Security & Safeguards · Company practice
Security and fraud cookies are listed as strictly necessary
The strictly necessary table includes Cloudflare Bot Management, a CSRF-prevention token, a device-recognition and fraud-prevention token, and two cookies described as fraud detection and checkout continuity. The fraud-detection descriptions say the data is necessary to improve the checkout experience and understand customer friction. The listed terms are a few seconds for the bot-management cookie, Session for the CSRF token, and one year for the device-recognition, fraud and checkout cookies.
Details not recorded for this card
Supporting quotations
__cf_bm
This CloudFoundry cookie is necessary to support Cloudflare Bot Management. As part of our bot management service, this cookie helps manage incoming traffic that matches criteria associated with bots.
A few seconds
affirm-csrf-token
A secure random token (e.g., synchronizer token or challenge token) that is used to prevent CSRF attacks. A CSRF secure application assigns a unique CSRF token for every user session.
Session
fp_token_xxxx-xxxxx-xxxx-xxxxxx
Assists with device recognition and fraud prevention.
1 Years
t_v2_s
This cookie helps detect fraud and provides continuity between each of your checkout attempts with Affirm. This data is necessary for Affirm to improve your experience by understanding where you and other customers are experiencing friction as you use our product.
1 Years
checkout_continuity_service
This cookie helps detect fraud and provides continuity between each of your checkout attempts with Affirm. This data is necessary for Affirm to improve your experience by understanding where you and other customers are experiencing friction as you use our product.
1 Years
Qualifications & exceptions
- The notice states that strictly necessary cookies are always enabled.
Not stated here
- The notice does not explain why fraud detection and checkout continuity are treated as strictly necessary rather than functional or performance cookies.