Cookie Policy

Last updated: 2026-09-27

What are cookies?

Cookies are small text files stored on your device when you visit a website. They help the site function correctly and remember your preferences.

Cookies we use

Essential cookies are set without asking for your consent — the platform cannot function without them. Each entry below states when it is set. The functional and privacy cookies listed alongside them are not subject to consent either: a theme choice, a Global Privacy Control signal and a consent decision can only be honored by storing them. Optional performance-monitoring cookies are set only if you explicitly accept optional cookies, and never when your browser sends a Global Privacy Control signal.

Names are shown in their production form. Three of them — Secure-authjs.session-token, Host-authjs.csrf-token and Secure-authjs.callback-url — are stored by your browser with a Secure- or __Host- prefix on the secure (HTTPS) site, and appear as authjs.session-token, authjs.csrf-token and authjs.callback-url on a local non-HTTPS development build. Every other cookie name below is the same in both cases.

Cookies that are not subject to consent

  • __Host-prism-device: Essential. Lets a personal survey link tell your devices apart, so the link works on up to four devices and on one at a time. Set when you open a survey page, and renewed on each visit. Holds a random value that names your browser, never you. HttpOnly, Secure, SameSite=Lax. Expires 30 days after your last visit to a survey page.

  • __Secure-authjs.session-token: Essential. Manages your authenticated session. Set when you sign in. HttpOnly, Secure, SameSite=Lax. Expires 4 hours after you sign in, whether or not you are active.

  • csrf-token: Essential. Protects form submissions against cross-site request forgery. Set on any page request that does not already carry it, and left alone after that. Readable by our own page scripts, which must send it back with each submission, so it is deliberately not HttpOnly. Secure, SameSite=Strict, 1 day.

  • __Host-authjs.csrf-token: Essential. Protects the sign-in routes against cross-site request forgery. Set when you first reach one of those routes. HttpOnly, Secure, SameSite=Lax. No expiry is set, so your browser discards it when you close it.

  • __Secure-authjs.callback-url: Essential. Remembers the address to return you to as you move through a sign-in, sign-out or callback step. Set on requests to our authentication routes whenever the return address resolved for that request differs from the one already stored. HttpOnly, Secure, SameSite=Lax. No expiry is set, so your browser discards it when you close it.

  • prism.ui.theme: Functional. Remembers whether you chose the light or dark theme. Set only when you pick a theme. Persistent, 1 year.

  • prism-gpc-opt-out: Privacy. Records that your browser sent a Global Privacy Control signal. Set on any request that carries the signal. Persistent, 1 year.

  • prism-cookie-consent: Privacy. Records your cookie consent preference. Set when you accept or decline optional cookies. Persistent, 1 year.

Optional cookies (set only with your consent)

  • cwr_s / cwr_u: Optional. Performance monitoring. Set only if you accept optional cookies and your browser is not sending a Global Privacy Control signal, and only on signed-in pages. Telemetry is sent to Veeam's own monitoring service; no advertising or cross-site tracking. Cleared if you later decline.

No advertising or cross-site tracking cookies

We do not use advertising, social media, or cross-site tracking cookies. We do not use Google Analytics, Facebook Pixel, or any similar services. The only performance-related cookies we set are the optional monitoring cookies listed above, and only with your consent.

Managing cookies

You can delete or block cookies through your browser settings. Note that blocking essential cookies may prevent the platform from functioning correctly. You can change your choice about optional cookies at any time by clearing the prism-cookie-consent cookie, after which the consent banner is shown again.

Global Privacy Control

We honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we treat it as an opt-out of any non-essential data processing and set no optional cookies.

Questions

Questions about cookies or this policy: m.ruffin@veeam.com. See also our Privacy Notice.

Last updated: Oct 3, 2026 | Privacy Policy