Glossary

AES-256-GCM is authenticated encryption: the AES block cipher with 256-bit keys in Galois/Counter Mode, providing confidentiality and integrity in one pass — tampered ciphertext fails authentication instead of decrypting to garbage.

Argon2id is the recommended variant of Argon2, winner of the Password Hashing Competition: a memory-hard key-derivation function that makes password guessing expensive on GPUs and custom hardware, while resisting side-channel attacks.

A blind index is a keyed, deterministic hash of a field (such as an email address) stored in place of the plaintext, so a database can look records up by exact match without holding — or leaking — the value itself.

End-to-end encryption means data is encrypted on the sender’s device and decrypted only on the recipient’s — every intermediary, including the service operator, handles ciphertext it cannot read.

HKDF (HMAC-based key derivation function, RFC 5869) expands one strong secret into any number of independent, purpose-bound keys via extract-then-expand — the standard way to turn a shared secret into separate encryption, signing, and session keys.

A JWT is a compact, signed token carrying claims (user ID, expiry, scopes) that services can verify statelessly — any holder of the verification key can check authenticity without a database lookup.

Key stretching turns a low-entropy secret like a password into a stronger key by making each derivation deliberately expensive — thousands to millions of iterations, or memory-hard computation — so brute-force guessing becomes uneconomical.

OPAQUE is an asymmetric password-authenticated key exchange (aPAKE) protocol, described in RFC 9807, that lets a server verify a password without ever seeing it — the password never leaves the client, even during registration.

An OPRF is a two-party protocol where a server holding a secret key helps a client evaluate a pseudorandom function on the client’s input — without the server learning the input or the output, and without the client learning the key.

A PAKE is a cryptographic protocol in which two parties use a shared password to establish a strong session key — without ever transmitting the password or exposing it to offline guessing from intercepted traffic.

Passkeys are public-key login credentials based on the FIDO2/WebAuthn standards: your device holds a private key and signs a per-site challenge, so there is no shared secret to phish, leak, or reuse across sites.

PKCE (Proof Key for Code Exchange, RFC 7636) hardens the OAuth 2.0 authorization-code flow: the client commits to a one-time secret up front, so an intercepted authorization code is useless without it.

SRP is a 1990s password-authenticated key exchange that lets clients log in without sending the password. It was the workhorse aPAKE for two decades and is now superseded by OPAQUE (RFC 9807).

TOTP (RFC 6238) generates six-digit codes from a shared secret and the current time, giving accounts a second factor that changes every 30 seconds and works fully offline in any authenticator app.

In applied privacy engineering, zero-knowledge describes systems designed so the service operator cannot read user data or secrets — verification and storage work without the server ever holding the plaintext.

Authentication in which the server verifies you know your password without ever receiving it — during signup or login, in any form. The usual construction today is an aPAKE such as OPAQUE (RFC 9807).

Anonymization is processing data such that the individual it once related to can no longer be identified by any means reasonably likely to be used — done correctly, the result falls entirely outside GDPR’s scope, unlike pseudonymized data.

A consent banner is the on-page prompt asking a visitor to accept or decline non-essential cookies and tracking, required under the EU ePrivacy Directive whenever a site stores or reads anything on the visitor’s device that isn’t strictly necessary.

A data controller is the natural or legal person that determines the purposes and means of processing personal data — under GDPR, the controller bears primary responsibility for lawful processing and for honoring data subjects’ rights.

A data processor is the natural or legal person that processes personal data on behalf of, and under the instructions of, a data controller — without independently deciding why or how that data is used.

Data residency is the physical or jurisdictional location where an organization’s data is stored — a deliberate infrastructure choice, distinct from data sovereignty, which concerns whose laws govern that data regardless of where it sits.

Data sovereignty is the principle that data is subject to the laws of the jurisdiction that governs it — broader than data residency, since a legal claim can reach across borders regardless of where servers physically sit.

A data processing agreement (DPA) is the contract required by GDPR Article 28 between a data controller and a data processor, setting out the scope, purpose, and security obligations governing the processor’s handling of personal data on the controller’s behalf.

