Cookies & Browser Storage

1. Sign-in and security cookies

The luminar_session cookie keeps your authenticated session. It is HttpOnly and uses Secure in production and SameSite protections. The session has an eight-hour maximum and is subject to a fifteen-minute inactivity limit enforced by the server. Logout clears the app session cookie.

Short-lived luminar_mfa and luminar_oauth cookies support authentication challenges and OAuth protections where those flows are used, with a five-minute lifetime. The internal ‘luminar’ names are legacy identifiers for CredVaultMD. Authentication and hosting providers may use additional security cookies on their own domains.

2. Display preferences and setup

Local storage under credvaultmd.workspace-design remembers your Classic or Hybrid layout until you clear it or change it. It does not contain your uploaded documents or passwords.

If you choose an NPI record and continue setup, session storage can retain the selected public NPI and a setup timestamp in that browser tab for up to one hour. This lets you return after sign-in without repeating the search. It is cleared on completion or cancellation and does not grant access to a vault.

3. Analytics and affiliate links

The site does not install advertising pixels. Cloudflare Web Analytics may measure page views and loading performance on public pages through a cookie-free beacon supplied by our hosting provider. Affiliate redirects count a link identifier and click time on our server without setting an attribution cookie. A destination website may use its own cookies after you leave CredVaultMD; its policy applies there.

4. Your controls

You can clear site cookies and storage in your browser settings. Blocking sign-in cookies may prevent authentication; clearing layout storage resets your design preference. Clearing browser storage does not delete records stored in your vault. Use document controls or contact support@credvaultmd.com for account-data requests.