Cookie complaince

gistfile1.txt

# Cookie and Data Flow Compliance Report

## Rippling Webapp - Code Analysis

**Generated:** October 23, 2025  
**Repository:** rippling-webapp  
**Analysis Type:** Codebase investigation for cookie and data flow compliance

---

## Executive Summary

This report provides a comprehensive analysis of cookies and data flows identified in the Rippling cookie compliance audit. Each item was investigated by examining the actual codebase to determine:

- Whether the service is actively integrated
- The purpose and functionality of each cookie/data flow
- Recommendations for compliance categorization

---

## Part 1: Cookie Compliance Analysis

### 1. RudderStack - `test_rudder_cookie`

**Service:** RudderStack  
**Cookie Name:** `test_rudder_cookie`  
**Purpose:** Functional  
**Activity Level:** 0.00%  
**Domain:** app.rippling.com  
**Created:** 12/25/2022  
**Last Seen:** 9/24/2025

#### Investigation Results

- ❌ **NOT FOUND** in codebase
- No references to RudderStack in any code files
- Zero implementation evidence

#### Recommendation

**✅ MARK AS JUNK / REMOVE**

- This cookie is from a service that is no longer integrated
- 0% activity confirms it's not being used
- Safe to remove from cookie notice

---

### 2. Sentry - `_AMP_TEST`

**Service:** Sentry  
**Cookie Name:** `_AMP_TEST`  
**Purpose:** Analytics  
**Activity Level:** 0.3169%  
**Domain:** als.rippling.com  
**Created:** 5/18/2023  
**Last Seen:** 10/3/2025

#### Investigation Results

- ✅ Sentry IS actively used in the codebase
- ❌ `_AMP_TEST` cookie name NOT found in code
- Sentry initialized in: `app/core/services/initializeRenderBlockingServices.tsx` (line 89)
- Cookie name suggests Amplitude, not Sentry
- Unexpected domain: `als.rippling.com`

#### Code Reference

```typescript
// app/core/services/initializeRenderBlockingServices.tsx
Sentry.init({
  dsn: config.sentryDsn,
  LogRocketService,
  SnackBarService: SnackBar,
  isSpoofed,
  // ...
});
```

#### Recommendation

**⚠️ VERIFY - Possible Miscategorization**

- The `_AMP_TEST` name doesn't match Sentry's cookie patterns
- This may be misattributed in the compliance tool
- **Action:** Verify with Sentry documentation if this is actually their cookie
- If not from Sentry, mark for removal

---

### 3. Amplitude - `^amp_.*`

**Service:** Amplitude  
**Cookie Name:** Pattern matching `^amp_.*`  
**Purpose:** Analytics  
**Activity Level:** 15.39%  
**Domain:** app.rippling.com  
**Created:** 12/1/2022  
**Last Seen:** 10/3/2025

#### Investigation Results

- ✅ Amplitude IS integrated but **indirectly through Segment**
- Events are sent to Amplitude as an "unbundled" destination via Segment
- Amplitude cookies are set because Segment forwards analytics data

#### Code References

**Metadata Configuration:**

```typescript
// app/lib/services/segment/segmentService.web.ts (Line 198-202)
payload._metadata = {
  bundled: ['Segment.io'],
  unbundled: ['Amplitude'],
  bundledIds: [],
};
```

**Session Tracking:**

```typescript
// app/lib/services/segment/segment.ts (Line 197-205)
integrations: {
  Amplitude: {
    session_id: getOrCreateSessionId({ eventTimestamp: timestamp }),
    groups: {
      Company: companyId,
    },
  },
}
```

#### Recommendation

**✅ KEEP - Actively Used**

- 15.39% activity is legitimate
- Analytics events are routed through Segment to Amplitude
- Cookie is necessary for analytics tracking
- References in cross-sell features for cohort IDs

---

### 4. Heap - `^_hp2_hld.*`

**Service:** Heap  
**Cookie Name:** Pattern matching `^_hp2_hld.*`  
**Purpose:** Analytics  
**Activity Level:** 0.00%  
**Domain:** www.rippling.com  
**Created:** 1/18/2023  
**Last Seen:** 4/26/2025

#### Investigation Results

- ❌ **NOT FOUND** in codebase
- No references to Heap analytics
- Zero implementation evidence

#### Recommendation

**✅ MARK AS JUNK / REMOVE**

- Legacy cookie from discontinued service
- 0% activity confirms removal
- Safe to exclude from cookie notice

