Cookie notice, version ck-1
Version ck-1, published 2026-11-10, effective 2026-11-10. Each version is fixed once published; a change is a new version. SHA-256 63945eb24af578f5de59bed5b64057241d7faaadbb4bbb6c360cdd083ebad5be. This version's fixed copy.
. The notice
Sovrasign Cookie Notice. Version ck-1, effective 10 November 2026.
In short: we use only the cookies and device storage our service needs to work, such as keeping you signed in. No advertising cookies, no tracking across sites, no third-party analytics, no fingerprinting for analytics. We use security signals to protect accounts, and Stripe checks your browser on payment pages to prevent fraud (A6). That is why you see no cookie banner.
A1. What this notice covers
Cookies are small files a website stores in your browser. Websites can also keep data in your browser in other ways ("local storage", "session storage", "IndexedDB"). This notice lists everything Sovrasign stores on your device on its web app, its signing page, its verifier and its websites, and what our apps keep on your device. Read it with our privacy policy.
A2. Why there is no consent banner
The law in the EU, the EEA and the UK allows a website to store information on your device without asking only when it is strictly necessary for a service you asked for. Everything listed below meets that test: it signs you in, keeps your session secure, remembers a choice you made, or protects a payment you are making. We use nothing else. If we ever want to use a cookie that is not strictly necessary, we will first ask you with a banner where "Accept" and "Reject" are equally easy, and update this notice.
A3. The web app
| Name | What it does | How long | Status |
|---|---|---|---|
sovrasign_access | Keeps you signed in: a short-lived access token sent only to our API. Your browser's scripts cannot read it | 10 minutes, renewed while you use the app | In use |
sovrasign_refresh | Renews your sign-in without asking you again; changes every time it is used, so a stolen copy is detected. Sent only to the address that renews sessions | Up to 30 days, removed when you sign out. The session it renews ends earlier after 12 hours without use | In use |
sovrasign_signin | Ties the sign-in you started to the answer from Google, Microsoft or Apple, so no one else can finish it | 10 minutes | In use |
sovrasign_region | Remembers which region your account is in (for example "us"), so sign-in goes to the right place even when our directory is unavailable. Holds no email address | 12 months | In use |
sovrasign.language (local storage) | Only if you choose a language in Settings > Language: shows the web app in it in this browser. Holds only the language code (for example "fr") and is never sent to our servers | Until you choose "Automatic" again or clear your browser's site data | In use |
sovrasign_crash_reports (local storage) | Only if you turn "Send crash reports" off in Settings > Privacy: remembers that this browser must not send crash reports, even before you sign in. Holds only the word "off" and is never sent to our servers | Until you turn crash reports on again or clear your browser's site data | In use |
sovrasign_device | Recognizes this browser when you sign in, so we can warn you by email when someone signs in to your account from a browser it has not used before. A random code with no meaning of its own; we keep only a fingerprint of it with your account. Sent only to the account addresses of our API, and your browser's scripts cannot read it | 400 days after you last signed in with this browser; your account forgets the browser at the same time | In use |
All our cookies are first-party (set by our own site), sent only over encrypted connections, and marked so that other websites cannot make your browser send them (SameSite=Strict). The sign-in cookies are HttpOnly: page scripts cannot read them.
When you choose Google, Microsoft or Apple to sign in, their pages open, and they use their own cookies under their own policies.
