> Imperva WAF and DDoS protection under the GDPR: strictly necessary security cookies, data transfers and how to disclose Imperva in your privacy notice. > > Canonical: https://www.flowconsent.com/en/services/security/imperva Security # Imperva Essential · [Official website](https://www.imperva.com) Imperva is a leading web application firewall (WAF) and DDoS protection provider used by European banks, governments, retailers and SaaS companies to defend their web infrastructure. It sits in front of the customer's website as a reverse proxy or DNS-routed CDN, inspecting every HTTP request for attacks. Imperva sets a small number of strictly necessary security cookies (such as the incap\_ses\_\ and visid\_incap\_\ cookies) which are exempt from prior consent under Art. 5(3) ePrivacy. [Block Imperva until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Not required - Documented cookies 3 - Third-party domains 4 - Servers Imperva, Inc., San Mateo, California, United States. Global PoPs including European cities (Frankfurt, Paris, Dublin, London) Overview ## What does Imperva do? ## **What is Imperva** Imperva (originally Incapsula) is a leading WAF, DDoS protection, bot management and API security provider. Deployed as a reverse proxy or DNS-routed CDN, it inspects every HTTP request before it reaches the origin server, blocking attacks (SQL injection, XSS, credential stuffing, layer 7 DDoS) and validating suspicious traffic with CAPTCHA challenges. ## **Cookies and data** Imperva typically sets incap\_ses\_\ (session identifier for security context), visid\_incap\_\ (visitor security identifier across sessions), and nlbi\_\ (load-balancing cookie). All are classified as strictly necessary for security. Imperva also processes IP, User-Agent, request bodies, headers and behavioural signals on the WAF level. ## **GDPR and ePrivacy** Imperva's security cookies fall under the strictly necessary exemption of Art. 5(3) ePrivacy. They do not require prior consent. The processing of request data relies on legitimate interest (Art. 6(1)(f)) and the legal obligation in Art. 32 GDPR. EDPB guidance treats security cookies as strictly necessary as long as they remain proportionate. ## **Data transfers and PoP routing** Imperva has European PoPs (Frankfurt, Paris, Dublin, London). You can request EU-only routing for traffic from European visitors. The central threat intelligence is in the US; aggregated and anonymised attack signatures are shared globally, covered by SCCs and EU-US DPF. For high-sensitivity deployments, document the routing and the threat-sharing in your security policy. ## **NIS2 and incident response** For essential and important entities under NIS2, Imperva is a key technical measure. Integrate Imperva alerts and logs into your SIEM and incident response runbook. Configure log retention to match NIS2 reporting obligations (significant incidents must be reported within 24 hours). ## **Practical compliance checklist** 1\. Sign the Imperva DPA. 2. Configure EU PoPs for European traffic. 3. Document Imperva in your Record of Processing Activities as a security measure. 4. Disclose Imperva in your privacy notice. 5. Integrate logs with your SIEM. 6. Map Imperva to your NIS2 incident response runbook. 7. Configure log retention to match obligations. Compliance ## Imperva and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) and legal obligation under Art. 32 GDPR to ensure security of processing - Risk level low - Applicable regulations GDPR, ePrivacy Directive (strictly necessary cookie exemption), NIS2 Directive ### Impact assessment (DPIA) Imperva processes visitor IP, User-Agent, request URLs, request bodies and headers for inspection, plus aggregated threat telemetry. Key DPIA considerations: (1) cookies set are strictly necessary for security and may rely on the consent exemption of Art. 5(3) ePrivacy; (2) request inspection processes personal data, justified by legitimate interest and Art. 32 GDPR; (3) data may be processed in Imperva PoPs (some in EU, some elsewhere); (4) US threat intelligence sharing covered by SCCs; (5) NIS2 incident response obligations may apply. A streamlined DPIA is sufficient. ### Sample text for your banner > Our site is protected against attacks and bots by Imperva. Imperva inspects each request and sets strictly necessary cookies (incap\_ses\_\, visid\_incap\_\) to remember which visitors have already passed security challenges. This processing is based on our legitimate interest in security and our legal obligation under Art. 32 GDPR. Cookies and trackers ## What Imperva sets and contacts - Tracking method Web application firewall and DDoS protection. Sits in front of the website as a reverse proxy or DNS-routed CDN. Sets a small number of security cookies for bot detection and challenge persistence - Server location Imperva, Inc., San Mateo, California, United States. Global PoPs including European cities (Frankfurt, Paris, Dublin, London) - Data transferred outside the EU Visitor IP, request metadata, security challenge results and aggregated threat telemetry are processed in Imperva PoPs and shared with the central Imperva threat intelligence in the US. Transfers covered by 2021 SCCs and EU-US DPF. