Cookie Policy
Last updated September 3, 2026
This policy explains what cookies Rayz Security sets in your browser and why. It's short, because our actual cookie use is short: cookies that keep you signed in, and, only if you agree, Google Analytics on our public website.
Strictly necessary cookies
These cookies are what keep you logged in as you move between pages. The Service can't function without them, so there's no opt-out for these specifically. Declining them means declining to use the Service, the same as declining to enter a password.
| Cookie | Purpose | Duration |
|---|---|---|
sc_access | Short-lived session token that authenticates your requests while you're signed in. | 30 minutes |
sc_refresh | Used to issue a new session token without asking you to sign in again. | 14 days |
sc_step | Remembers where you are in the onboarding flow so you can pick up where you left off. | 14 days |
All three are set as HttpOnly (not readable by page scripts) and SameSite=Lax, and as Secure (HTTPS-only) in production.
Analytics cookies (only with your consent)
On our public website (the pages you can reach without signing in) we use Google Analytics to understand which pages are read and how visitors arrive. It runs only after you choose "Accept" in the cookie notice; if you decline or never answer, the Google Analytics script is not loaded at all. It is never used inside the signed-in product.
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Distinguishes one visitor from another with a random identifier (set by Google Analytics). | 2 years |
_ga_* | Keeps session state for Google Analytics. | 2 years |
Google Analytics 4 does not log or store IP addresses. Google's own handling of this data is described in its privacy terms for partner sites. You can change your mind at any time by clearing this site's data in your browser, which shows the notice again.
What we don't use
We don't set advertising or cross-site tracking cookies. If that changes as the product grows, we'll update this page and this section first. We're not going to let this policy quietly go stale while our actual cookie use expands behind it.
Third-party cookies
If you connect an integration like Jira, the authorization flow briefly takes you to that provider's own site, which may set its own cookies under its own policy. Those are outside our control once you leave our domain for that step.
Controlling cookies
Most browsers let you block or delete cookies through their settings. Blocking the sign-in cookies will sign you out and prevent you from staying signed in to the Service. There's no partial mode where you keep functionality without them. Analytics cookies are optional: decline them in the notice, or block them in your browser, and the Service works exactly the same.
Changes to this policy
We'll update the "Last updated" date above whenever this policy changes, and describe the change here if it affects what we actually collect.
Contact
Questions about this policy? Reach us at support@rayz-security.com.