Does the application use cookies?

The use of cookies is reduced to a strict minimum, and allows essentially to keep the user authenticated throughout the user's session (session cookie) or to facilitate the use of the application by temporarily storing some interface choices made by the user.

What are the different cookies used by the application?

• The session cookie

The session cookie is essential for the proper functioning of the application. It allows the user to be recognized once logged in without having to ask the user to re-authenticate each time he or she changes pages. It contains only a random text identifier that can only be recognised by the server hosting the application: it does not contain any information that could reveal the user's identity.

This cookie is automatically destroyed when the browser closes.

Note that the identifier contained in the session cookie becomes obsolete when the session expires on the server side (for hosted environments, this occurs by default every 10th and 40th minutes if the user has been inactive for at least 24 minutes in a row). However, the cookie remains on the device until the browser closes but is no longer usable until the user re-authenticates to the application.

• The persistent login cookie

If the "Allow the user to save his credentials for future connections" feature has been enabled at the application level (Administration > Application connection > Authentication Policy page, section "Authentication Cookie"), the user has the option to save his credentials via the application's login portal: this creates a persistent connection. The lifetime of the cookie is configured by the customer in the same "Authentication Cookie" section of the above-mentioned page.This cookie contains an encrypted string known only to the database, allowing the user to automatically re-authenticate when they start a new session or when their previous session has expired. The persistent connection and the associated cookie are automatically destroyed as soon as the user explicitly disconnects from the application by clicking on the "Log out" link accessible via the menu in the top bar.

Note that the user has the possibility, via "My account" by clicking on one's name, to delete one or more of his persistent connections. This will not delete the corresponding cookies on his devices, but will render them inoperative.

• Numerical identifier of the logged-in user

A cookie containing the numerical identifier of the connected user is created as soon as the user is authenticated and is destroyed when the browser closes. It allows to propagate the last URL accessed by the user if his session was destroyed during browsing: this is only done if the user reconnects and his identifier is indeed the same as the one previously stored in this cookie.

• Density of the pixel of the screen used

For an optimal rendering of the images, the application adapts their resolution (size in pixels) according to the definition of the screen used for navigation. To do this, the browser indicates the pixel density of the screen (Device Pixel Ratio) via a cookie. The application then stores the information in the user's session and deletes the cookie. The browser can be reset to store this information as a cookie if the screen definition changes during navigation (for example, if the user changes the zoom onboard his browser) or if the session has expired. The cookie is deleted when the browser closes if the application has not deleted it by itself (for example, if the user has not browsed the application after the cookie has been created).

• Language used to display the application

A cookie is created as soon as the user changes the language in which the application is displayed. This cookie expires after 12 month. It allows the application to automatically display in the last selected language each time the user logs back in.

• Last selections via drop-down lists

When the user makes a selection via a drop-down list, the browser writes the last selections he or she made as a cookie, so that the application can then store them in its database and propose, in these same lists, the last choices made by the user. The database is saved as soon as the user changes pages: the application then deletes the cookie. However, if the storage cannot be done because the user leaves the application, then the cookie remains on the browser with a lifetime of 7 days (this duration will be interrupted if the user reconnects and reuses the drop-down lists again).

Note that the stored information is non-sensitive since only the numerical identifiers corresponding to the selections made are present (no textual data).

• Deployed" or "reduced" status of some interface regions

The application has several regions within its interface that can be deployed or reduced according to the user's preference: right panel on most pages, left panel containing tabs on "file" type pages, status bubble in the initiatives file*. When the user changes the "deployed" or "reduced" status of one of these regions, the browser indicates this via a cookie that is then retrieved by the application when navigation occurs. The report is then stored in session, and the cookie is destroyed.

Note that if the user leaves the application before it has been able to delete the cookie, it can remain on the device, with a lifetime of 7 days.

• Light Theme, Dark Theme

A cookie is set to store the chosen theme for the appearance of the application: device theme, light theme, or dark theme. Its lifespan is 12 months.

• Cookie Consent Banner

Acceptance of the information message regarding the setting of cookies is itself stored in a cookie with a lifespan of 12 months.