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------------- | ------------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------- | | incap\_ses\_\ | Strictly necessary | Session | Imperva security session identifier used to recognise visitors that have already passed the WAF and bot challenges. | | visid\_incap\_\ | Strictly necessary | 1 year | Persistent visitor identifier across sessions, used to maintain security context and prevent re-challenging trusted visitors. | | nlbi\_\ | Strictly necessary | Session | Load-balancing cookie that pins a visitor to the same Imperva PoP for consistent inspection. | ### Third-party domains contacted (4) - `imperva.com` - `incapdns.net` - `incap.io` - `cloudwaf.io` Questions ## Frequently asked questions about Imperva Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Cookies Imperva sets? incap\_ses\_\, visid\_incap\_\, nlbi\_\. All strictly necessary for security. ### Consent needed? No, security cookies fall under the strictly necessary exemption of Art. 5(3) ePrivacy. ### Legal basis? Legitimate interest (Art. 6(1)(f)) and Art. 32 GDPR security obligation. ### US transfers? Threat intelligence is centralised in the US, covered by SCCs and DPF. Traffic can be EU-routed. ### DPIA? A streamlined DPIA is sufficient; full DPIA recommended for NIS2 critical entities. ### Compliant deployment? Sign DPA, EU PoP routing, document in Record of Processing Activities, integrate with SIEM, NIS2 runbook. ### Alternatives? EU-friendly WAF/DDoS: Cloudflare (US, EU PoPs), Akamai (US, EU PoPs), Fastly (US, EU PoPs), DataDome (France), Variti (Switzerland). ### Policy updates? Disclose Imperva as a security processor, mention the US threat intelligence transfer with SCCs, list the security cookies as strictly necessary. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [GuardFlame](https://www.flowconsent.com/en/services/security/guardflame) [GuardFlame is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. GuardFlame supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, GuardFlame ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/guardflame) [Security](https://www.flowconsent.com/en/services/security/guardflame) · ### [authorized.by](https://www.flowconsent.com/en/services/security/authorized-by) [authorized.by is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. authorized.by supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, authorized.by enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/security/authorized-by) [Essential](https://www.flowconsent.com/en/services/security/authorized-by) · ### [Apruvd](https://www.flowconsent.com/en/services/security/apruvd) [Apruvd is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Apruvd integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Apruvd helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/security/apruvd) [Essential](https://www.flowconsent.com/en/services/security/apruvd) · ### [v4Guard Checkpoint](https://www.flowconsent.com/en/services/security/v4guard-checkpoint) [v4Guard Checkpoint is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. v4Guard Checkpoint supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, v4Guard Checkpoint ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/v4guard-checkpoint) [Essential](https://www.flowconsent.com/en/services/security/v4guard-checkpoint) · ### [SEON](https://www.flowconsent.com/en/services/security/seon) [Seon is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Seon supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Seon ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/seon) [Essential](https://www.flowconsent.com/en/services/security/seon) · ### [iThemes Security](https://www.flowconsent.com/en/services/security/ithemes-security) [iThemes Security is a comprehensive web security solution that protects websites and applications from cyber threats including DDoS attacks, SQL injection, and cross-site scripting. It provides web application firewall (WAF) capabilities, real-time threat detection, and automated incident response. iThemes Security offers SSL/TLS encryption, bot management, and security monitoring. With compliance reporting and vulnerability scanning, iThemes Security strengthens your overall security posture.](https://www.flowconsent.com/en/services/security/ithemes-security) [Essential](https://www.flowconsent.com/en/services/security/ithemes-security) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)