---

### 5. Amazon Ad Service - `C_.*`

**Service:** Amazon Ad Service  
**Cookie Name:** Pattern matching `C_.*`  
**Purpose:** Analytics  
**Activity Level:** 0.00%  
**Domain:** app.rippling.com  
**Created:** 10/4/2023  
**Last Seen:** 9/23/2025

#### Investigation Results

- ❌ **NOT FOUND** in codebase
- Only AWS (Amazon Web Services) infrastructure references found
- No advertising service integration

#### Recommendation

**✅ MARK AS JUNK / REMOVE**

- Not used for advertising
- 0% activity confirms no usage
- Safe to remove from cookie notice

---

### 6. rB2B - `_reb2bsessionID`

**Service:** rB2B  
**Cookie Name:** `_reb2bsessionID`  
**Purpose:** Analytics  
**Activity Level:** 40.48%  
**Domain:** www.rippling.com  
**Created:** 5/13/2024  
**Last Seen:** 10/3/2025

#### Investigation Results

- ❌ **NOT FOUND** in application codebase
- Despite 40.48% activity, no code references exist
- rB2B is a third-party B2B visitor identification service

#### Likely Source

- External tag management system (Google Tag Manager)
- Third-party marketing scripts
- Browser extensions
- Marketing website scripts (separate from app)

#### Recommendation

**⚠️ CHECK TAG MANAGER / EXTERNAL SCRIPTS**

- This is NOT set by application code
- Check Google Tag Manager or other tag systems
- Verify if this is needed for marketing/sales
- If not needed, remove the third-party script

---

## Part 2: Data Flow Compliance Analysis

### 1. Decagon - `decagon.ai`

**Service:** Decagon (Customer Chat)  
**Classification:** Essential  
**Activity Level:** 0.00%  
**Purpose:** AI-powered customer support chat  
**Domains:** decagon.ai, dcgn-fe.rippling.com

#### Investigation Results

- ✅ **ACTIVELY INTEGRATED** in codebase
- CustomerChat service uses Decagon for support

#### Code References

**Service Initialization:**

```typescript
// app/core/hooks/useInitNonBlockingServices.ts (Line 39-40)
function init() {
  // Decagon customer chat
  CustomerChat.init();
  // ...
}
```

**Script Loading:**

```typescript
// app/lib/services/remoteUrls.ts (Line 7)
export const APPROVED_SCRIPTS = {
  decagon: 'https://dcgn-fe.rippling.com/loaders/rippling_proxy.js',
  // ...
};
```

**User Identity Setup:**

```typescript
// app/core/hooks/useServiceInitialization.ts (Lines 114-120)
CustomerChat.identify(roleId, companyId, name, role.isAdmin, {
  email: roleToUse.workEmail || roleToUse.user_cache?.email,
  firstName: roleToUse.user_cache?.name?.first,
  lastName: roleToUse.user_cache?.name?.last,
  employeeStatus: roleToUse.roleState || 'INIT',
  personalEmail: roleToUse.user_cache?.email,
});
```

#### Recommendation

**✅ KEEP - Active Integration**

- The 0% activity is a **measurement error**
- Service is properly integrated and initialized
- Used for customer support functionality
- Essential for help/support features

---

### 2. Imgix - `rippling2.imgix.net`

**Service:** Imgix (Image Optimization CDN)  
**Classification:** Essential  
**Activity Level:** 0.7761%  
**Purpose:** Image and video optimization  
**Domain:** rippling2.imgix.net

#### Investigation Results

- ✅ **ACTIVELY USED** for media optimization
- Found in multiple product areas

#### Code References

**Spend Management:**

```typescript
// app/products/finance/SpendManagement/constants.ts (Line 1132)
'https://rippling2.imgix.net/Visa-secure-faq-Rippling-12192024.pdf';
```

**Cross-Sell Video Assets:**

```typescript
// app/products/growth/CrossSell/.../RoundupCards.tsx (Line 17)
const DEFAULT_VIDEO = 'https://rippling.imgix.net/images/R4_1200x1080_R1.mp4';
```

**Terms of Service:**

- Listed in all locale translations as "Optimizes images and video"

#### Recommendation

**✅ KEEP - Active CDN**

- Legitimate CDN service for media optimization
- 0.776% activity is reasonable for specific features
- Essential for performance optimization

