Cookie Policy
Last updated: 13 July 2026 • Version: 1.0
The French version of this document prevails in case of discrepancy.
1. Introduction
This policy explains how Secure Layer SASU uses cookies and similar technologies, in line with CNIL guidance and the ePrivacy directive.
We collect consent through vanilla-cookieconsent, a self-hosted consent platform (no third party receives your data); non-essential cookies are not set before you consent.
2. Legal basis
Under Article 82 of the French Data Protection Act and the GDPR: strictly-necessary cookies need no consent; all others (notably analytics) require your prior consent.
3. Strictly necessary cookies and local storage
These cookies and local storage keys keep the service working or record a choice you made; they need no consent.
| Cookie / key | Purpose | Duration |
|---|---|---|
| cc_cookie | Stores your consent choices, written on your first choice (Accept/Reject, vanilla-cookieconsent) | 6 months |
| Cognito / Amplify (session) | Authentication and session after sign-in (AWS Cognito) | Session |
| sl.leftMode | Remembers your sidebar layout preference | ~1 year |
| sl-no-beacon | Remembers your objection to cookie-free audience measurement (written only if you object, see section 5) | Until cleared |
4. Analytics cookies
Consent required
These cookies are set only after you accept the analytics category in the banner.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| cwr_s, cwr_u, cwr_c, cwr_i | Amazon CloudWatch RUM (AWS, eu-west-3) | Audience measurement, performance and error monitoring, session recording (text masked) | ≤ 30 days |
Accepting this category also covers session recording: replaying your journey on the site to diagnose problems. Text you type and text on screen are masked by default.
We use no Google Analytics, no third-party ad networks, and no marketing cookies.
5. Cookie-free audience measurement
We also measure traffic on the public pages with an in-house tool that uses no cookie and no identifier. The only thing written to or read from your device is your objection flag (the sl-no-beacon key, see section 3), written only if you object. Each visit sends a simple count (page, referrer, campaign, language), with no identifier and no stored IP address.
The resulting statistics are aggregate and anonymous, for our exclusive use, never joined to user accounts. This processing is exempt from consent (Article 82 of the French Data Protection Act), so it runs without the banner. Logs are kept for 13 months. Details in our Privacy Policy.
You can object
Open "Cookie Settings" in the footer and turn on the audience measurement objection. Your choice is stored in your browser (key sl-no-beacon) and nothing is sent anymore.
6. Managing your consent
On your first visit the consent banner lets you accept, reject, or customize by category. Your choice is kept for 6 months (CNIL guidance), then asked again.
You can change or withdraw consent at any time via the "Cookie Settings" button in the footer.
7. Browser controls
You can also manage cookies in your browser settings; blocking all cookies may prevent you from signing in.
8. Your rights
You may withdraw consent, access information about the cookies used, and lodge a complaint with the CNIL. For full processing details see our Privacy Policy.
9. Contact
Data protection: dpo@securelayer.dev
General: support@securelayer.dev