1Cookies on this site, in short
We use the cookies that the website and the console need in order to work: one that remembers your cookie choices and — only when you sign in to a console — three that keep your session secure and, if your organisation signs in through single sign-on, a few more that last only as long as the sign-in. One more remembers the language you chose; it outlives your browser session only if you allow it.
We use no analytics, advertising or social-media cookies, and no other company sets cookies through our pages.
2What cookies and local storage are
A cookie is a small piece of text that a website asks your browser to store and to send back with later requests to the same site. Local storage is a similar store in your browser that the page's own script can read, but which is never sent to the server by itself. Both stay on your device until they expire or you delete them.
3The cookies we use
qp_locale
Remembers the language you chose with the language switch. Set only when you choose one.
Without your consent it is a session cookie, deleted when you close your browser.
- Category
- Preferences
- Duration
- 1 year · with your consent
- Set by
- This website
qp_consent
Records your cookie choices, so the banner does not ask again on every visit.
- Category
- Strictly necessary
- Duration
- 180 days
- Set by
- This website
qp_access
Keeps you signed in to the console. HttpOnly: no script on the page can read it.
- Category
- Strictly necessary
- Duration
- 15 minutes
- Set by
- The console
qp_refresh
Renews your console session when the access cookie expires, without asking you to sign in again. HttpOnly.
- Category
- Strictly necessary
- Duration
- 7 days
- Set by
- The console
qp_csrf
Protects the console against requests forged by other sites: the console sends it back with every change you make.
- Category
- Strictly necessary
- Duration
- 7 days
- Set by
- The console
qp_sso_handoff
Set only when your organisation signs in with OIDC single sign-on: carries the result from your identity provider to the console during sign-in, and is deleted as soon as the sign-in finishes. HttpOnly.
- Category
- Strictly necessary
- Duration
- 5 minutes
- Set by
- The console
Every cookie is first-party: it is set by quickpentest.com or by the console's own address, for our own domain only. The console's session cookies are HttpOnly, so no script on a page can read them. The CSRF cookie is readable on purpose: the console's script has to send it back with each change you make, which proves that the request came from the console itself and not from another site.
When your organisation signs in through OIDC single sign-on, the sign-in framework also sets two short-lived cookies for the round trip to your identity provider: a correlation cookie and a nonce cookie (.AspNetCore.Correlation.… and .AspNetCore.OpenIdConnect.Nonce.…). They protect the sign-in against forgery and replay, are deleted when it completes, and expire within an hour if it does not.
4What the console keeps in your browser
Inside the console, a few display preferences are kept in your browser's local storage rather than in cookies: whether the sidebar is collapsed (qp-sidebar), the layout of your dashboard (qp-dashboard-layout and qp-dashboard-kpis), the list views you save, and whether you dismissed the prompt for desktop notifications.
They hold nothing but those choices, are never sent to us, and stay until you clear them. The public website keeps nothing in local storage.
5Your choices
Strictly necessary cookies do not need your consent under the Personal Data Protection Authority's guidance on cookies or the EU's ePrivacy rules, because the site cannot provide what you asked for without them; we tell you about them here instead.
The one choice you have is whether we may remember your language after you close your browser. When you first visit, a banner at the foot of the page asks it: Accept all allows it, Necessary only refuses it, and Customize shows both categories, strictly necessary locked on and preferences with a switch. Refusing is as easy as accepting, and the site works the same either way: without your consent qp_locale is a session cookie that your browser deletes when you close it, and with it, it lasts one year. Your answer is kept in the qp_consent cookie for 180 days; after that, or sooner if our categories change, the banner asks again.
You can change your choice at any time through Cookie preferences at the foot of every page of this website. The change takes effect at once, including on a language cookie you already have. If we ever add another kind of cookie that is not strictly necessary, we will ask for your consent before setting it, and you will be able to withdraw it as easily as you gave it.
You can also block or delete cookies in your browser's settings. If you block qp_locale, pages follow the language your browser asks for. If you block the console's session cookies, you cannot sign in.
6Changes to this policy
When we add, remove or change a cookie, we update the table above and the date at the top of the page.
7Contact
Questions about cookies or about your personal data can be sent to privacy@quickpentest.com. Our Privacy Policy explains how we handle personal data and the rights you have.