---

### 3. Greenhouse - `boards.greenhouse.io`

**Service:** Greenhouse ATS (Applicant Tracking System)  
**Classification:** Essential  
**Activity Level:** 0.00%  
**Purpose:** Recruiting and job board integration  
**Domain:** boards.greenhouse.io

#### Investigation Results

- ✅ **ACTIVELY INTEGRATED** as managed connector
- Extensive setup and configuration components

#### Code References

**API Setup:**

```typescript
// app/products/it/Apps/modules/Auth/setups/apiToken/greenhouseSetup.tsx
const GreenhouseSetup = ({ initInstallationData }: any) => {
  // Setup for API credentials
  // Links to app.greenhouse.io for authentication
};
```

**Webhook Setup:**

```typescript
// app/products/it/Apps/modules/Webhook/setups/greenhouseSetup.tsx
const GreenhouseSetup = ({ initInstallationData }: any) => {
  // Setup for webhook integration
  // Handles candidate updates, rejections, etc.
};
```

**Data Connector:**

```typescript
// app/products/platform/HubPlatform/modules/DataConnectors/constants/connectors.ts
{
  title: 'Greenhouse',
  id: MANAGED_CONNECTOR.GREENHOUSE,
  appName: THIRD_PARTY_APP_NAMES.GREENHOUSE,
  connectorType: CONNECTOR_TYPE.MANAGED,
}
```

#### Recommendation

**✅ KEEP - Managed Integration**

- Essential for customers using Greenhouse ATS
- The `boards.greenhouse.io` domain is for job board features
- Main API traffic uses `app.greenhouse.io`
- 0% activity expected as not all customers use this

---

### 4. Guideline - `my.guideline.com`

**Service:** Guideline (401k Provider)  
**Classification:** Essential  
**Activity Level:** 0.00%  
**Purpose:** Retirement plan management  
**Domain:** my.guideline.com

#### Investigation Results

- ✅ **ACTIVELY INTEGRATED** for 401(k) management
- Route definitions exist for Guideline dashboard

#### Code References

**Route Configuration:**

```typescript
// app/products/it/Apps/containers/401k/GuidelineDeeperDashboard.routes.tsx
// Contains routes for Guideline 401(k) dashboard integration
```

#### Recommendation

**✅ KEEP - Third-Party Integration**

- Essential for companies offering 401(k) plans
- Users are redirected to Guideline's domain
- 0% activity expected as customer-specific feature
- Not all companies offer retirement plans

---

### 5. Datadog - `app.datadoghq.com`

**Service:** Datadog (Monitoring & Analytics)  
**Classification:** Analytics  
**Activity Level:** 0.00%  
**Purpose:** RUM (Real User Monitoring) and logging  
**Domains:** app.datadoghq.com (NOT USED), dd.rippling.com (ACTUAL)

#### Investigation Results

- ✅ Datadog IS actively used
- ❌ **WRONG DOMAIN** in compliance tracking
- ✅ **ACTUAL DOMAIN:** `dd.rippling.com` (proxy)

#### Code References

**RUM Initialization:**

```typescript
// app/lib/log/datadog-rum/index.ts (Lines 187-191)
datadogRum.init({
  applicationId,
  clientToken,
  site: 'datadoghq.com',
  proxy: 'https://dd.rippling.com', // ← ACTUAL DOMAIN USED
  service: 'rippling-webapp',
  env: 'production',
  // ...
});
```

**Logger Configuration:**

```typescript
// app/lib/log/logger/logger.ts (Lines 115-122)
datadogLogs.init({
  clientToken: DATADOG_CLIENT_TOKEN,
  site: 'datadoghq.com',
  service,
  env: 'production',
  forwardErrorsToLogs: false,
  sessionSampleRate: 100,
  proxy: 'https://dd.rippling.com', // ← ACTUAL DOMAIN USED
});
```

**Service Initialization:**

```typescript
// app/core/services/initializeRenderBlockingServices.tsx (Line 77)
datadogRum.init(PartnerCompany);
```

#### Recommendation

**🔄 UPDATE DOMAIN**

- **REMOVE:** `app.datadoghq.com` (not used)
- **ADD:** `dd.rippling.com` (actual proxy domain)
- All Datadog traffic is proxied through your own domain
- 0% activity on app.datadoghq.com is correct

