> Sapren and GDPR: what is known about this Iranian Laravel CMS and website builder, its session cookies, hosting outside the EU and the compliance steps to take. > > Canonical: https://www.flowconsent.com/en/services/cms/sapren CMS # Sapren Unclassified · [Official website](https://www.sapren.net) Sapren is a little known content management system and website builder, listed by technology directories as an Iranian hosted builder based on PHP, Laravel and MySQL and linked to the domain sapren.net. Archives show an Iranian web design company behind it until 2025, but the domain now redirects to unrelated content, so its current status cannot be verified. A Sapren site mainly sets technical session cookies, while hosting in Iran raises international transfer questions under the GDPR. [Block Sapren until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=cms) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [CMS](https://www.flowconsent.com/en/services/cms) - Consent Unclassified - Prior consent Not required - Documented cookies 2 - Third-party domains 2 - Servers Most likely Iran. W3Techs lists Sapren Website Builder as an Iranian hosted website builder, and archived copies of sapren.net up to January 2025 show an Iranian web design, SEO, network and VoIP company (شرکت ساپرن). Since 2026 the sapren.net domain redirects to unrelated gambling content, so the vendor's current status and hosting cannot be verified. Overview ## What does Sapren do? ## **What Sapren is** Sapren is a content management system and website builder associated with the domain sapren.net. Very little public documentation exists: technology directories such as W3Techs list "Sapren Website Builder" as an Iranian hosted website builder used by a tiny share of websites, and software comparison sites describe it as a CMS written in PHP on the Laravel framework with a MySQL database. Archived copies of sapren.net up to January 2025 show the site of an Iranian company offering web design, SEO, network installation and VoIP services, which appears to be the vendor. Since 2026, sapren.net redirects to unrelated gambling content, so we could not confirm whether the company still operates the CMS, where it hosts client sites today or what contractual terms it offers. The information on this page is therefore based on directory data, archives and the default behaviour of the Laravel framework, and should be checked against the actual site you are auditing. ## **Data and cookies it collects** As a server side CMS, Sapren generates pages on the vendor's servers, which receive each visitor's IP address, browser information and requested URLs in their access logs. Laravel applications set two first party cookies by default: a session cookie (laravel\_session, frequently renamed after the application) and XSRF-TOKEN, which protects forms against cross site request forgery; both typically expire after two hours. These are the cookies you are most likely to find, but confirm their real names with a cookie scan. Contact forms, quote requests or customer areas built with the CMS store whatever personal data visitors submit in the vendor's database. Any analytics, chat or social media tags on a Sapren site, such as Google Tag Manager or Yandex Metrica, are added separately and must be assessed on their own. ## **GDPR and ePrivacy implications** If you run a site on Sapren and target visitors in the EU, you are the controller and the vendor acts as your hosting processor, which requires a data processing agreement under Article 28 GDPR. No such agreement, privacy policy or security documentation from the vendor could be found publicly. Under Article 5(3) of the ePrivacy Directive, the session and CSRF cookies are strictly necessary, so the cookie side is simple, but the processing side is not. ## **Consent requirements** The Laravel session and XSRF-TOKEN cookies are exempt from consent under the CNIL guidelines, German TDDDG § 25 and Spanish LSSI CE art. 22.2, because they are required to deliver the site and secure its forms. Consent is required for every optional tag the site loads, such as analytics, advertising pixels or embedded social content. Your consent banner must block those tags until the visitor agrees, whatever CMS runs the site. ## **Data transfers outside the EU** If the site is hosted by the vendor in Iran, all visitor data processed by the server leaves the EEA for a country without an adequacy decision. No Standard Contractual Clauses (Decision 2021/914) or other Chapter V safeguards are documented, and after the Schrems II ruling a transfer impact assessment would be required. EU sanctions on Iran can also restrict contracts and payments with Iranian providers, which makes a compliant setup hard to achieve. ## **Practical compliance steps** Start by identifying where the site is really hosted, using DNS and hosting records rather than the vendor's former website. Scan the site to list its cookies and third party tags, block optional tags behind a consent banner, and describe the session cookies in your cookie policy. If the hosting is in Iran and no valid transfer mechanism or DPA can be obtained, plan a migration to an EU hosted CMS, export your content and form data, and update your privacy policy to reflect the new processor. Compliance ## Sapren and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) for hosting and delivering the website, and the strictly necessary exemption of Art. 5(3) ePrivacy for session and CSRF cookies. Consent is still required for any analytics, advertising or social media tags added to a Sapren built site. The international transfer itself needs a valid Chapter V mechanism, which is not documented. - Risk level medium - Applicable regulations GDPR (including Chapter V on international transfers), ePrivacy Directive 2002/58/EC art. 5(3), French CNIL cookie guidelines, German TDDDG § 25, Spanish LSSI CE art. 22.2, Schrems II case law, SCC 2021/914 ### Impact assessment (DPIA) A standard brochure site running on Sapren does not usually require a DPIA, because it mainly processes connection data and technical cookies. The main concern is the probable hosting in Iran, a country without an adequacy decision, combined with the absence of any public DPA or privacy documentation from the vendor. Assess whether forms collect personal data, document the transfer and its legal mechanism, and consider whether EU sanctions affect the contract. If no safeguard can be put in place, migrating to EU hosting is the safer option. ### Sample text for your banner > We use strictly necessary cookies to keep your session secure and make our website work. With your consent, we also use optional analytics and marketing cookies to understand how our site is used. You can accept, refuse or adjust these optional cookies at any time. Cookies and trackers ## What Sapren sets and contacts - Tracking method Server side content management system and website builder: pages are generated and hosted by the vendor, so it is not a tracking tag. Technology directories describe it as a PHP CMS built on the Laravel framework with MySQL, which typically sets first party session