Cookie policy

Last updated: 5 October 2026

This page describes the cookies, browser storage, and similar technologies used by the Fiducio website and application operated by Fiducio Cyber Ltd. It matches the technologies in the current application. It is not a generic list of every technology a website might use.

Fiducio does not currently deploy advertising or remarketing tracking. There is no advertising tag, conversion event, or marketing-consent category in use.

How to choose

On your first visit, a banner offers Accept all, Reject all, and Manage preferences. Those actions are equally available. Optional analytics and diagnostics stay off until you opt in. Continuing to browse does not count as consent.

You can change or withdraw a choice at any time with Cookie settings in the site footer, in the legal links on this page, or in the platform header after you sign in. If analytics was already on, turning it off saves the new choice and refreshes the page so optional browser analytics and diagnostics do not run. A first rejection does not refresh the page. Necessary sign-in and security storage keeps working.

A saved choice is stored only in your browser under the name fiducio_cookie_consent. It records a schema version, the category choices, and the time of the choice. It does not store your name, email, or account id. It is kept for about 6 months and is then treated as expired, so you are asked again. If the meaning of the choice changes, the schema version changes and you are asked again as well. This lifetime is Fiducio's own limit. It is not a period set by the ICO.

Consent preference

Provider: Fiducio (first-party browser storage)
Purpose: Remember whether you accepted or rejected optional analytics and diagnostics.
Category: Necessary, because it stores the choice itself.
Duration: About 6 months, or until you clear site data or the schema version changes.
Consent required: No separate opt-in. The record is written when you use the banner or Cookie settings.

Supabase authentication

Provider: Supabase, first-party cookies set by Fiducio for the auth session
Purpose: Keep you signed in and complete the sign-in flow you request, including the code verifier used during sign-in.
Category: Necessary
Duration: The lifetime of the Supabase auth session. This application sets SameSite=Lax, and Secure when the site is in production. It does not hard-code the cookie name or a separate expiry. The name is chosen by the Supabase browser client from the project URL.
Consent required: No. These cookies are part of the sign-in service you request.

Operator admin session

Provider: Fiducio, first-party cookie fiducio_admin_session
Purpose: Keep an operator signed in to the internal admin tool after they authenticate.
Category: Necessary
Duration: 7 days. The cookie is HttpOnly, SameSite=Lax, and Secure in production.
Consent required: No. It is set only after an operator signs in to that tool.

Quote handoff

Provider: Fiducio, first-party sessionStorage key fiducio_quote_token
Purpose: Carry a quote you just requested into account creation in the same browser tab.
Category: Necessary for that quote flow
Duration: Until the tab closes, or until account creation reads and removes it. No expiry is stored inside the value.
Consent required: No. It is written only after you request a quote.

Account-closure request id

Provider: Fiducio, first-party sessionStorage key fiducio_offboarding_client_request_id
Purpose: Give one account-closure attempt a stable id so a repeat click in the same tab does not start a second request.
Category: Necessary for that closure flow
Duration: Until the tab closes or the request finishes and the key is removed.
Consent required: No. It is written only when you start account closure.

Legacy demo data in the browser

Provider: Fiducio, first-party localStorage
Purpose: A small set of older admin and forwarded-check screens keep demo records in the browser. Customer payment-risk data is stored on the server, not in these keys.
Category: Necessary only for those screens, and only after you open them
Duration: Until you clear site data. The application does not set an expiry.
Consent required: Not used on the public marketing pages, and not used for analytics.

Microsoft 365 and Xero connection

Provider: Fiducio server record, plus Microsoft or Xero when you continue to their site
Purpose: Bind an OAuth consent screen to the signed-in organisation. The state value is stored as a hash in Fiducio's database for 10 minutes. It is not stored in a Fiducio browser cookie.
Category: Necessary for the connection you start
Duration: 10 minutes for Fiducio's server record. Microsoft and Xero may set their own cookies on their sites during the consent screen. Those names and lifetimes are controlled by those providers and are not set by this application.
Consent required: No Fiducio cookie. You start the connection yourself.

Stripe checkout

Provider: Stripe, on Stripe's website
Purpose: Take payment when you choose to subscribe. Fiducio redirects you to Stripe Checkout. This application does not load Stripe.js on its own pages.
Category: Necessary for the payment you start, on Stripe's site
Duration: Stripe controls any cookies on its own domain. This policy does not list Stripe cookie names or lifetimes, because they are not set by Fiducio code.
Consent required: The redirect happens when you choose to pay. Stripe is not loaded before that.

Vercel Web Analytics

Provider: Vercel, loaded in the Fiducio site
Purpose: Aggregated page-visit measurement. Vercel describes this product as cookieless and as using anonymised or aggregated traffic data rather than a persistent cross-site identifier. Fiducio still waits for opt-in before loading it.
Category: Analytics and diagnostics
Duration: No Fiducio cookie is configured for it. It does not load until you opt in. Turning analytics off saves that choice and refreshes the page so it is not loaded again.
Consent required: Yes. Default off.

Browser error reporting

Provider: Sentry
Purpose: Send browser errors to Sentry so Fiducio can diagnose faults. The browser client is configured with sendDefaultPii off and performance tracing off. Session Replay is not enabled in this application.
Category: Analytics and diagnostics
Duration: The browser client is not initialised until you opt in. Turning analytics and diagnostics off saves that choice and refreshes the page, so browser Sentry does not start on the reloaded page. A later opt-in can start it in that new page. This policy does not claim a particular Sentry cookie name, because this application does not set one itself.
Consent required: Yes. Default off. Server-side error reporting, used to operate the service, is separate and is not controlled by this browser choice.

Font and page content

Provider: Fiducio, first-party
Purpose: The Inter font is included with the application at build time and served from this site. Structured-data scripts describe the organisation to search engines. A Google site-verification meta tag is present for Search Console. None of these are advertising tags, and none are configured here to write a cookie.
Category: Necessary page delivery, or a static verification meta tag that does not store a preference
Duration: Not applicable as stored consent.
Consent required: No.

Contact

Questions about this policy: info@fiducio-cyber.com. See also the privacy policy.