Cookie policy

This policy covers what is stored on your device by the Baobyte public website and by the authenticated Baobyte AML Suite workspace. It uses “cookies” loosely, as the law tends to: the same rules apply to browser storage that is not technically a cookie, and both are listed here.

Where an institution runs the platform on its own infrastructure, this policy describes what the software stores. The institution’s own notice governs its own deployment.

A cookie is a small file a site asks your browser to keep and send back on later requests. Local storage is a similar store that stays on your device and is never sent automatically — the site’s own code has to read it and decide what to do.

The distinction matters here, because two of the things this site stores are local storage rather than cookies, and they never leave your machine at all.

Optional cookies are off until you turn them on. That is the actual default in the stored record, not a description of an intention: there is no state in which an optional category is pre-selected.

• Rejecting is one click, from the banner. It is the same size and the same emphasis as accepting, and there is no dialog in the way. The banner has no dismiss-without-deciding control, because a close button that stores nothing is a fake choice and one that stores acceptance is a lie.
• A Global Privacy Control signal is honoured as a rejection, and the banner is not shown. If you have already told your browser to opt you out, asking again is nagging.
• You can change your mind at any time using the cookie settings control in the site footer, which reopens the same preferences dialog.
• The banner does not appear at all without JavaScript. With scripting off, nothing is measured, so there is nothing to consent to and no way to record an answer. Showing a banner in that situation would be asking permission for something that is not happening.

A recorded choice is asked again after six months, and is invalidated early if the purposes materially change — a new category, a new purpose or a new processor. Consent given to one set of purposes is not consent to a different set.

The six-month interval and the change-triggers that force a re-ask have not been confirmed against Nigerian supervisory expectations.

These make the site do the thing you asked it to. They cannot be switched off, and no consent is sought for them.

• baobyte_marketing_consent — records the cookie choice you made on this screen so you are not asked again. Holds a version number, a timestamp and two true/false values, and nothing else: no identifier, no session material. Readable by the site’s own code, deliberately, because that code has to know before it does anything whether it is allowed to. Six months.
• baobyte-marketing-consent — a local-storage mirror of the same record. Two stores are used because each covers a real failure of the other: a browser set to clear cookies on exit keeps local storage, and some browsers cap the life of a script-written cookie at a few days while leaving local storage alone. The cookie wins where both exist. Until you clear site data.
• baobyte_token — the workspace session. Set only after you sign in. Marked HttpOnly so page code cannot read it, and SameSite=Lax. An absolute session deadline is enforced on the server as well, rather than relying on the cookie’s own expiry. Until the session ends.
• baobyte_tenant — records which institution’s workspace the session belongs to. Set only after sign-in. Until the session ends.
• baobyte_oidc_state, baobyte_oidc_nonce, baobyte_oidc_verifier, baobyte_oidc_return — short-lived values that hold a sign-in attempt together and prevent it being tampered with or replayed. HttpOnly. Ten minutes, or until the sign-in completes.
• baobyte_logout_state, baobyte_session_ended — carry a sign-out through the identity provider and back, so the workspace can tell you why your session ended. Until sign-out completes.

If you turn analytics on, this site counts how many people read each page, which links they use, and how far down a page they get. Six event types exist and no more: page_view, cta_click, scroll_depth, form_start, form_step and form_submit.

No cookie is set for measurement. The consent record is the only cookie this feature writes, and it is what makes the rest lawful. What is worth stating as an absence:

• The counts go to this site’s own server. No analytics company is contacted. Every page on this site makes zero requests to any other domain — no external fonts, scripts, images or beacons — because the product is deployed into air-gapped bank installations where a request to an unreachable host is a hanging request rather than degraded analytics. The content security policy enforces the same rule, so a third-party snippet pasted in later would be refused by the browser.
• Your IP address is not stored, and not because it is truncated or hashed: the receiving endpoint never reads a forwarding header, so there is nothing held.
• No profile is built about you. There is no advertising identifier, no cross-site identifier, and no device or browser fingerprinting — no canvas, no font enumeration, no screen metrics, no user-agent, no language list. The only identifier is a random value minted per page view and held in memory; it never touches storage, so a reload produces a different one and two visits cannot be joined.
• No session recording, keystroke capture or form field values, and no search queries — what a visitor types into a search box on an AML vendor’s site can name the institution they work for or the enforcement action they are worried about.
• Only the page path is reported, never a query string or a fragment, and only paths belonging to the public marketing site are accepted at all. Anything from the authenticated workspace is discarded at the server, because a path there (“a case, a customer”) is itself information about a person under investigation.

With analytics off, no measurement request is made at all. It is not sampled, delayed or anonymised — it does not happen.

Remembers display choices so the site looks the same next time. Stored on your own device and never transmitted.

• baobyte-theme-preference — light, dark, or follow your system setting. Local storage. Until you clear site data.

An open question a reviewer must settle: the theme value is read by a script that runs before the page paints, which is necessarily before any consent decision has been made — otherwise the page would flash the wrong colours on every load. It stores nothing about you and is never sent anywhere, which is a reasonable argument that it is strictly necessary rather than a consented preference. That determination has not been made by counsel. If the answer is “preference”, the script must be gated behind consent and this section rewritten.

There are none. This site sets no third-party cookie, loads no third-party script, embeds no third-party font, image or video, and contains no advertising or social media tracking pixel.

That is a structural property rather than a promise: the content security policy for the public pages restricts every resource to this site’s own origin, the automated test suite asserts that a page load produces zero cross-origin requests, and the site is expected to work in an installation with no internet access at all.

Signed-in users of the AML workspace are subject to the strictly necessary cookies in section 4 and to two further local-storage values that exist for usability:

• baobyte-recent-destinations — the last few screens you opened, so the command palette can offer them again. Screen names only.
• baobyte-theme-preference — as described in section 6, shared with the public site.

No analytics run on the authenticated surface. The measurement code is mounted only on public marketing pages, every event carries a path with no query string, and the receiving endpoint rejects any path that is not a public marketing route. Three independent checks, so that removing any one of them does not silently open the boundary.

Every major browser lets you view, block and delete cookies and site data through its settings, and most offer a private-browsing mode that discards them at the end of the session. Your browser’s help pages describe the exact steps.

Blocking the strictly necessary cookies will break sign-in: without them the workspace cannot keep you signed in or tell which institution’s data you are working with. Clearing site data will also clear your recorded cookie choice, so the banner will ask again.

This policy is updated when what is stored changes. Where the change is material — a new category, a new purpose, a new recipient — the recorded consent version is bumped and you are asked again rather than the old answer being reused for a new question.