Privacy & security

GST360 keeps browser authentication in a protected, HTTP-only session cookie. Access and refresh tokens are handled by the server and are not written to browser storage.

Tenant scope is resolved from the workspace host and verified by the GST360 API. Financial dashboard data is requested only for the authenticated tenant context.

For organisation-specific retention, access, or privacy questions, contact your GST360 tenant administrator.