Security

This marketing site is served over HTTPS in production. The contact form and login calls stay on this origin. The site's API talks to the commercial API and to the contact destination configured for the deployment.

A successful login stores the session token and the refresh token in httpOnly, SameSite=Lax cookies. On HTTPS those cookies are also marked Secure. The site attaches the session token as Authorization: Bearer when it calls /v1/commercial/whoami. The refresh token is sent only to POST /v1/auth/refresh, along with that same bearer. Page scripts cannot read either cookie.

This page does not state a compliance certification. Ask us, through the contact form, what reviews are available for a deployment you are considering. Put "Security" in the message.

What customer data a deployment stores is defined in that deployment's agreement, not on this page.