Every cookie this software sets, and what each one is for
Reading these pages sets none of them. Each of the six arrives when you do something that needs it — sign in, prove a second factor, collapse the side rail — and each is named below with what it holds and how long it lasts.
The six, by name
Three of the lifetimes below are a setting rather than a number, because an organisation chooses them. Those three say so in the table, rather than printing one firm's figure as though it were everybody's.
| Cookie | What it holds | How long it lasts |
|---|---|---|
| sb-…-auth-token | Your signed-in session | Until you sign out, or the session expires |
| bb_entry | Which sign-in code was sent, so the next screen can check the one you type | The life of that one code, in minutes |
| passkey_challenge | A single use challenge, while a passkey is being registered or used | Seconds — it is cleared the moment the passkey answers |
| trusted_device | That this device already proved a second factor | As many days as the organisation's security settings allow |
| tenant_view | Which organisation you asked to view, on a deployment that hosts several | Until you leave that view |
| backbone-rail | Whether you collapsed the side rail | A year, and clearing it only restores the wide rail |
Three kinds of cookie this software does without
Each of these is normal on a software marketing site. The list above is the whole of what we set, which is why we can print it.
No page-view tracker, no session recorder, no heat map. We learn what this site does from the demo requests it produces, which somebody chose to send us.
Nothing on these pages reports your visit to an advertising network, so visiting them changes nothing about what follows you around afterwards.
The pictures, the fonts and the scripts are served from this deployment. A font loaded from somebody else's server is a request to them carrying your address.
Clear them, block them, and what each one costs you
There is no banner on this site, because a banner asks permission for tracking and there is none to ask about. What there is instead is this.
- Read the pages
Browse the whole of this site with cookies blocked and nothing changes. Nothing here sets one.
- Sign in
The session cookie is the sign-in. Blocking it means the software cannot tell one request from the next, and every screen asks you to sign in again.
- Keep the convenience, drop the rest
Clearing trusted_device means proving a second factor again on this device. Clearing backbone-rail restores the wide side rail. Neither loses any work.
- Clear them from the browser
Every browser clears cookies for one site from its own settings, and this site honours that without a fight — there is nothing here that writes itself back.
See what else is held, and for how long
The privacy page covers the records themselves. This page covers only what your browser keeps.