Cookies and similar technologies are small files or identifiers stored on your device. They help websites remember preferences, support secure sessions, measure usage, and improve reliability across our public site and authenticated platform.

We group cookies and similar technologies into the following categories:

Essential cookies

Required for authentication, secure sessions, and CSRF protection. These cannot be disabled if you want to use the platform. They are set by SecurityScore.me itself:

• Session cookie (next-auth.session-token): keeps you signed in; expires after 7 days.
• CSRF and sign-in redirect cookies (next-auth.csrf-token, next-auth.callback-url): protect the sign-in form; removed when you close the browser.
• Active organization (ss_active_org): remembers which organization workspace you selected; 90 days.
• Demo preview (ss_demo_preview): only set when you open the demo workspace; 4 hours.

Analytics cookies

Used to understand page usage, improve public pages, and measure performance. Google Analytics, Vercel Analytics and Vercel Speed Insights are only loaded after you accept analytics in our cookie banner. Google Analytics then sets its own cookies (such as _ga).

Preference cookies

Your cookie choice is stored in your browser's local storage (not a cookie), so the banner does not appear again.

Security and abuse-prevention technologies

Google reCAPTCHA is used on the sign-up, contact and pricing forms to prevent abuse. It is required on those forms, may set Google cookies, and is not loaded on other pages.

Some technologies are set by service providers that help us operate SecurityScore.me. Providers may process data under their own privacy policies. With your consent where required, this may include:

• Supabase — authentication and session management for accounts and organization workspaces.
• Vercel — hosting, infrastructure, and (with your consent) aggregated usage analytics.
• Vercel Speed Insights — performance measurement to help us improve page load reliability.
• Google Analytics — aggregated website analytics when you consent to analytics cookies.
• Google reCAPTCHA — abuse prevention on the sign-up, contact and pricing forms.
• Microsoft — sign-in and connection flows when you connect a Microsoft 365 tenant.

We do not use advertising or social-media tracking cookies on the MSP platform. For broader data handling, see our Privacy Policy.

You can control cookies through our consent banner and through your browser settings. You may delete cookies, block all cookies, or block cookies from specific sites.

Blocking essential cookies may prevent login, organization workspace access, or other core platform functionality from working correctly.

We may update this Cookie Policy as the product, providers, or legal requirements change. The updated version will be posted on this page with a revised last-updated date.

Questions about this Cookie Policy: info@securityscore.me