A4. The signing page
| Name | What it does | How long | Status |
|---|---|---|---|
sovrasign_signer | Keeps your signing session open after you open the link from your invitation, so the link itself is not sent again with every step. Your browser's scripts cannot read it | 2 hours, never longer than the link | In use |
sovrasign_oidc | Ties the sign-in you start to confirm who you are before signing (with Google, Microsoft or Apple) to their answer, so no one else can finish it. The web app uses it too when you confirm a document you send. Your browser's scripts cannot read it | 10 minutes, removed when the sign-in finishes | In use |
sovrasign_remember (local storage) | Only if you tick "Remember my choice on this device" (off by default; kept in this browser and never sent to our servers): remembers which sign-in you used (for example "Microsoft") for a coded version of your email address, so the same button comes first next time on this device. Holds no readable email address and no token, only the provider name and the coded address. "Forget this device" on the signing page removes it | 12 months | In use |
sovrasign_crash_reports (local storage) | Only if you choose "Don't send them" in the page's footer: this browser then sends no crash reports from the signing page. Holds only the word "off" and is never sent to our servers | Until you choose "Send them" or clear your browser's site data | In use |
sovrasign_language_switch (session storage) | Only when you change the page's language: your answers so far, while the page reloads in the new language, so you do not lose them. Kept in this tab only and never sent to our servers | Removed as soon as the page has reloaded | In use |
sovrasign_signer_key (IndexedDB) | Only when the page takes you to Google, Microsoft or Apple to sign in (on a phone, or when your browser blocks the sign-in pop-up): the one-time signing key for this document, locked with a key that cannot be copied out of the browser, with the sign-in's request. Never sent to our servers | Deleted when you come back and sign, after 10 minutes at most, and when you finish | In use |
sovrasign_redirect, sovrasign_redirect_result, sovrasign_redirect_view (session storage) | In the same case: the sign-in's request and the provider's answer, and your answers so far, so the page can continue when you come back. Kept in this tab only and never sent to our servers (the provider's answer goes to us only to finish the sign-in, as with the pop-up) | Removed as soon as the page has come back, and when you finish | In use |
sovrasign_signer_work (IndexedDB) | Only when you cannot reach us while signing, so you can pick up where you left off: the signed document when the connection dropped before it reached us (sent as soon as the connection returns, also when you open the link again later), and your answers while we cannot be reached. Private envelopes are not available yet; we will describe their local storage before they are. Never used for anything else | Each part is deleted as soon as it has reached us, and everything when you finish. If you do not come back, it is deleted when you next open the signing page 30 days or more after you last used it, or when you clear your browser's site data | In use |
A5. The verifier
| Name | What it does | How long | Status |
|---|---|---|---|
signpdf.trust.v1 (local storage) | Keeps the list of trusted public keys (from Google, Microsoft, Apple and Sovrasign) that the verifier checks signatures against, so verification also works offline. Contains no personal data. The documents you verify are checked in your browser and never uploaded | Until you clear your browser's site data | In use |
sovrasign.trust-list.v1 (local storage) | The signed list of trusted keys that the verifier and the signing page check signatures against, as last downloaded from us, so verification also works offline. It is believed only when our signature on it checks out. Contains no personal data | Replaced when a newer list is downloaded; otherwise until you clear your browser's site data | In use |
A6. Payments
| Name | What it does | How long | Status |
|---|---|---|---|
__stripe_mid | Set by our payment provider Stripe on our billing pages only, to prevent card fraud | 1 year | Planned (with paid plans) |
__stripe_sid | Set by Stripe on our billing pages only, to prevent card fraud during your visit | 30 minutes | Planned (with paid plans) |
Stripe's payment form on our billing pages also checks information about your browser and device to detect fraud. When you buy a pack, you may pay on Stripe's own checkout page, where Stripe uses its own cookies under Stripe's cookie policy. We load Stripe's code only on pages where you pay or manage payment details.
A7. Our websites and help center
No cookies, no local storage and no third-party scripts. We count page views from our web servers' logs (see the privacy policy). If we add a statistics tool, it will be one that uses no cookies and no identifiers.
A8. Our desktop and mobile apps
Apps do not use cookies. They keep on your device: your sign-in, in the operating system's secure storage (Keychain, Keystore or Windows' protected storage); your envelopes and cached documents, encrypted with a key that only this device holds; your offline documents, wherever you save them; and your settings. The apps contain no advertising or third-party analytics code. Crash reports are cleaned of personal data on your device before they are sent, and you can turn them off.
A9. What we do not use
- advertising, retargeting or social-media cookies or pixels;
- third-party analytics, heat maps or session recordings;
- fingerprinting your browser or device to recognize you across visits for analytics;
- tracking pixels in emails. Getting-started and news emails count which links were clicked; service emails such as invitations contain no tracking;
- usage events from your device that the service does not need, unless you opt in (privacy policy A3.5). Your choice is saved in your account, not in a cookie.
A10. Your choices
- You can block or delete cookies in your browser's settings. If you block the cookies in A3 or A4, you cannot sign in or sign documents.
- "Forget this device" on the signing page removes the item of A4 (
sovrasign_remember) that remembers your sign-in choice. - Global Privacy Control: if your browser sends this signal, we treat it as a request to opt out of any sale or sharing of your personal information. We do neither, so nothing else changes.
- Your browser also keeps copies of our page files in its normal cache so that pages load faster. They contain no personal data.
A11. Changes and contact
When we change what we store, we update this notice first and give it a new version and date. A new item that is not strictly necessary would come with a consent banner first (A2). Questions: privacy@sovrasign.com.