Prismaraby SovSec

Legal Cookie Policy

SOV-LG-006

Cookie Policy

Applies to All website and app visitors · Version 1.0 · 2 November 2026

Draft — pending legal review. These documents are being finalised. Fields shown as [TO BE COMPLETED] are not yet filled in, and the wording may change before it is legally binding.

1. About this policy

1.1 This policy explains how SovSec (SovSec, we) uses cookies and similar technologies — such as local storage, session storage and IndexedDB — on sovsec.com, prismara.eu and their subdomains, including the Prismara web applications (together, the Sites). It should be read with our Privacy Policy (SOV-LG-005).

1.2 The law that applies is § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021), implementing Article 5(3) of Directive 2002/58/EC, and the corresponding laws of other Member States, together with the GDPR where cookies involve personal data. Storing or reading information on your device is allowed without consent only where it is strictly necessary to provide a service you have explicitly requested; everything else requires your prior consent.

1.3 Where SovSec provides a Prismara web app to a business client, the client decides how the app is configured. The cookies listed below are those set by our platform; the client's own policies may add to this information.

2. Our approach in short

  • Strictly necessary only, by default. Our Sites work with strictly necessary cookies alone. They are set to keep you signed in securely, protect forms against attack and remember your cookie choices.
  • No advertising or tracking. We do not use advertising cookies, social media pixels, fingerprinting or cross-site tracking, and we do not allow third parties to set cookies on our Sites for their own purposes.
  • No third-party analytics. We do not use Google Analytics or similar services. We may produce aggregated visitor statistics from our own server logs, which does not involve storing anything on your device.
  • Hardened cookies. Security cookies use the __Host- prefix, which forces them to be Secure, bound to the exact host and unavailable to other subdomains, and are set HttpOnly and SameSite=Lax or Strict.

3. Categories of cookies

Strictly necessary

3.1 These are essential to provide the Sites and the services you ask for — for example signing in, keeping your session secure and remembering your consent choice. They do not require consent under § 165(3) TKG 2021. You can block them in your browser, but sign-in and some features will then not work.

Preferences

3.2 These remember choices you actively make, such as language or dark mode. Because they are set only when you make the choice, and only to carry out that choice, we treat them as strictly necessary for a service you have explicitly requested. We do not set them in advance.

Analytics

3.3 We do not currently use analytics cookies. If we introduce privacy-friendly, self-hosted analytics in future, we will set analytics cookies only with your prior consent, as § 165(3) TKG 2021 contains no exemption for analytics. We will update this policy and our consent banner first.

Third-party cookies

3.4 Our Sites do not embed third-party content that sets cookies (such as videos or social media widgets); we link to such content instead. When you pay for Prismara Personal Secure, you are taken to a checkout page hosted by Stripe, which sets its own cookies for fraud prevention and security under Stripe's cookie policy. These are set on Stripe's domain, not ours.

4. Cookies and storage we use

 Name                   Type / set by                  Purpose                                                          Duration

 __Host-                Cookie, first party —          Keeps you signed in securely after authentication; contains      Session; ends on sign-out,
 sov_session            sovsec.com, prismara.eu apps   an opaque, random session identifier.                            after 12 hours idle or at
                                                                                                                        most 7 days

 __Host-sov_csrf        Cookie, first party            Protects forms and sign-in against cross-site request forgery.   Session

 __Host-                Cookie, first party —          Holds the state and nonce of a sign-in in progress (OpenID       10 minutes
 sov_auth_tx            identity.prismara.eu           Connect) so that the response can be verified.

 __Host-                Cookie, first party —          Only if you tick “Remember this device”: identifies a trusted    30 days
 sov_device             identity.prismara.eu           device to reduce repeated prompts. It never replaces your
                                                       passkey.

 __Host-sov_lb          Cookie, first party            Routes your requests to the same server during a session         Session
                                                       (load balancing).

 __Host-                Cookie, first party            Records your cookie choices so we do not ask again on            12 months
 sov_consent                                           every page.

 sov_lang               Cookie, first party            Remembers the language you choose (English / German).            12 months; set only when
                                                                                                                        you choose

 prismara.theme         Local storage, first party     Remembers light or dark mode, if you choose one.                 Until you clear it

 prismara.cache.*       IndexedDB, first party —       Offline cache of your mailbox, documents and settings to         Until you sign out or clear
                        Prismara web apps              make the apps fast and usable offline. Prism vault data is       site data
                                                       cached only in encrypted form.

 prismara.keys          Browser key store              Holds non-extractable device keys used for end-to-end            Until you sign out of the
                        (WebCrypto), first party       encryption and passkey-protected sessions.                       device or clear site data

 prismara.draft.*       Session storage, first party   Keeps unsent drafts if a tab reloads.                            Until the tab is closed

Demo sites at <app>-demo.prismara.eu use the same strictly necessary cookies with a -demo suffix. Exact names may change with software updates; we will keep this table current.

5. Consent banner and your choices

5.1 While our Sites use only strictly necessary cookies, we do not show a consent banner. Instead, a “Cookie settings” link in the footer of every page leads to this policy and your settings.

5.2 If we introduce cookies that need consent, a banner will appear on your first visit. It will offer “Accept all” and “Reject all” with equal prominence on the first layer, granular choices per category, no pre-ticked boxes and no cookie wall — you can use the Sites in full if you reject. No non-essential cookie is set or read before you consent.

5.3 We store your choice for 12 months, then ask again. We also ask again if we add a new purpose.

5.4 We treat a Global Privacy Control (GPC) signal from your browser as a refusal of consent for any non-essential cookies.

6. How to change or withdraw your choices

  • On our Sites: click “Cookie settings” in the footer and change your choices. Withdrawing consent is as easy as giving it and takes effect immediately; we will delete any non-essential cookies we set.
  • In your browser: you can block or delete cookies and site data in your browser settings (for example, Prismara Browser, Firefox, Chrome, Safari or Edge). Blocking strictly necessary cookies will stop sign-in from working.
  • Prismara web apps: signing out clears session cookies and the offline cache on that device. “Sign out everywhere” in your account security settings ends all sessions.

6.1 Questions about cookies: privacy@sovsec.com. You also have the rights described in our Privacy Policy, including the right to complain to Datenschutzbehörde (DSB).

7. Changes

7.1 We review this policy whenever we change the cookies we use and at least once a year. The version and date are shown on the cover.

Drafting notes — remove before publication

  • Cookie names, durations and the 12-hour idle / 7-day maximum session are proposed values — align with the actual Prismara Identity and website implementation before publication; run a cookie scan of each live domain.
  • Rechtsanwalt to confirm that user-initiated language/theme storage qualifies as 'unbedingt erforderlich' under § 165(3) TKG 2021 and that no banner is required while only such storage is used.
  • Any future self-hosted analytics requires prior consent in Austria (no analytics exemption in § 165(3) TKG 2021).

End of SOV-LG-006 Cookie Policy v1.0 (EU edition). SovSec Ltd · Company no. [COMPANY NUMBER] (England and Wales) · VAT no. [UK VAT] · EU OSS / UID [NUMBER]; from 2028: [SOVSEC FLEXCO NAME], FN [FN NUMBER], UID ATU[NUMBER].

Questions about this document? Contact us. SovSec Ltd — Sovereignty is Security.

Prismara

Sign in to your workspace

or

You enter your password and second factor only on Prismara Identity's own page, never here. Administrators use Admin login.
Prismara Admin Console

Administrator sign-in

Passkey required
Separate session from your user account
Every action recorded in the audit trail
or

Continues to Prismara Admin at admin.prismara.eu. Not an administrator? Use User login.