access to your specified downstream spoke sites.