FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Hosting

Envoy

UnclassifiedOfficial website

Envoy is an open source edge and service proxy written in C++, created at Lyft and hosted by the Cloud Native Computing Foundation (CNCF). Sites behind it are recognised by the server: envoy response header. It routes, load-balances and secures HTTP traffic on the operator's own infrastructure, loads nothing in the visitor's browser and sets no cookie by default, so it does not require consent.

Block Envoy until consentScan my site
Overview

What does Envoy do?

What is Envoy?

Envoy is a high-performance proxy designed for cloud-native applications. It was developed at Lyft, released as open source in September 2016, accepted by the Cloud Native Computing Foundation in 2017 and became a CNCF graduated project in November 2018. It is written in C++ and distributed under the Apache 2.0 licence. Envoy is used as an edge proxy in front of websites and APIs, as a load balancer, and as the sidecar proxy of service meshes such as Istio. It should not be confused with Envoy, the visitor management software for offices, which is an unrelated product.

How Envoy appears on a website

When a response passes through Envoy, it usually carries a server: envoy header and often an x-envoy-upstream-service-time header giving the backend processing time in milliseconds. Technology scanners rely on these headers. Envoy does not change the HTML page, does not inject scripts and does not make the visitor's browser contact any additional domain. Many hosting platforms and API gateways use Envoy internally, so the header can appear even when the site owner did not install it directly.

Cookies and personal data

In its default configuration Envoy sets no cookie. An operator can configure it to generate a cookie for session affinity (sticky sessions) or stateful sessions; the name and lifetime of that cookie are then chosen in the configuration, not by Envoy. As a proxy, Envoy processes the visitor's IP address, the requested URL, headers and timing data, and it can write access logs containing them if access logging is enabled.

GDPR and consent

No consent is needed for Envoy itself. Routing requests and protecting the service are necessary to deliver the website the visitor asked for, and the default setup stores nothing on the visitor's device. If a sticky session cookie is configured, it is generally considered strictly necessary for load balancing. Access logs are processed on the basis of legitimate interest (security, reliability). Data only leaves the EU if the operator runs Envoy, or ships its logs, outside the EU.

Practical steps

  • Check whether access logging is enabled and set a retention period for the logs.
  • Document any session affinity cookie defined in your configuration.
  • Mention reverse proxy logs in your privacy notice.
  • Keep Envoy updated, since security releases are published regularly.
  • Remove or rewrite the server header if you do not want to expose your stack.
Compliance

Envoy and the GDPR

Legal basis
Legitimate interest (Art. 6(1)(f) GDPR) for traffic routing, security and access logs
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive

Impact assessment (DPIA)

Envoy does not usually require a DPIA: it is infrastructure software that processes connection data to route traffic. Points to watch are the content and retention of access logs, any headers or tracing data forwarded to observability tools, and where those logs are stored. A DPIA may be needed for the wider service if it involves large-scale monitoring.

Sample text for your banner

Requests to this site pass through a reverse proxy that routes and secures traffic. It stores nothing on your device and only keeps technical connection logs for security purposes.
Cookies and trackers

What Envoy sets and contacts

Tracking method
Open source edge and service proxy placed in front of the website's servers, detected through the server: envoy and x-envoy-upstream-service-time response headers. Nothing is loaded in the browser.
Server location
Self-hosted (runs on the infrastructure chosen by the site operator or its cloud provider)
Cookieless mode available
Yes
Questions

Frequently asked questions about Envoy

Can't find your question? Write to us, we answer fast.

What does the server: envoy header mean?

It shows that the response went through Envoy, the open source proxy hosted by the CNCF. It may be operated by the site owner or by a hosting platform or API gateway that uses Envoy internally.

Is this Envoy the visitor management software?

No. The server: envoy header refers to Envoy Proxy from envoyproxy.io. The office visitor management tool sold under the same name is a different company and product.

Does Envoy set cookies?

Not by default. An operator can configure a cookie for sticky sessions or stateful sessions, with a name and lifetime defined in the Envoy configuration.

Do I need visitor consent because my site runs behind Envoy?

No. Envoy only routes and protects requests and does not store anything on the visitor's device in its default setup. Consent depends on the other tools used by the site.

Who develops Envoy?

Envoy was created at Lyft and is now a graduated project of the Cloud Native Computing Foundation, developed by contributors from many companies under the Apache 2.0 licence.

Same category

More services: Hosting

See the whole category

Kangle

Kangle is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Kangle supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Kangle ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Hosting

Artifactory

Artifactory is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Artifactory offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Artifactory empowers organizations to optimize strategy and maximize return on investment.

Hosting

Starlet

Starlet is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Starlet supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Starlet ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Hosting

Host Europe

HostEurope is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. HostEurope offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, HostEurope empowers organizations to optimize strategy and maximize return on investment.

Hosting

GoAhead

GoAhead is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. GoAhead integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, GoAhead helps organizations maintain robust websites that meet user expectations and technical requirements.

Hosting

Debian

Debian is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Debian supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Debian ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Hosting

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site