and CSRF protection cookies (Laravel defaults laravel\_session and XSRF-TOKEN, often renamed). Any analytics or marketing tags depend on what each site adds. - Server location Most likely Iran. W3Techs lists Sapren Website Builder as an Iranian hosted website builder, and archived copies of sapren.net up to January 2025 show an Iranian web design, SEO, network and VoIP company (شرکت ساپرن). Since 2026 the sapren.net domain redirects to unrelated gambling content, so the vendor's current status and hosting cannot be verified. - Data transferred outside the EU If a site is hosted on Sapren infrastructure in Iran, every page request, IP address, form submission and session identifier is processed in a country without an EU adequacy decision. No DPA, Standard Contractual Clauses or privacy documentation from the vendor could be found, and EU sanctions against Iran can further complicate any contract. Treat it as an undocumented third country transfer until proven otherwise. ### Cookies set (2) | Name | Type | Duration | Purpose | | ---------------- | ------------------------- | ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | laravel\_session | HTTP cookie (first party) | 2 hours (Laravel default, typical) | Typical Laravel session cookie expected on a Sapren site, since the CMS is described as built on Laravel; it is often renamed after the application. It keeps the visitor's server side session, for example during form submission. Strictly necessary; confirm the real name with a cookie scan. | | XSRF-TOKEN | HTTP cookie (first party) | 2 hours (Laravel default, typical) | Typical Laravel cookie carrying a CSRF protection token so that forms on the site cannot be submitted by other websites. Strictly necessary for security; confirm its presence with a cookie scan. | ### Third-party domains contacted (2) - `sapren.net` - `www.sapren.net` Questions ## Frequently asked questions about Sapren Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Sapren set? Sapren is described as a Laravel based CMS, and Laravel sets two first party cookies by default: a session cookie (laravel\_session, often renamed) and XSRF-TOKEN for form protection, both typically lasting two hours. The vendor publishes no cookie list, so confirm the actual names with a cookie scan. Any analytics or marketing cookies come from tags added to the site. ### Is consent required for a Sapren website? Not for the CMS itself: session and CSRF protection cookies are strictly necessary and exempt under Article 5(3) of the ePrivacy Directive. Consent is required for any optional tags on the site, such as analytics, advertising pixels or social media embeds. Those must be blocked until the visitor accepts them. ### What is the legal basis for using Sapren? Hosting and delivering the website rely on legitimate interest under Art. 6(1)(f) GDPR, and form submissions on the purpose for which they are collected, such as pre contractual steps under Art. 6(1)(b). The technical cookies fall under the strictly necessary exemption. The transfer to the hosting provider additionally needs a Chapter V mechanism if it is outside the EEA. ### Does Sapren transfer data outside the EU? Most likely yes. Sapren is listed as an Iranian hosted website builder, and Iran has no EU adequacy decision; no Standard Contractual Clauses or DPA from the vendor could be found. EU sanctions on Iran may also complicate contracts, so verify the real hosting location of your site before drawing conclusions. ### Do I need a DPIA for a Sapren site? A simple brochure site usually does not require a DPIA. Document the processing in your register, assess the probable transfer to Iran and the missing vendor documentation, and pay special attention if forms collect sensitive or large volumes of personal data. Without safeguards, migrating to EU hosting is the safer route. ### How do I make a Sapren website compliant? Identify the real hosting location through DNS and hosting records, since the vendor domain sapren.net now shows unrelated content. Scan the site, describe the session cookies in your cookie policy and block optional tags behind a consent banner. If no DPA or valid transfer mechanism can be obtained, plan a migration and export your content and form data. ### What are EU based alternatives to Sapren? Hosted website builders operated in the EU include Jimdo (Germany) and IONOS MyWebsite (Germany). If you prefer an open source CMS, TYPO3 or WordPress installed on an EU hosting provider keep data inside the EEA. Make sure a DPA is signed with whichever provider you choose. ### How should I update my cookie policy for Sapren? List the session cookie and XSRF-TOKEN with their real names as found by a scan, their purpose (session handling and form security), duration and the strictly necessary category, with your own domain as provider. Name the hosting provider and its location in your privacy policy. Update the policy whenever you add tags or migrate away from Sapren. Same category ## More services: CMS [See the whole category](https://www.flowconsent.com/en/services/cms) ### [DedeCMS](https://www.flowconsent.com/en/services/cms/dedecms) [DedeCMS is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. DedeCMS supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, DedeCMS ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/dedecms) [CMS](https://www.flowconsent.com/en/services/cms/dedecms) · ### [caSaaS](https://www.flowconsent.com/en/services/cms/casaas) [caSaaS is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. caSaaS integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, caSaaS helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/casaas) [CMS](https://www.flowconsent.com/en/services/cms/casaas) · ### [Voog](https://www.flowconsent.com/en/services/cms/voog) [Voog is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Voog supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Voog enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/cms/voog) [CMS](https://www.flowconsent.com/en/services/cms/voog) · ### [Strikingly](https://www.flowconsent.com/en/services/cms/strikingly) [Strikingly is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Strikingly integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Strikingly helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/strikingly) [CMS](https://www.flowconsent.com/en/services/cms/strikingly) · ### [Contentstack](https://www.flowconsent.com/en/services/cms/contentstack) [Contentstack is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Contentstack integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Contentstack helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/cms/contentstack) [CMS](https://www.flowconsent.com/en/services/cms/contentstack) · ### [MotoCMS](https://www.flowconsent.com/en/services/cms/motocms) [MotoCMS is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. MotoCMS supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, MotoCMS ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/cms/motocms) [CMS](https://www.flowconsent.com/en/services/cms/motocms) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)