---

### 6. Slack - `emoji.slack-edge.com`

**Service:** Slack (Collaboration Platform)  
**Classification:** Essential  
**Activity Level:** 0.00%  
**Purpose:** Slack integration and workflow notifications  
**Domain:** emoji.slack-edge.com

#### Investigation Results

- ✅ **ACTIVELY INTEGRATED** in multiple areas
- Multiple integration components exist

#### Code References

**Helpdesk Installation:**

```typescript
// app/products/platform/HubPlatform/modules/HelpdeskChat/containers/InstallPage/
<img
  src="https://platform.slack-edge.com/img/add_to_slack.png"
  srcSet="https://platform.slack-edge.com/img/add_to_slack.png 1x,
          https://platform.slack-edge.com/img/add_to_slack@2x.png 2x"
/>
```

**SSO Setup:**

```typescript
// app/products/it/Apps/modules/SSO/saml/setups/slackSetup.tsx
class SlackSetup extends React.Component {
  // Slack SAML SSO configuration
}
```

**Workflow Notifications:**

```typescript
// app/products/platform/HubPlatform/modules/CustomAlerts/components/notificationTypes/slack/
// Slack notification integration for workflows
```

**Custom App Token:**

```typescript
// app/products/it/Apps/containers/SlackCustomAppToken/SlackCustomAppToken.tsx
// Slack custom app integration setup
```

#### Recommendation

**✅ KEEP - Active Integration**

- Essential for Slack integration features
- `emoji.slack-edge.com` is for Slack emoji CDN
- 0% activity may be due to:
  - Not all users have Slack connected
  - CDN assets are heavily cached
  - Tracking tool may not catch all CDN requests

---

### 7. Bing Ads - `browser.pipe.aria.microsoft`

**Service:** Microsoft Bing Ads / Clarity  
**Classification:** Advertising  
**Activity Level:** 0.00%  
**Purpose:** Bing paid search ads analytics  
**Domain:** browser.pipe.aria.microsoft

#### Investigation Results

- ⚠️ **MIXED SIGNALS**
- ❌ NOT found in application code
- ✅ Found in Terms of Service translations

#### Code References

**Terms of Service Mention:**

```json
// translations/locales/en-*/tos.json (Line 328)
"microsoft": "Bing paid search ads"
```

**Note:** The domain `browser.pipe.aria.microsoft` is part of Microsoft's Clarity analytics platform, not the main application code.

#### Recommendation

**⚠️ REVIEW - Possible Marketing Site Only**

- No code implementation in app.rippling.com
- May be loaded on marketing site (rippling.com)
- Check tag management system (Google Tag Manager)
- 0% activity suggests it's not actively used on app
- **Action:** Verify if this is marketing site only
- If not needed for app.rippling.com, can be removed

---

## Summary Tables

### Cookie Compliance Summary

| Cookie Service      | Activity | Recommendation | Reason                            |
| ------------------- | -------- | -------------- | --------------------------------- |
| RudderStack         | 0%       | ❌ REMOVE      | Not in codebase, no usage         |
| Sentry (\_AMP_TEST) | 0.32%    | ⚠️ VERIFY      | Misattributed - check source      |
| Amplitude           | 15.39%   | ✅ KEEP        | Active via Segment integration    |
| Heap                | 0%       | ❌ REMOVE      | Not in codebase, legacy           |
| Amazon Ad Service   | 0%       | ❌ REMOVE      | Not in codebase                   |
| rB2B                | 40.48%   | ⚠️ CHECK       | Not in app code - external script |

### Data Flow Compliance Summary

| Data Flow  | Domain                      | Activity | Recommendation | Reason                                 |
| ---------- | --------------------------- | -------- | -------------- | -------------------------------------- |
| Decagon    | decagon.ai                  | 0%       | ✅ KEEP        | Active support chat, measurement error |
| Imgix      | rippling2.imgix.net         | 0.78%    | ✅ KEEP        | Active media CDN                       |
| Greenhouse | boards.greenhouse.io        | 0%       | ✅ KEEP        | ATS integration for customers          |
| Guideline  | my.guideline.com            | 0%       | ✅ KEEP        | 401(k) integration                     |
| Datadog    | app.datadoghq.com           | 0%       | 🔄 UPDATE      | Wrong domain - use dd.rippling.com     |
| Slack      | emoji.slack-edge.com        | 0%       | ✅ KEEP        | Active Slack integration CDN           |
| Bing Ads   | browser.pipe.aria.microsoft | 0%       | ⚠️ REVIEW      | Marketing site vs app clarification    |

