QEDARA TRUST CENTER
Cookies, preferences and session controls
QCM uses browser storage for authentication, request protection, workspace selection and interface preferences.
Necessary session cookies
Auth.js cookies support request-forgery protection, the login return location and the authentication session. The observed production CSRF and callback cookies use Secure, HttpOnly and SameSite=Lax. Session-cookie expiry is distinct from the server-side inactivity limit.
Workspace and privileged-session cookies
qedara_workspace_id stores the selected workspace; its reviewed lifetime is 365 days, with Secure, HttpOnly and SameSite=Lax. qcm_platform supports privileged access, with a reviewed default lifetime of 30 minutes and SameSite=Strict. The workspace identifier alone grants no access.
Local preferences
localStorage stores theme, language, navigation expansion, selected document columns and model preference. These optional values are read and written only after you accept preferences. Rejecting or withdrawing preferences clears the listed values. The choice lasts 180 days; expiry requires a new choice. Theme and other controls still work for the current page without remembering them.
Tab state
With preference consent, sessionStorage stores document-list scroll/query context and marketing language. Query context can include user-entered search information. Browser restoration behaviour can preserve tab state.
Consent and optional storage
Strictly necessary storage for a service you request is distinct from optional analytics, advertising or other non-essential storage. Optional storage requires prior consent and an accessible way to withdraw it. Use Cookie settings, available throughout QCM, to accept preferences, reject optional storage or change your choice. Optional preferences are off until you choose. The necessary qcm.storage-consent.v1 localStorage record stores the policy version, choice and timestamps for 180 days, without a user identifier. This control does not enable analytics or advertising. Other Qedara sites have their own scope.
Your controls
Explicitly log out on shared devices. Closing a tab may not clear a browser-restored session. Blocking necessary cookies may prevent login. This inventory is not a claim that every authenticated flow or external Qedara site has been scanned for tracking.