Cookie Policy & Preference Center
This Cookie Policy explains how Systemics Inc., d/b/a Echelon Fleet Systems (“Echelon,” “Echelon Fleet Systems,” “we,” or “us”) uses HTTP cookies, OAuth 2.0 PKCE security verifiers, and browser localStorage keys across https://echelonfleet.com and its subdomains. Echelon does not use third-party advertising pixels, cross-site behavioral tracking cookies, or data-broker retargeting beacons.
1. Complete Cookie & Local Storage Inventory (`echelonfleet.com`)
The table below enumerates every first-party cookie and browser storage key used by the Echelon web console, authentication flows, and public marketing surface:
| Key / Cookie Name | Category | Mechanism & Domain | Retention | Purpose |
|---|---|---|---|---|
| echelon_token | Strictly Necessary | HTTP Cookie / LocalStorage echelonfleet.com | Session / 24 hours | Authenticates your active console session and binds API requests to your isolated tenant org_id under PostgreSQL Row-Level Security. |
| echelon_oauth_state | Strictly Necessary | HTTP-Only SameSite=Lax Cookie echelonfleet.com | 10 minutes (Single-Use) | Cryptographic state and PKCE code_verifier nonce preventing Cross-Site Request Forgery (CSRF) and authorization code interception during Google OAuth 2.0 and Microsoft Entra ID SSO flows. |
| echelon_csrf | Strictly Necessary | HTTP Cookie echelonfleet.com | Session | Protects state-mutating POST/PUT/DELETE requests against cross-origin request forgery. |
| echelon_theme | Functional | LocalStorage echelonfleet.com | Persistent (1 year) | Stores your explicit editorial light-mode or dark-mode interface preference across page loads. |
| echelon-finance-dashboard-v2 | Functional | LocalStorage echelonfleet.com | Persistent | Persists customized financial KPI card ordering and layout preferences in the Finance Console. |
| echelon_cookie_consent | Functional | LocalStorage echelonfleet.com | 12 months | Records your granular cookie and telemetry consent choices configured in the Preference Center on this page. |
2. Google OAuth 2.0 & Microsoft Entra ID Authentication Cookies
When you initiate Single Sign-On via Google OAuth 2.0 or Microsoft Identity Platform (Microsoft Entra ID / Azure AD), Echelon sets a short-lived, cryptographically signed echelon_oauth_state cookie containing a 128-bit random state nonce and PKCE code_verifier (RFC 7636). While you are on accounts.google.com or login.microsoftonline.com, Google or Microsoft may set their own authentication cookies governed by their respective privacy policies. Upon redirect back to https://echelonfleet.com, the temporary echelon_oauth_state cookie is immediately verified and cleared.
3. Global Privacy Control (GPC) & Browser Controls
Echelon honors the Global Privacy Control (GPC) browser signal (Sec-GPC: 1) under the California Consumer Privacy Act (CCPA/CPRA) and applicable state privacy statutes by defaulting non-essential telemetry to off. You can also clear cookies and localStorage at any time through your browser settings or use the interactive Preference Center above. For additional information on how we process personal data, please review our Privacy Policy or email privacy@echelonfleet.com.
Questions regarding OAuth verification, privacy, or enterprise compliance? Contact legal@echelonfleet.com or privacy@echelonfleet.com.