Cookie policy

1. This website

theassayco.com sets no cookies and stores nothing in your browser. It runs no analytics, no advertising pixels and no session recording. Its fonts, styles and scripts are served from the site itself; no page loads anything from another company.

The contact form and the Lens key form send what you type when you press the button, and nothing before that.

2. The application

This covers app.theassayco.com, the demo, and every customer workspace at your-company.app.theassayco.com. Every cookie below is strictly necessary: without it the thing you asked for cannot work. Each is set by the address you are on, is sent only over an encrypted connection, and is never sent to another site.

Cookie	What it is for	How long it lasts
assay_session	Keeps you signed in to the workspace. It holds a signed statement of who you are and your role; no password and no workspace data. Scripts cannot read it.	8 hours, or until you sign out
assay_oidc	Set while you sign in with your organisation’s Okta, to check that the reply came back to the browser that started it. Scripts cannot read it.	A few minutes; removed when sign-in finishes
assay_sso_error	If a sign-in through Okta fails, carries the reason back to the sign-in screen so it is not put in the address bar.	One minute; removed as soon as it is read
assay_share_…	Set when you open a shared report that has a passcode, so you are not asked for it on every page of that report. Scripts cannot read it.	2 hours

3. Other things the application keeps in your browser

Two items are kept in the browser’s local storage, and only when you ask for them. They stay on your device and are never sent to us.

Item	What it is for	How long it lasts
Drift baseline	When you choose to save a baseline on an assessment: the ids and names of its flows, so a later assessment can show what changed.	Until you clear it in the workspace or clear the browser’s site data
Runtime address	The public address you type on the runtime set-up screen, remembered so you do not type it again.	Until you clear the field or the browser’s site data

4. The Lens extension

Assay Lens sets no cookies. It keeps its own settings in Chrome’s extension storage on your device: the address of your Assay server, your Lens key, the mode you chose and, in the enterprise edition, the signed rule pack. “Disconnect” on its settings page removes the key and the rule pack. Removing the extension removes everything.

5. Turning cookies off

You can block or delete cookies in your browser’s settings. The website works exactly the same without them. The application will not be able to keep you signed in, because the sign-in cookie is the only way it knows a request is yours.

6. Changes

If we add a cookie, it is listed here before it is used, and the version and date above change. We will not add analytics or advertising cookies without asking you first.

7. Contact

Questions about this policy: privacy@theassayco.com. What personal data we hold and your rights over it are in the privacy policy.