Cookies
Cookie policy
Every cookie this site sets, what each one is for, and why you are not asked to consent to any of them.
- Effective date
- Last reviewed
1What this covers
Cookies and similar technologies used by this site. CertaSafe itself uses cookies only, and no local storage or session storage. The one thing the site embeds is the payment form of Stripe, CertaSafe's payment processor, on the review page where you pay, and what Stripe sets there is listed below.
Browsing this site sets no cookie at all. A cookie is set only when you start building an order, sign in, or open the payment form on the review page, and each one exists to make that specific thing work.
2Categories in use
Strictly necessary. Every cookie on this site is in this category. CertaSafe's keep you signed in and keep the order you are building attached to your browser. The payment processor's, set only on the review page, let it detect fraud on the payment you are making. Without them you cannot sign in, place an order, or pay, so no consent is required for them and there is nothing to switch off.
Functional. None. CertaSafe sets no preference or convenience cookie.
Measurement. None. This site runs no analytics, tag manager, session recorder, or heat map, and sets no measurement cookie.
Advertising. None. There is no advertising on this site, no advertising network embedded in it, and no advertising cookie is set.
3The cookies this site sets
| Name | Category | Purpose | Set by | Expires |
|---|---|---|---|---|
| cs_draft_token | Strictly necessary | Keeps the order you are building attached to your browser before you have an account. It holds a random token and nothing about you. | CertaSafe | 14 days after you last touch the draft |
| sb-<project>-auth-token | Strictly necessary | Your signed-in session. When the value is long it is split across numbered parts ending .0 and .1, which are the same cookie. | CertaSafe, through its authentication library | Up to 400 days, and cleared immediately when you sign out |
The middle part of the session cookie's name identifies CertaSafe's authentication project. Both cookies are set by this site on this domain. Neither is readable by anyone else.
| Name | Category | Purpose | Set by | Expires |
|---|---|---|---|---|
| __stripe_mid | Strictly necessary | Fraud prevention for the payment you are making. Set on this site's domain by Stripe's script, and readable by that script. | Stripe, CertaSafe's payment processor | One year |
| __stripe_sid | Strictly necessary | Fraud prevention for the payment you are making, for one visit to the payment form. Set on this site's domain by Stripe's script, and readable by that script. | Stripe, CertaSafe's payment processor | 30 minutes |
| m | Strictly necessary | Fraud prevention. Set on Stripe's own domain, m.stripe.com, by Stripe's payment form. | Stripe, CertaSafe's payment processor | 400 days |
| __cf_bm | Strictly necessary | Telling people from automated traffic. Set on hcaptcha.com, a bot protection service that Stripe's payment form uses. | hCaptcha's bot protection, reached by Stripe's payment form | 30 minutes |
Stripe's payment form also keeps a few values in session storage inside its own fraud prevention frame, on Stripe's domain m.stripe.network, which the browser clears when the tab closes. Nothing is kept in local or session storage on this site's own domain. No page other than the review page loads anything from Stripe, so none of these is set anywhere else on the site.
4Consent
You are not asked for cookie consent, and no cookie banner is shown, because there is nothing to consent to. Consent is required for cookies that are not strictly necessary, and none is set on this site: the payment processor's cookies are set only on the page where you pay, and only to protect that payment.
If CertaSafe ever adds a cookie outside the strictly necessary category, it will ask before setting it, refusing will be as easy as agreeing, and this policy will list the cookie before it appears.
5Vendors
Stripe, CertaSafe's payment processor. Its script and payment form run on the review page and on no other page, and set the cookies listed above for fraud prevention on the payment you are making; the form also reaches hCaptcha's bot protection, which sets the one cookie listed for it. Stripe's own privacy policy governs what Stripe collects. No other third party sets or reads a cookie on this site, and no other third party script runs on any page of it.
7Changes
The current version and its effective date are always published here. A change to the inventory is published and dated when the cookie changes, not at the next review.
8Contact
Cookie questions. support@certasafelabs.com, telephone 707-731-9296, 8 to 5 daily.
This version took effect on 28 September 2026. When a policy changes, the new version publishes here with its own effective date, and the version it replaced stays identifiable.