Audit It

1. What are cookies

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work, to remember your preferences, and to provide information to the website owner about how the site is being used.

2. Cookies we use

Strictly necessary cookies — These cookies are essential for the Service to function. They include session cookies that keep you logged in and security cookies that protect against cross-site request forgery. These cookies cannot be disabled.

Analytics cookies — With your consent, we use Google Analytics (GA4) and Google Tag Manager to understand how visitors use our site. This data is aggregated and anonymised. You can opt out at any time by adjusting your cookie preferences via the "Cookie preferences" link in the footer.

3. Third-party cookies

We may use third-party services that set their own cookies, including Google Analytics. These third parties have their own privacy policies. We do not control the cookies set by third parties.

4. Managing cookies

You can manage your cookie preferences at any time using the "Cookie preferences" link in the footer of any page. You can also control cookies through your browser settings — most browsers allow you to refuse or delete cookies. Note that disabling certain cookies may affect the functionality of the Service.

5. Contact

For questions about our use of cookies, contact us at contact@auditit.io.

auditit_trial_device is an HttpOnly, SameSite=Lax cookie with a 35-day lifetime, set only when an agency owner starts a trial, not merely when a visitor opens a public page. In production it is Secure. It contains a signed random device identifier used for repeated-trial checks; corresponding server-side identifiers are hashed. It is not an advertising identifier. Deleting it does not erase existing identity or website claims or guarantee eligibility for another trial.

The existing sid session cookie authenticates account sessions and has a 24-hour configured lifetime, with HttpOnly and the deployed secure/same-site settings. Session/database expiry and browser restrictions must be checked against actual deployment behavior before describing it as persistent or strictly necessary. Keep existing non-essential analytics/advertising consent choices; do not reclassify all cookies as essential because a trial is added.

The proposed purpose of the trial device cookie is abuse prevention. Whether it is exempt from consent as strictly necessary, and how it should appear in the banner/preferences inventory, requires professional review.

Cloudflare Turnstile (trial-start step only)

When trials are enabled, the trial-start step loads Cloudflare Turnstile to protect the trial request from automated abuse. It runs in a frame served by Cloudflare. It does not load on normal registration, paid checkout or customer audit embeds. Declining analytics does not prevent this security check.

Turnstile stores the following on your device:

We have not observed Turnstile setting any cookies. Cloudflare's own documentation describes an optional cookie, cf_clearance, used with pre-clearance; we do not enable pre-clearance. We use this security check to protect the trial request you have asked to make, independently of analytics consent. If you block the check or its storage, you may be unable to complete the trial-start step; please contact us at contact@auditit.io. See Cloudflare's Cookie Policy and Turnstile Privacy Addendum for more information. We will update this list if it changes.

Version 1.1; effective 2026-11-03.

Change log: UK/USA business-only supply; no VAT charged; same USD price with a maximum-charge promise; updated privacy and trial wording.