Cookie Policy
Last updated: September 2026
1. What are cookies?
Cookies are small text files that are stored on your device when you visit a website. They are widely used to make websites work, to make them more efficient, and to provide information to the owners of the website.
2. Which cookies do we use?
NIS2Certify uses strictly necessary cookies that are required for the functioning of the application, and analytics cookies (Google Analytics) that are only placed after your explicit consent.
| Cookie | Purpose | Type | Retention period |
|---|---|---|---|
| sb-*-auth-token | Authentication and session management. Keeps you logged in during your visit to the application. Managed by Supabase (our authentication provider). | Strictly necessary | Session / until logout |
| admin_impersonating | Tracks when a platform administrator views another user account for support purposes. Visible to administrators only. | Functional | 4 hours |
| _ga | Google Analytics — distinguishes unique visitors for website statistics. Only placed after your consent. | Analytics | 2 years |
| _ga_* | Google Analytics — stores the session state for collecting anonymous usage statistics. Only placed after your consent. | Analytics | 2 years |
Session recording (Umami): on our public marketing pages (including the free Quick Scan and the NIS2 assistant) we use Umami, self-hosted by us in the EU at analytics.nis2certify.org, for session replays and heatmaps. It records clicks, scrolling and mouse movements, together with the layout of the page. All text on the page and everything you type is masked (Umami's "strict" level), so it is not visible in the recordings. We never record in the logged-in dashboard or the assessment environment. Recordings are kept for a maximum of 30 days. Recording only starts after you give consent via the cookie banner, and Umami does not place any cookies for it.
3. Consent
Under the European ePrivacy Directive (Article 5(3)), cookies that are strictly necessary for the provision of a service requested by the user are exempt from the consent requirement. Our authentication and session cookies fall under this exemption.
For analytics cookies (Google Analytics) and session recording (Umami) we request your explicit consent in advance via the cookie banner. These cookies are only placed, and recording only starts, after you click "Accept all". You can change your choice at any time by clearing the site data (cookies and local storage) for nis2certify.org in your browser.
4. Managing cookies
You can manage or delete cookies via the settings of your web browser. Most browsers offer the option to:
- View and delete all cookies
- Block cookies from specific websites
- Block third-party cookies
- Clear all cookies when you close the browser
Please note: if you block or delete our cookies, you will not be able to log in to NIS2Certify and the application will not be usable.
5. Contact
Do you have questions about our cookie policy? Contact us at privacy@nis2certify.org.
Also read our privacy policy for more information about how we handle your personal data.