1. Overview

This policy describes every cookie and session identifier PremioGuard sets when you use this website, why each one is set, and how long it lasts.

PremioGuard uses no advertising, analytics, or cross-site tracking cookies. There is no third-party marketing script on these pages, no social tracking pixel, and no behavioural profiling. Every cookie described below is set by us, for a single purpose: to keep you signed in and to protect the sign-in itself.

Because none of our cookies are used for advertising or profiling, they are all strictly necessary for the service to operate. They are set on the basis of our legitimate interest in operating a secure service and in performing the contract with you, rather than on consent.

2. Strictly necessary cookies

Cookie Purpose Lifetime Type
premioguard_session Identifies your session server-side so the site knows who you are. Contains an opaque identifier only — no personal data, no account information. 2 hours by default, extended to 30 days if you chose "remember me". First-party, HttpOnly, Secure, SameSite=Lax
remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d Keeps you signed in across browser restarts when you select "remember me". Holds a token that lets the server re-establish your session without your password. 30 days First-party, HttpOnly, Secure, SameSite=Lax
XSRF-TOKEN Protects you against cross-site request forgery. The value is read by client-side script and echoed in a header on state-changing requests, so another site cannot submit a form as you. Session-length First-party, Secure, SameSite=Lax
premioguard_support_session Identifies an authenticated PremioGuard support agent's session, on the separate support console. See section 6. Session-length, extended to 30 days when remembered First-party, HttpOnly, Secure, SameSite=Lax

Note on the cookie names. The session cookie is named from the application name, so it reads premioguard_session. The "remember me" cookie carries a hash of the guard class that issues it; the exact string is listed above so you can find and clear it. These are our own names, not third-party ones.

premioguard_session is the cookie that makes you signed in. Its value is an opaque identifier; everything about your account — your identity, your permissions, your second-factor state — is held server-side against that identifier and is never written into the cookie.

  1. Two separate clocks end a session

    The cookie itself expires after the configured lifetime. Independently of that, a session with no activity for 5 hours is destroyed outright. The idle ceiling is not a substitute for the cookie's own expiry — it exists because a browser holding a cookie for someone who walked away from an unlocked machine keeps presenting it, and the cookie's expiry is measured from when it was issued rather than from the last thing the person did.

  2. Session data

    Alongside the cookie we keep a small amount of server-side session data, including the identifier of the active second-factor challenge, whether the current session has satisfied two-factor authentication, and the time of last activity. This is what stops a second-factor challenge being satisfied by a different session.

  3. On sign-out

    Signing out invalidates the session server-side and clears the cookie, rather than merely asking the browser to forget it.

When you tick "remember me" at sign-in, the session cookie is stretched to 30 days and a separate recaller cookie is set. The recaller cookie lets the server re-establish your session on a later visit without asking for your password.

  1. The trade-off, stated plainly

    A remembered session remains usable on a shared machine for up to 30 days. It is opt-in, the sign-in form states the actual duration, and you can decline it. A remembered session is still subject to two-factor authentication on each new sign-in — remembering you does not skip the second factor.

  2. Revoking a remembered session

    Changing your password, signing out, or resetting a credential invalidates remembered sessions. Where you suspect an account has been compromised, changing the password is what ends every remembered session on every device at once.

5. Cookies and two-factor authentication

A correct password alone does not sign you in. Where an account has a second factor enrolled, the password check parks the request in a pending state until a code is answered, and only then is a full session established.

  • The pending state is held server-side, keyed to the browser session. It is not a cookie that grants access, and following the sign-in redirect before answering the code does not sign you in.
  • The second-factor result is recorded per session. Satisfying the challenge in one browser session does not mark another session as verified, so a stolen session cookie cannot be upgraded by answering a code somewhere else.
  • Codes expire after a short period and are limited to a small number of attempts. A code is also bound to the challenge it was issued for, so a code minted for enrolment cannot be used to answer a sign-in challenge.
  • Signing out, or changing a credential, ends the pending state and any remembered session together with it.

6. The support console session

PremioGuard operates an internal support console, used by our staff to help customers. It runs on a completely separate session identifier from the customer application, so a support session can never be resolved as, or collide with, a customer or administrator session.

  • A support agent's session is not established by a cookie alone. The agent's identity, their permissions, and their second-factor state are resolved server-side on every request.
  • Support agents are challenged for a second factor on every sign-in, and the console refuses to operate a capability the agent has not been granted.
  • Suspending a support agent, or resetting their credential, ends their live sessions immediately rather than at their next sign-in.

7. Cookies we do not use

For the avoidance of doubt, PremioGuard does not set:

  • advertising or behavioural-targeting cookies;
  • third-party analytics cookies, including any cross-site identifier that would let another site recognise you;
  • social-media tracking pixels or embedded social content on these pages;
  • cookies used to build a profile for marketing.

The public pages load fonts and stylesheets from public content-delivery networks. Those requests are ordinary web requests, not tracking cookies, but if you would prefer to avoid contacting a third party at all, a content blocker will do it. The pages remain fully readable and functional without those assets, using fallback fonts.

8. Managing cookies in your browser

Every browser lets you view, block, and delete cookies, and most let you clear them on exit. Because all our cookies are strictly necessary, blocking them will sign you out and prevent sign-in — the site will not work as an authenticated application.

  • To end every remembered session, clear cookies for this site and change your password. Clearing cookies alone removes the token from this browser but cannot revoke it on the server if it has already been copied.
  • Signing out clears the session server-side and is the tidier way to end a session on a shared machine.
  • Private or incognito windows do not persist cookies between sessions, which is the simplest way to avoid a remembered session on a shared device.

If you have difficulty signing in after clearing cookies, contact us at contact@premioguard.com.

We do not operate a cookie-consent banner for these cookies, because consent is not the lawful basis we rely on for them. They are set on the basis of performing the contract with you and of our legitimate interest in keeping the service secure; a service that could not set a session cookie could not offer an account at all.

You can withdraw the basis for a remembered session at any time by declining "remember me" at the next sign-in, or by signing out. Where we ever introduce a non-essential cookie, we will ask for consent first and you will be able to withdraw it without losing access to the service.

Questions about this policy, or about how our processing relates to the Privacy Policy, can be sent to contact@premioguard.com.