Cookie policy
Last updated: 2026-09-16
Which cookies does SAQ set?
SAQ sets only strictly necessary cookies. There are no analytics and no third-party cookies, so there is no consent banner. The public pages set no cookies at all; the ones below are set by the app when you log in, or while a single sign-on round trip is in progress.
| Name | Purpose | Lifetime |
|---|---|---|
saq.session_token | Keeps you logged in. | Up to 30 days, extended while you use SAQ, never beyond 90 days; 24 hours for magic-link logins |
saq.two_factor | Remembers that your password was accepted while you enter the second factor. | Minutes |
saq.passkey_challenge | Holds the one-time challenge during a passkey login or registration. | Minutes |
saq.sso_state | Ties a single sign-on round trip to this browser while the identity provider is visited. | 10 minutes |
saq.locale | Remembers your language choice. | 1 year |
saq.workspace | Remembers your last used workspace. | 1 year |
saq.theme | Remembers your light or dark theme choice. | 1 year |
How are forms protected without a CSRF cookie?
Requests that change something are accepted only from SAQ's own origin. The browser's Origin header is checked on every such request, so no separate token cookie is needed.