This page describes the personal data processed and stored by the Shibboleth Metadata administration site, and the cookies that the site uses.

Data stored explicitly

Each metadata registration made on this site includes a record of who is allowed to manage that registration. A history of changes is also retained which includes details of previous managers. The change history also records details of who made each change. The history is retained indefinitely.

Data stored incidentally

Standard Apache logs are kept, recording certain details of every HTTP[S] interaction. These logs are deleted after 52 weeks. Beyond that point only anonymous statistical data is kept for reporting purposes.

Relevant log files may be retained for longer if an investigation is under way for the purposes of assisting with the investigation.

Details stored in the standard Apache log files:

• Internet address of connecting client
• Time stamp
• Request made
• Server's response code and number of bytes returned
• The "user agent" string identifying the make of client

Cookies

The Shibboleth Metadata administration site sets two cookies that are essential for the operation of the site. Both are set when you first visit the site during a browsing session and will be deleted by your browser when that session ends. Both contain an alphanumeric value that uniquely identifies your current browsing session and which is used internally by the site for session management. These cookies have the names 'sessionid' and 'csrftoken'.