The ePrivacy Directive (2002/58/EC, amended 2009) is the EU law governing confidentiality of electronic communications, including the cookie-consent rule: storing or reading anything on a user’s device requires prior consent unless it is strictly necessary.

The EU-US Data Privacy Framework (DPF) is a 2023 adequacy decision permitting personal-data transfers to US companies that self-certify to its principles — successor to the invalidated Privacy Shield and Safe Harbor.

The FADP (Federal Act on Data Protection) is Switzerland’s national data protection law; its fully revised version (nFADP) took effect 1 September 2023, modernizing Swiss law to align closely — though not identically — with the GDPR.

The GDPR (General Data Protection Regulation, EU 2016/679) is the European Union’s data protection law, which has applied since 25 May 2018 and governs how personal data of people in the EU/EEA is collected, processed, and transferred.

Personal data, under GDPR, is any information relating to an identified or identifiable natural person — a deliberately broad definition covering not just names and IDs but anything that can be linked back to someone, directly or in combination with other data.

Privacy by design is the principle — codified as a legal obligation in GDPR Article 25 — that data protection must be built into a system’s architecture from the outset, not added afterward as a policy or a configuration toggle.

Pseudonymization is processing personal data so it can no longer be attributed to a specific person without additional information, which is kept separately and secured — a GDPR-recognized risk-reduction measure, but the data remains personal data in scope.

Standard contractual clauses (SCCs) are European Commission-approved contract templates that legalize personal-data transfers from the EU/EEA to countries without an adequacy decision by extending GDPR-equivalent protections.

A sub-processor is a third party a data processor engages to help process personal data on a controller’s behalf — a cloud host, for example. GDPR requires the controller’s prior authorization and a flow-down contract.

Bot detection distinguishes automated traffic from genuine human visitors before allowing an action — form submission, login, checkout — to prevent spam, credential stuffing, and scraping at scale.

Bounce rate is the share of visits in which a user views a single page and leaves without any further interaction or navigation — a rough signal of whether a landing page held attention.

Browser fingerprinting identifies a device by combining device and browser attributes — screen size, installed fonts, GPU details, timezone, and more — into a composite signature, without storing anything on the device.

Cookieless analytics measures website traffic without setting cookies or any other persistent client-side identifier. It derives counts from request-level signals instead.

Do Not Track (DNT) was an HTTP header and browser setting, specified by a W3C working group, that signaled a user’s preference not to be tracked across sites. It never became a standard and was largely abandoned because sites were never legally required to honor it.

Email open tracking records when a recipient views a message, typically via an embedded tracking pixel that silently reports back to the sender the moment the email client loads remote images.

Global Privacy Control is a browser-sent HTTP signal (Sec-GPC: 1) expressing a user’s opt-out of sale and sharing of personal data — legally binding in California and other US states, unlike Do Not Track.

A honeypot, in bot detection, is a form field hidden from human view but present in the page’s HTML — automated submitters that fill in every field reveal themselves, while real visitors never see it to fill in.

A proof-of-work challenge requires a client to perform a small, verifiable computation before a request is accepted — cheap for one user, expensive enough at scale to make bulk automated abuse uneconomical.

The referrer is the URL of the page a visitor was on immediately before arriving at the current one, sent by the browser in the HTTP Referer header (or omitted, per the page’s referrer policy).

In web analytics, a session is a group of interactions — pageviews, events — from one visitor treated as a single continuous visit, typically closed out after a period of inactivity (commonly 30 minutes).

A third-party cookie is set by a domain other than the one the user is visiting — typically an ad or analytics vendor embedded via script — letting that vendor recognize the same browser across unrelated sites.

A tracking pixel is a tiny, invisible image embedded in a page or email whose load request signals to the hosting server that the content was opened, along with the viewer’s IP and client details.

Unique visitors counts distinct people (or devices) visiting a site over a period, as opposed to pageviews, which counts every page load — the same visitor loading ten pages is one unique visitor and ten pageviews.

UTM parameters are widely used query-string tags (utm_source, utm_medium, utm_campaign, and related fields) appended to a URL so analytics tools can attribute traffic to a specific campaign, channel, or link.