Security

Last updated: October 10, 2026

This page describes how CookieBoss protects data today. It is written to be checked, so it says what we do rather than what we aspire to.

Infrastructure and data location

  • CookieBoss runs entirely on Cloudflare: application code on Cloudflare Workers, data in Cloudflare D1 (database) and R2 (files).
  • The database’s primary location is Western Europe. Requests are handled on Cloudflare’s global network, so processing can happen outside the EU. The full list of providers and locations is on our sub-processor page.
  • Data is encrypted in transit (TLS 1.2 or higher, HSTS on our websites and dashboard) and at rest (Cloudflare’s storage encryption).
  • The database keeps point-in-time backups for 30 days.

Accounts and access

  • Passwords are stored only as salted PBKDF2-SHA256 hashes and compared in constant time.
  • Sessions are signed tokens that are also checked against a server-side session list on every request. Signing out, resetting your password or “sign out everywhere” revokes them. Sessions expire after 7 days.
  • API keys are stored only as hashes, can be read-only or read-write, and can be revoked at any time.
  • Team roles (owner, admin, viewer) are enforced by the server on every request, not just hidden in the interface. Billing and account deletion are owner-only.
  • Tenant isolation: every query for customer data is scoped to the customer’s account.
  • Internal admin tools are only reachable through Cloudflare Access with single sign-on, and refuse every request that does not carry a valid Access token.
  • The script is compiled per site and served from cdn.cookieboss.io. Banner texts and settings are validated when saved and escaped when shown, so a banner can’t carry injected code.
  • Before a visitor makes a choice, the script stores nothing on their device and tagged scripts stay blocked.
  • Consent records hold a random visitor ID, the choice and its time, and approximate country. IP addresses are not stored with them; the consent record holds at most a keyed one-way hash.
  • Consent beacons are only accepted from the website they belong to.
  • Each published version of a site’s script is kept, so a release can be rolled back to the exact previous version.

Monitoring and logs

  • Application logs are kept for 30 days and are used for troubleshooting and incident response.
  • Errors in our web apps are reported without query strings or secrets.
  • Our production smoke test, which covers signup, sign-in, the API, script delivery and billing, runs on every deployment, and a deployment is blocked if it fails.

Security reviews

  • In October 2026 we ran a full security review of our code and infrastructure configuration. All critical findings and most high-severity findings were fixed within days. They covered access control for internal tools, OAuth, tenant isolation, consent-record integrity and our platform plugins. The remaining items are scheduled.
  • Every change is type-checked and tested automatically before it can reach production.

Deletion

  • Account owners can delete their account and all its data from the dashboard (Account → Delete account). Deletion is immediate; deleted data is gone from backups within 30 days.
  • Consent records are deleted when the consent duration the website owner set has passed (12 months by default).
  • Scan results are deleted after 12 months, and shared scan reports after 90 days.

Not in place yet

We prefer to be explicit:

  • We don’t hold a formal certification such as ISO 27001 or SOC 2.
  • Content Security Policy on the dashboard is limited to frame protection.

Reporting a vulnerability

Please email [email protected] with “Security” in the subject. We reply within two working days, and we won’t take legal action against good-faith research that avoids privacy violations and service disruption and gives us reasonable time to fix the issue before disclosure.