Legal
Cookie Policy
Everything Sustain AI Index stores in your browser, what each item is for, and how long it lasts. This page is generated from the same register the consent dialog reads, so it cannot describe cookies the software no longer sets.
Last updated 17 September 2026
1. What this site sets
The public site — the pages you are reading now, including the registry and the methodology — sets no cookies and writes nothing to your browser’s storage. There is no analytics, no advertising, and no third-party tracker on it.
The one exception is the record of your own cookie choice, described in section 4. It exists only once you have made a choice.
2. Categories and what is in them
Cookies are grouped by what they are for. Only the necessary category is active today; the others are listed so you can see that they are empty rather than unmentioned.
Necessary
Required for the service to work at all: signing in, keeping a session secure, and holding the short-lived state behind an invitation or a password reset. These cannot be switched off.
| Name | Purpose | Duration | Set on |
|---|---|---|---|
| sb-<project>-auth-tokenCookie · First party | Keeps you signed in to your portal. Set only after you sign in. | Until you sign out, or the session expires | Portal only |
| sb-<project>-auth-token-code-verifierCookie · First party | A one-time value that ties a sign-in or password reset to the browser that started it. | Minutes — cleared as soon as sign-in completes | Portal only |
| inv_sessionCookie · First party | Remembers that you opened a valid invitation link, so the token never has to travel further. | Until the invitation is accepted or the browser closes | Portal only |
| password_recovery_contextCookie · First party | Proves the current session came from a password reset link. Expires after ten minutes. | Ten minutes | Portal only |
| Assessment draft stateBrowser storage · First party | Holds the answers you are part-way through so the page can show your progress. Cleared when you sign out. | Until you sign out | Portal only |
Functional — nothing is active
Remembers choices you make about how the service behaves, beyond what it needs to run. No service in this category runs on this site or in the portal today, so nothing is set even if you allow it.
Analytics — nothing is active
Measures how the service is used, so it can be improved. Nothing here is used to identify you. No service in this category runs on this site or in the portal today, so nothing is set even if you allow it.
Marketing — nothing is active
Advertising and cross-site tracking technologies. No service in this category runs on this site or in the portal today, so nothing is set even if you allow it.
3. The portal, and why it differs
The supplier, auditor and registry portals are a separate application on a separate host. Logging in there necessarily sets a session cookie — that is what being signed in means — along with short-lived cookies for an invitation or a password reset in progress. Each is listed in section 2.
All of them are strictly necessary: they exist because you asked for the thing they enable, none measures your behaviour, and none is shared for advertising. Under section 3-15 of the Norwegian Electronic Communications Act, storage that is strictly necessary to provide a service you expressly requested does not require consent, which is why signing in does not ask.
4. The record of your choice
When you answer the cookie banner, your answer is stored in a first-party cookie named sai_privacy. It holds your decision for each category and the date you made it — nothing else, and nothing that identifies you.
It lasts six months, after which the banner asks again. Consent is treated as something that expires rather than something given once.
The record is kept per site: a choice made here does not carry over to the portal, and the portal asks separately.
5. Changing or withdrawing your choice
You can change your answer at any time, and withdrawing is as easy as giving it — reopens the same dialog from the footer of any page.
You can also clear cookies in your browser. Doing so removes the record of your choice, so the banner will ask again on your next visit. Blocking storage entirely does not break the site; it means the answer cannot be remembered.
6. Changes to this policy
Any new cookie or storage key has to be added to the register this page is generated from before it can ship, so this policy changes at the same time the software does. Material changes are reflected in the date at the top.
Questions about anything here can go to hello@sustainaiindex.com. How we handle personal data more broadly is covered by the Privacy Policy.