FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Security

Imperva

EssentialOfficial website

Imperva is a leading web application firewall (WAF) and DDoS protection provider used by European banks, governments, retailers and SaaS companies to defend their web infrastructure. It sits in front of the customer's website as a reverse proxy or DNS-routed CDN, inspecting every HTTP request for attacks. Imperva sets a small number of strictly necessary security cookies (such as the incap_ses_<id> and visid_incap_<id> cookies) which are exempt from prior consent under Art. 5(3) ePrivacy.

Block Imperva until consentScan my site
Overview

What does Imperva do?

What is Imperva

Imperva (originally Incapsula) is a leading WAF, DDoS protection, bot management and API security provider. Deployed as a reverse proxy or DNS-routed CDN, it inspects every HTTP request before it reaches the origin server, blocking attacks (SQL injection, XSS, credential stuffing, layer 7 DDoS) and validating suspicious traffic with CAPTCHA challenges.

Cookies and data

Imperva typically sets incap_ses_<id> (session identifier for security context), visid_incap_<id> (visitor security identifier across sessions), and nlbi_<id> (load-balancing cookie). All are classified as strictly necessary for security. Imperva also processes IP, User-Agent, request bodies, headers and behavioural signals on the WAF level.

GDPR and ePrivacy

Imperva's security cookies fall under the strictly necessary exemption of Art. 5(3) ePrivacy. They do not require prior consent. The processing of request data relies on legitimate interest (Art. 6(1)(f)) and the legal obligation in Art. 32 GDPR. EDPB guidance treats security cookies as strictly necessary as long as they remain proportionate.

Data transfers and PoP routing

Imperva has European PoPs (Frankfurt, Paris, Dublin, London). You can request EU-only routing for traffic from European visitors. The central threat intelligence is in the US; aggregated and anonymised attack signatures are shared globally, covered by SCCs and EU-US DPF. For high-sensitivity deployments, document the routing and the threat-sharing in your security policy.

NIS2 and incident response

For essential and important entities under NIS2, Imperva is a key technical measure. Integrate Imperva alerts and logs into your SIEM and incident response runbook. Configure log retention to match NIS2 reporting obligations (significant incidents must be reported within 24 hours).

Practical compliance checklist

1. Sign the Imperva DPA. 2. Configure EU PoPs for European traffic. 3. Document Imperva in your Record of Processing Activities as a security measure. 4. Disclose Imperva in your privacy notice. 5. Integrate logs with your SIEM. 6. Map Imperva to your NIS2 incident response runbook. 7. Configure log retention to match obligations.

Compliance

Imperva and the GDPR

Legal basis
Legitimate interest (Art. 6(1)(f) GDPR) and legal obligation under Art. 32 GDPR to ensure security of processing
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive (strictly necessary cookie exemption), NIS2 Directive

Impact assessment (DPIA)

Imperva processes visitor IP, User-Agent, request URLs, request bodies and headers for inspection, plus aggregated threat telemetry. Key DPIA considerations: (1) cookies set are strictly necessary for security and may rely on the consent exemption of Art. 5(3) ePrivacy; (2) request inspection processes personal data, justified by legitimate interest and Art. 32 GDPR; (3) data may be processed in Imperva PoPs (some in EU, some elsewhere); (4) US threat intelligence sharing covered by SCCs; (5) NIS2 incident response obligations may apply. A streamlined DPIA is sufficient.

Sample text for your banner

Our site is protected against attacks and bots by Imperva. Imperva inspects each request and sets strictly necessary cookies (incap_ses_<id>, visid_incap_<id>) to remember which visitors have already passed security challenges. This processing is based on our legitimate interest in security and our legal obligation under Art. 32 GDPR.
Cookies and trackers

What Imperva sets and contacts

Tracking method
Web application firewall and DDoS protection. Sits in front of the website as a reverse proxy or DNS-routed CDN. Sets a small number of security cookies for bot detection and challenge persistence
Server location
Imperva, Inc., San Mateo, California, United States. Global PoPs including European cities (Frankfurt, Paris, Dublin, London)
Data transferred outside the EU
Visitor IP, request metadata, security challenge results and aggregated threat telemetry are processed in Imperva PoPs and shared with the central Imperva threat intelligence in the US. Transfers covered by 2021 SCCs and EU-US DPF.

Cookies set (3)

NameTypeDurationPurpose
incap_ses_<id>Strictly necessarySessionImperva security session identifier used to recognise visitors that have already passed the WAF and bot challenges.
visid_incap_<id>Strictly necessary1 yearPersistent visitor identifier across sessions, used to maintain security context and prevent re-challenging trusted visitors.
nlbi_<id>Strictly necessarySessionLoad-balancing cookie that pins a visitor to the same Imperva PoP for consistent inspection.

Third-party domains contacted (4)

  • imperva.com
  • incapdns.net
  • incap.io
  • cloudwaf.io
Questions

Frequently asked questions about Imperva

Can't find your question? Write to us, we answer fast.

Cookies Imperva sets?

incap_ses_<id>, visid_incap_<id>, nlbi_<id>. All strictly necessary for security.

Consent needed?

No, security cookies fall under the strictly necessary exemption of Art. 5(3) ePrivacy.

Legal basis?

Legitimate interest (Art. 6(1)(f)) and Art. 32 GDPR security obligation.

US transfers?

Threat intelligence is centralised in the US, covered by SCCs and DPF. Traffic can be EU-routed.

DPIA?

A streamlined DPIA is sufficient; full DPIA recommended for NIS2 critical entities.

Compliant deployment?

Sign DPA, EU PoP routing, document in Record of Processing Activities, integrate with SIEM, NIS2 runbook.

Alternatives?

EU-friendly WAF/DDoS: Cloudflare (US, EU PoPs), Akamai (US, EU PoPs), Fastly (US, EU PoPs), DataDome (France), Variti (Switzerland).

Policy updates?

Disclose Imperva as a security processor, mention the US threat intelligence transfer with SCCs, list the security cookies as strictly necessary.

Same category

More services: Security

See the whole category

GuardFlame

GuardFlame is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GuardFlame supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GuardFlame ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Security

authorized.by

authorized.by is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. authorized.by supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, authorized.by enables informed decisions that improve experience and drive results.

Essential

Apruvd

Apruvd is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Apruvd integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Apruvd helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

v4Guard Checkpoint

v4Guard Checkpoint is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. v4Guard Checkpoint supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, v4Guard Checkpoint ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

SEON

Seon is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Seon supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Seon ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

iThemes Security

iThemes Security is a comprehensive web security solution that protects websites and applications from cyber threats including DDoS attacks, SQL injection, and cross-site scripting. It provides web application firewall (WAF) capabilities, real-time threat detection, and automated incident response. iThemes Security offers SSL/TLS encryption, bot management, and security monitoring. With compliance reporting and vulnerability scanning, iThemes Security strengthens your overall security posture.

Essential

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site