This Cookie Policy explains the cookies and similar technologies used on TasScan websites and portals, operated by TAS Group LLC. It supplements the Privacy Policy.
1. Summary
TasScan uses only cookies that are strictly necessary to sign you in and protect your account, security and anti-abuse technologies, and a few browser-storage entries that remember choices you make. TasScan currently does not use cookies for cross-site behavioral advertising, and we do not use advertising cookies, tracking pixels or third-party analytics scripts. Because the technologies we use today are strictly necessary or record a preference you set, we do not show a cookie banner.
2. Strictly necessary and authentication cookies
All TasScan cookies are first-party and host-only: they are sent only to the host that set them. They are strictly necessary to provide a service you asked for, so they do not need consent.
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
tas_session | Customer portal and customer API host | Keeps you signed in; holds an opaque session identifier, the session itself is stored on our servers. | Until you sign out, after 12 hours without activity, or 7 days at most; without "remember me" it ends when you close the browser. |
tas_csrf | Customer portal and customer API host | Protects forms and changes against cross-site request forgery. | 7 days |
tas_admin_session | Operations portal (administrators only) | Keeps an administrator signed in. | Ends when the browser closes, after 30 minutes without activity, or 8 hours at most |
tas_csrf_admin | Operations portal (administrators only) | Cross-site request forgery protection for administrators. | 7 days |
The public website, including the free Security Check, sets no cookies of its own.
Session protections. Where technically applicable, our session cookies are set with the Secure attribute (sent only over HTTPS), the HttpOnly attribute (not readable by page scripts) for session identifiers, and a SameSite attribute (Lax or Strict) to limit sending on cross-site requests. Cookies used for CSRF protection must be readable by our own page scripts and so are not HttpOnly.
3. Preference storage
Some choices are remembered in your browser's local or session storage (not cookies). They are never sent to us or to third parties and you can clear them at any time.
| Key | Where | Purpose |
|---|---|---|
tasscan-theme | All TasScan sites | Your light or dark theme choice |
tasscan.sidebar_collapsed, tasscan.admin.sidebar_collapsed | Portals | Whether the navigation sidebar is collapsed |
tasscan.mfa_reminder_dismissed_at, tasscan.mfa_skipped_at | Customer portal | When you dismissed or postponed the two-factor reminder |
tasscan.mfa_token, tasscan.admin.mfa_token | Portals | Carries the second sign-in step between two pages (session storage, removed after sign-in) |
4. Security and anti-abuse technologies
Our sites are delivered through a content-delivery and attack-protection provider. Depending on the protection active at the time, it may set cookies such as __cf_bm (distinguishes people from automated traffic), cf_clearance (records that you passed a security challenge) or _cfuvid (applies rate limits fairly). These are strictly necessary security cookies, are not used for advertising or analytics, and are described in the provider's cookie documentation. We also use rate limiting, hashed rate-limit keys and request signals to prevent abuse; these do not store a cookie in your browser.
5. Optional analytics
We do not currently use optional analytics cookies. If we introduce analytics or other non-essential technologies that require consent, they will remain disabled until you have given consent where the law requires it, you will be able to refuse as easily as accept, and we will update this policy and its date before they are used.
6. Advertising
We do not use advertising cookies and do not use cookies for cross-site behavioral advertising. We do not allow third-party advertisers to place cookies on our sites.
7. Error reporting
When an error occurs, a technical report (error type and message, the page address without its query string, browser type and software release) may be sent to our error-monitoring provider, with email addresses and tokens removed. Error reporting sets no cookies and stores nothing in your browser.
8. Cookie controls and consent
You can clear or block cookies in your browser settings. Blocking the TasScan session or CSRF cookies prevents you from signing in to the portals; the public website works without cookies. Where consent is required for a technology (see section 5), you can withdraw it at any time through the control we provide for it, and by clearing your browser data. Signals such as Global Privacy Control are respected where required by law for any sale, sharing or targeted-advertising purposes, which we do not currently carry out.
9. Changes
We will update this page, with a new version and effective date, before we change the cookies or storage we use.