Workspace and account

Workspace shows the name and the address (your-workspace.app.cmpstack.io). Renaming the name changes only the label. Renaming the address moves the workspace to a new subdomain and tells you the new sign-in URL; the old one stops working, so warn your team.

One account can belong to several workspaces. Agencies run one per client and switch between them from the workspace menu without signing in again.

Workspace → Consent record retention sets how long a visitor's decision is kept before it is destroyed. Three years is the default: it outlives the limitation period everywhere we operate, so a complaint about a page view today can still be answered in two years' time. One year is the shortest allowed, because a record that expires before the consent it proves leaves a live banner running on a decision nobody can produce.

Changing it deletes nothing. The nightly job is the only thing that removes a record, and it acts on whatever the setting says when it runs. Shortening the period does not reach back through your history the moment you press Save.

A record cannot be edited — by you, by your team, or by us. The database refuses any change to a consent record and refuses a delete from the application entirely. The one exception is moving a domain to another workspace, which changes who holds the record without touching what it says. That is what makes the export from Consent Logs worth producing to somebody who has no reason to take your word for it.

Deleting a domain keeps its records. They stay in Consent Logs under the site's name, marked as a deleted domain, until the retention period ends. A record is removed in only two ways: by the nightly job when its period is over, and when a customer's contract ends and the workspace is closed. Nobody can delete one by hand — not you, not us.

On Portfolio, tick the sites you want and an action bar appears: Publish banners or Run scans. Neither does anything yet. Both open a preview listing every site you selected with its own answer — will change, nothing to do, or refused with the reason.

Approving runs them one at a time. A refused site does not stop the others — twenty publish, one is refused, and the summary says which.

Pressing Approve twice is safe. Each preview carries a batch id, and applying the same batch again reports what it already did instead of doing it again, so a dropped connection is not a reason to work out how far it got.

The header checkbox selects what is on this page, not everything matching your filters — a “select all 400” that quietly includes rows nobody looked at is how a bulk action becomes a surprise.

On Portfolio, grouped by client, each client's heading has a Client report link. It opens that client's month: the average compliance score across their sites, how many are leaking before consent, the consent rate, what changed since last month, every site with its own numbers, and every finding still open. The PDF is the same thing with your branding on it.

Pick the month at the top. The current month runs to the moment you generate it rather than to the end of the month — a report covering nine days that claims to cover thirty invites a comparison nobody should make.

Send it every month. At the bottom of the drawer, switch it on and it goes out on the first of each month, covering the month that just ended, with the PDF attached. Up to five addresses; leave them empty and it goes to this workspace's owners, which is what you want if you would rather read it before forwarding it. The email says who scheduled it and how to stop it, because the person receiving it is often not one of our customers.

A member limited to some clients can produce reports for those clients and no others — the database returns nothing for the rest, so there is no way to build one by guessing an address.

Most cookies are named by rules that have not changed in years. What those rules cannot name goes to the shared list, and then — if a provider is configured — to a model. A model's answer is only written into your cookie declaration when it is confident enough to clear a threshold that has been measured against a labelled set.

You can always overrule us. In Domains → Cookies, change the category from the dropdown, or press change beside the vendor to say whose it really is — including clearing it entirely, which is how you say “this one is ours”. Your correction sticks through every later scan.

When a scan finds a cookie our rules cannot name, we look it up in a shared list before asking anything else. The same handful of trackers turn up on thousands of sites, so classifying one once — for everybody — is what keeps your scans fast and the “unknown” count low.

Workspace → Shared tracker knowledge turns your contribution off if you would rather. It costs you nothing: your scans go on reading the shared list either way, so they keep benefiting from what everyone else has established. The switch decides only whether you add to it.

Workspace → Branding puts your mark on the documents you send your clients: a logo (PNG or JPEG, up to 256 KB), an accent colour, a heading colour and the name the report says it is from. They appear on the enforcement report PDF, on the client report, and on the email a scheduled client report arrives in — there the logo travels inside the message, so it shows even in mail clients that block images from the web.

Branding changes whose document it looks like, never what it says. The findings, the evidence and the page explaining how each claim was measured are the same whoever the report is addressed from. That is deliberate: the method is what makes the document worth forwarding, and a report that could be re-skinned into saying something else would be worth nothing.

The accent colours the rules and the bar on the cover and is never used for text. The heading colour is text, so it has to read on white: a colour lighter than a 4.5:1 contrast is refused, with the ratio it measured. Either way, no colour you pick can make your own report hard to read.

It is part of Agency and Enterprise. On other plans the controls are visible but inactive, and reports carry the findings unbranded. If a plan lapses, what you uploaded is kept — it simply stops being applied — so coming back does not mean finding the logo file again.

Every plan ships the same tag, the same blocking, the same languages and the same consent log. The demo is full-featured and limited by time; the one thing it cannot do is remove our mark from the banner.

Plans are changed from your account on cmpstack.io, not from this panel: Account → Change plan opens Stripe checkout for an upgrade, and the billing portal holds invoices and payment details. Only the workspace owner can manage billing. Downgrading below the number of domains you hold takes the newest ones offline, not away.

Changing plan while you are paying takes effect at once. An upgrade is charged to your card straight away, for the rest of the current billing period; if the card is declined, nothing changes and nothing is charged. A downgrade’s unused amount becomes credit on your next invoice. Every payment, renewals included, is followed by a receipt by email.

VAT number. A business in the EU or the UK can give its VAT number when it first chooses a plan, on the same page as the plans. It is printed on your invoices and shown on Account → Subscription; it does not change the price. To add or correct one later, use Payment method & invoices on that page.

Cancelling. A subscription is cancelled from Payment method & invoices. It then runs to the end of the period you have paid for: everything keeps working, and a Plan ends date appears at the top of this panel and on Account → Subscription, with an email saying the same. Until that date, Keep my plan on that page undoes the cancellation, and nothing is charged for doing so.

When the period ends the workspace is suspended and its banners stop being served, but nothing is deleted yet. Choosing a plan again brings it back with everything intact. 31 days after the subscription ended, the workspace and everything in it are permanently deleted, consent records included; the owner is emailed a week before and again the day before. If you need your consent records after that, export them first: Consent logs → Export all records.

Running clients? Your account on cmpstack.io shows who each month’s bill is for, divided by client. The split is by billed domains — a client with three counts for three tenths of a ten-domain plan — and the domains in no group, plus whatever the division leaves over, are their own lines so the table adds up to the invoice exactly. There is a CSV to paste into your own billing. Assign domains to a client under Domains → Groups and the split follows.

Where we offer more than one currency, prices on cmpstack.io can be shown in dollars, pounds or euros, and each is its own price list rather than a conversion of the others. Pick the one you want before you first pay: a subscription is fixed to the currency of its first invoice and cannot be moved to another afterwards — changing it means cancelling and subscribing again. A demo workspace has not been charged yet, so it still chooses at the moment it takes a plan.

Profile

Your name and job title.

Security

Change your password. Two-factor authentication with an authenticator app is required on every account; keep the recovery codes from setup somewhere safe, they are the way back in if you lose the device.

Sessions

Every browser signed in as you, and a button to sign each one out.

Notifications

Per type of email, receive it immediately, in a daily or weekly digest, or not at all. Transactional emails such as invitations and security notices cannot be turned off.

Preferences

The page the panel opens on after you sign in, light or dark theme, and density. A member limited to clients is offered only the pages they can open; a default set to one of the workspace's own screens opens the Dashboard for them instead.