---

## Action Items

### Immediate Actions

1. **Remove from Cookie Notice:**

   - RudderStack (`test_rudder_cookie`)
   - Heap (`^_hp2_hld.*`)
   - Amazon Ad Service (`C_.*`)

2. **Investigate Further:**

   - Sentry `_AMP_TEST` cookie - verify actual source
   - rB2B - check tag management system
   - Bing Ads - clarify marketing vs app domains

3. **Update Data Flow Domains:**
   - Remove: `app.datadoghq.com`
   - Add: `dd.rippling.com`

### Verification Tasks

1. **Cookie Compliance Tool Accuracy:**

   - Verify why Decagon shows 0% activity despite active integration
   - Check if tool is measuring all subdomains correctly

2. **External Scripts:**

   - Audit Google Tag Manager for rB2B scripts
   - Review marketing site vs app domain differences
   - Verify Bing Ads scope (marketing vs app)

3. **Documentation:**
   - Update cookie policy with correct services
   - Document purpose of each active cookie
   - Clarify which domains serve which purposes

---

## Technical Details

### Analysis Methodology

This report was generated through:

1. **Codebase Search**: Used semantic search across entire repository
2. **Grep Analysis**: Searched for exact domain and service names
3. **File Inspection**: Read relevant configuration and initialization files
4. **Cross-Reference**: Verified translations, constants, and service configs

### Files Analyzed

Key files examined:

- `app/lib/services/segment/segmentService.web.ts`
- `app/lib/services/segment/segment.ts`
- `app/lib/log/datadog-rum/index.ts`
- `app/lib/log/logger/logger.ts`
- `app/core/hooks/useInitNonBlockingServices.ts`
- `app/core/hooks/useServiceInitialization.ts`
- `app/lib/services/remoteUrls.ts`
- `app/core/services/initializeRenderBlockingServices.tsx`
- Multiple integration setup files for third-party services

### Repository Information

- **Repository:** rippling-webapp
- **Platform:** React/TypeScript
- **Build System:** Vite
- **Key Dependencies:** Segment, Datadog, Sentry, LogRocket

---

## Appendix: Code Snippets

### Segment Configuration

```typescript
// app/lib/services/segment/segmentService.web.ts
const init = async () => {
  const { writeKey, shouldCheckLoggedIn } = getSegmentConfig();

  if (_isEmpty(writeKey)) {
    return;
  }

  // if test company, don't initialize segment
  const company = admin.getCompany?.();
  const primaryEmail = company?.primaryEmail || '';
  if (
    tokenManager?.testCompany ||
    company?.isTrialCompany ||
    isTestOrDemoCompany(primaryEmail)
  ) {
    return;
  }

  // Initialize segment with Amplitude as unbundled destination
  analytics.addSourceMiddleware((middlewareArgs: TMiddlewareArgs) => {
    const payload = { ...middlewareArgs.payload.raw };
    payload._metadata = {
      bundled: ['Segment.io'],
      unbundled: ['Amplitude'],
      bundledIds: [],
    };
    // ...
  });
};
```

### Datadog Proxy Configuration

```typescript
// app/lib/log/datadog-rum/index.ts
const init = async (partnerCompanyModel: BaseModel<PartnerCompany>) => {
  // ...
  if (isRealProdEnv || config.isPreviewEnv) {
    datadogRum.init({
      applicationId,
      clientToken,
      site: 'datadoghq.com',
      proxy: 'https://dd.rippling.com', // All traffic goes through this proxy
      service: 'rippling-webapp',
      env: 'production',
      version,
      trackUserInteractions: false,
      defaultPrivacyLevel: maskLevel,
      sessionSampleRate: 100,
      sessionReplaySampleRate: 100,
      traceSampleRate: 100,
      // ...
    });
  }
};
```

### Decagon Customer Chat

```typescript
// app/lib/services/customerChat/index.ts
const init = async () => {
  // ...
  loadScript('decagon', true, () => {
    // Decagon chat widget initialization
  });
};

// app/core/hooks/useInitNonBlockingServices.ts
function init() {
  // Decagon customer chat
  CustomerChat.init();
  // ...
}
```

---

## Document End

**Report Generated By:** Codebase Analysis Tool  
**Date:** October 23, 2025  
**Version:** 1.0  
**Status:** Complete

For questions or clarifications about this report, please refer to the specific code files mentioned in each section.