Which cookies run before I choose?

None of our first-party cookies run before you choose. The consent cookie is written when you Accept all, Reject all, or Save choices. In the EEA, the UK, and when region is unknown, Cloudflare Web Analytics does not load until you opt in to analytics.

How do I withdraw later?

Open Cookie settings in the footer. Reject all, or turn analytics and marketing off and save. Global Privacy Control also turns marketing off on every visit, even if you accepted marketing earlier.

Do you run Google Analytics or LinkedIn Insight?

No. Those tags are not on this site. A later change would put them behind marketing consent. They are not in the table because the staging scan did not load them.

What about the HubSpot form on the demo page?

The form loads when you open Book a demo, because that is the request you made. If marketing is off, the embed sets HubSpot do-not-track cookies so HubSpot does not run marketing cookies in the EEA before consent.

// legal · cookies

Cookies we set on this site

Rows come from an HTTP scan of this site on 11 September 2026, plus the first-party consent cookie this site writes after you choose. We do not invent names we did not see.

This page set is a draft until counsel ratifies it. The table is a scan, not a legal classification of every cookie.

Hillstrong Group Security uses cookies and similar storage on hillstrongsecurity.com so the site can run and, where you allow it, so we can see traffic. Read the privacy policy for how we handle personal information.

How choices work

Necessary storage records your choice. Analytics is the Cloudflare Web Analytics beacon. Marketing is for ad and HubSpot marketing cookies. LinkedIn Insight and Google Analytics 4 are not on this site. Display fonts are self-hosted.

EEA and UK visitors: analytics and marketing stay off until you opt in. US visitors: analytics runs until you opt out. Marketing stays off when your browser sends Global Privacy Control. If we cannot see your region, we wait for opt-in. See Do not sell or share.

Cookie settings

to Accept all, Reject all, or save categories. Reject all uses the same button size and color as Accept all. You can withdraw later from the footer.

Scan method

HTTP GET of https://hillstrongsecurity.com/ and https://hillstrongsecurity.com/demo/ on 11 September 2026 (scan ran against the staging hostname before cutover). Response Set-Cookie headers were empty on both URLs. The homepage HTML loaded Cloudflare Web Analytics (static.cloudflareinsights.com/beacon.min.js). The demo HTML also loaded https://js.hsforms.net/forms/embed/v2.js. Fetching that HubSpot script returned Set-Cookie __cf_bm on domain hsforms.net. No first-party cookie was present on the site in that HTTP scan.

Processors we know

Cloudflare Pages hosts the static site.
Cloudflare Web Analytics is an analytics beacon. It is not necessary. It does not load in the EEA, the UK, or unknown regions until you opt in to analytics.
HubSpot (portal 49160317) runs demo and newsletter forms. The demo form loads for anyone who opens Book a demo. HubSpot marketing cookies stay off in opt-in regions until marketing consent.
Microsoft Bookings runs meeting scheduling on the demo page.

Necessary only

Reject all, or EEA/UK/unknown before a choice. HTTP scan: no first-party cookies. After you choose, this site writes hgs_consent. On the demo page with marketing off, the form embed writes HubSpot opt-out cookies.

Name	Provider	Purpose	Duration	Evidence
hgs_consent	Hillstrong (first-party)	Stores analytics and marketing choices	180 days	Written by this site after Accept, Reject, or Save. Not on the HTTP scan (CMP was not live).
__hs_opt_out	HubSpot, set by our demo form when marketing is off	Tells HubSpot the visitor opted out of tracking	180 days	Set by HubSpotForm.astro. Not on the HTTP scan.
__hs_do_not_track	HubSpot, set by our demo form when marketing is off	Tells HubSpot not to track this browser	180 days	Set by HubSpotForm.astro. Not on the HTTP scan.

Analytics on

Cloudflare Web Analytics. The site HTML included the beacon script with token 01e48cf3818f424794e394ddd7348f4e. Fetching beacon.min.js returned no Set-Cookie. This scan found no analytics cookie on the site.

Name	Provider	Purpose	Duration	Evidence
None observed	Cloudflare Web Analytics	Page view beacon to static.cloudflareinsights.com	No cookie	Script present on staging HTML. No Set-Cookie on the beacon response. Held in EEA/UK/unknown until analytics consent.

Marketing on

No LinkedIn Insight and no GA4 on staging. First-party HubSpot tracking cookies were not in the staging HTTP Set-Cookie headers. The only HubSpot-related cookie this scan captured is Cloudflare bot management on the HubSpot forms CDN.

Name	Provider	Purpose	Duration	Evidence
__cf_bm	Cloudflare on hsforms.net	Bot management on the HubSpot forms script host	About 30 minutes (Expires on the Set-Cookie we received)	Set-Cookie on GET https://js.hsforms.net/forms/embed/v2.js. Domain=hsforms.net. Not a hillstrongsecurity.com cookie.

This page is not a GDPR policy. See terms of use.

// cookies FAQ

Cookie questions

Which cookies run before I choose?: None of our first-party cookies run before you choose. The consent cookie is written when you Accept all, Reject all, or Save choices. In the EEA, the UK, and when region is unknown, Cloudflare Web Analytics does not load until you opt in to analytics.
How do I withdraw later?: Open Cookie settings in the footer. Reject all, or turn analytics and marketing off and save. Global Privacy Control also turns marketing off on every visit, even if you accepted marketing earlier.
Do you run Google Analytics or LinkedIn Insight?: No. Those tags are not on this site. A later change would put them behind marketing consent. They are not in the table because the staging scan did not load them.
What about the HubSpot form on the demo page?: The form loads when you open Book a demo, because that is the request you made. If marketing is off, the embed sets HubSpot do-not-track cookies so HubSpot does not run marketing cookies in the EEA before consent.