Cookie Policy

When you visit Cybelle's website, intelligence platform, or Threat IQ simulation environment, our systems may place small data files on your device or browser. These technologies enable core platform functionality, security controls, and analytical insight into how our services are used. This section defines the tracking technologies we deploy.

Cookies

Cookies are small text files stored on your device by your browser at the instruction of a website. They persist either for the duration of your browser session (session cookies) or for a defined period beyond it (persistent cookies). Cookies enable websites to remember state, preferences, and identity across requests.

Web Beacons & Pixel Tags

Web beacons (also called pixel tags or tracking pixels) are small, transparent image files embedded in web pages or emails. When rendered by your browser or email client, they signal to our servers that the relevant content has been accessed. We use these sparingly and only for legitimate platform improvement purposes.

Local Storage & Session Storage

HTML5 local storage and session storage allow our platform to persist data directly in your browser beyond individual requests. We use local storage to maintain UI state preferences (such as navigation position or selected filters) and session storage for short-lived platform state that clears when you close your browser tab.

Zero Trust Session Tokens

Authenticated areas of our platform — including the Threat IQ simulator — use cryptographically signed session tokens to verify identity on each request. These tokens are stored in secure, HttpOnly, SameSite-strict cookies and are not accessible to client-side JavaScript. This architecture prevents cross-site scripting attacks from compromising authentication state.

We classify the tracking technologies we use into the following categories. Only Essential cookies are deployed without your consent. All other categories are subject to your preference selections.

Essential Cookies — Detail

The following essential cookies are always active and cannot be disabled without impairing core platform functionality:

• _cyb_session — Encrypted session identifier. HttpOnly, Secure, SameSite=Strict. Duration: session.
• _cyb_csrf — CSRF protection token. HttpOnly, Secure. Duration: session.
• _cyb_auth — Authentication state indicator for authenticated platform areas. HttpOnly, Secure, SameSite=Strict. Duration: up to 24 hours.

Analytics Cookies — Detail

Where you have consented to analytics, we deploy the following:

• Microsoft Clarity — Aggregated heatmap and session telemetry. Data is processed in aggregate without individual identification. Clarity operates under Microsoft's privacy commitments and our data processing agreement.

Some pages on the Cybelle platform may embed content or functionality hosted by third parties, which may set their own cookies independently of Cybelle. We exercise strict control over third-party integrations, but cannot be responsible for the cookie practices of external services.

We review our third-party service portfolio periodically and update this policy to reflect any additions or changes. To request the current list of active third-party services, contact legal@cybelle.io.

On your first visit to Cybelle's digital properties, you will be presented with a consent notice that allows you to accept, refuse, or granularly configure non-essential cookie categories. Your preferences are stored in a consent record cookie and honoured across subsequent visits.

Withdrawing or Changing Consent

You may modify your cookie preferences at any time by accessing our consent preference centre, accessible from the footer of any page. Withdrawing consent does not affect the lawfulness of processing carried out prior to withdrawal.

Browser-Level Controls

Most browsers provide controls to manage, restrict, or delete cookies. Common mechanisms include:

• Google Chrome — Settings → Privacy and Security → Cookies and other site data
• Mozilla Firefox — Preferences → Privacy & Security → Cookies and Site Data
• Apple Safari — Preferences → Privacy → Cookies and website data
• Microsoft Edge — Settings → Cookies and site permissions → Manage and delete cookies

Please note that blocking essential cookies will prevent authenticated platform areas from functioning. Analytics cookies may be individually blocked without affecting core platform operation.

Do Not Track

Where your browser transmits a "Do Not Track" (DNT) signal, we honour that signal by disabling analytics and functional tracking for your session. Essential security cookies remain active regardless of DNT state.

Opt-Out Mechanisms

For Microsoft Clarity analytics, you may opt out directly at clarity.microsoft.com/optout. This opt-out is stored as a browser cookie; clearing cookies will reset your opt-out preference.

This Cookie Policy is reviewed and updated periodically to reflect changes in our technology stack, regulatory requirements, or the third-party services we engage. The version number and "Last Updated" date at the top of this document identify the current revision.

Where we introduce a new category of cookie or materially change how an existing category operates, we will refresh the consent notice on our platform to give you the opportunity to review and confirm your preferences under the updated policy.

For any questions, concerns, or requests relating to our use of cookies or tracking technologies, please contact our Privacy Office:

You also have the right to raise concerns about our cookie practices with the data protection supervisory authority in your jurisdiction.