> Imunify360 and the GDPR: server-side security, threat intelligence transfers to the US, a reCAPTCHA challenge layer and legitimate interest. > > Canonical: https://www.flowconsent.com/en/services/security/imunify360 Security # Imunify360 Essential · [Official website](https://www.imunify360.com) Imunify360 is a server-side security suite by CloudLinux that protects Linux web servers against malware, brute-force, vulnerability exploitation and bot traffic. It runs on the hosting infrastructure and does not normally set cookies on visitors' browsers, although the optional CAPTCHA challenge layer can integrate with Google reCAPTCHA which does. For most European hosting providers and webmasters, Imunify360 has a low privacy footprint and relies on legitimate interest as its legal basis. [Block Imunify360 until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=security) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Security](https://www.flowconsent.com/en/services/security) - Consent Essential - Prior consent Not required - Documented cookies 2 - Third-party domains 4 - Servers CloudLinux Inc., headquartered in the United States. Runs locally on the customer's server; cloud threat intelligence database hosted in the US Overview ## What does Imunify360 do? ## **What is Imunify360** Imunify360 is a comprehensive security stack for Linux web servers offered by CloudLinux. It combines a web application firewall (WAF) with proactive defence, a malware scanner with one-click clean-up, brute-force protection, intrusion detection, IP reputation filtering and an optional CAPTCHA challenge for suspicious visitors. It is widely deployed by European hosting companies (cPanel-based shared hosting providers, VPS operators) and self-managed servers. ## **What data Imunify360 processes** For each incoming HTTP request, Imunify360 inspects the source IP, User-Agent, request path, query parameters, headers and (for POST traffic) the body. It maintains a local IP reputation cache plus a connection to the CloudLinux threat intelligence service. Malware scanning is performed on files inside the web roots and email mailboxes. None of this processing is exposed to the visitor's browser; no cookies are set by default. ## **GDPR and ePrivacy implications** Imunify360 processes personal data (IP, request payload that may contain identifying information). The legal basis is legitimate interest (Art. 6(1)(f) GDPR), reinforced by the Art. 32 GDPR obligation to maintain security of processing. ePrivacy does not apply to server-side inspection; it only becomes relevant when the optional CAPTCHA layer (Google reCAPTCHA) is used, because reCAPTCHA itself sets cookies and transmits data to Google. ## **Threat intelligence and US transfers** Imunify360 sends suspicious request fingerprints, IP reputation data and malware sample hashes to CloudLinux Inc. servers in the United States. This transfer is covered by Standard Contractual Clauses in the CloudLinux EULA / DPA. The data minimisation is good: only hashes and metadata, not raw request bodies, are transmitted upstream. ## **NIS2 and security obligations** For essential and important entities under the EU NIS2 Directive, Imunify360 fits into the broader cybersecurity risk management framework. Document its deployment in your information security management system (ISMS), tie it to incident response runbooks, and ensure the logs (Imunify360 incident log) are retained for the period required by NIS2 reporting obligations. ## **Practical compliance checklist** 1\. Sign the CloudLinux DPA. 2. Document Imunify360 in your Record of Processing Activities under security. 3. Disclose the US threat intelligence transfer in your privacy notice. 4. If reCAPTCHA is enabled, treat it as a separate processor with consent obligations. 5. Configure incident logs retention to match NIS2 requirements. 6. Test the false-positive workflow so legitimate visitors are not unfairly blocked. Compliance ## Imunify360 and the GDPR - Legal basis Legitimate interest (Art. 6(1)(f) GDPR) and legal obligation under Art. 32 GDPR to ensure the security of processing. No browser-side consent is normally required because Imunify360 itself sets no cookies; reCAPTCHA challenges if enabled require separate consent - Risk level low - Applicable regulations GDPR, NIS2 Directive, ePrivacy Directive (only if reCAPTCHA layer is used) ### Impact assessment (DPIA) Imunify360 processes IP addresses, request headers, request bodies (for WAF inspection), and uploaded files (for malware scanning). All processing happens on the customer's server; only suspicious patterns and IP reputation submissions are sent back to CloudLinux. Key DPIA considerations: (1) IP and request inspection is personal data processing under GDPR; (2) the legal basis is legitimate interest for security plus legal obligation under Art. 32; (3) threat intelligence sharing transmits hashed payloads to CloudLinux in the US, covered by SCCs; (4) if the CAPTCHA layer is enabled and uses Google reCAPTCHA, additional cookies and US transfers apply; (5) NIS2 Directive (EU) increases the importance of documented incident response. A streamlined DPIA is sufficient for typical hosting deployments. ### Sample text for your banner > Our servers are protected by Imunify360 (CloudLinux). When you access this site, Imunify360 inspects your request to block malicious traffic. This processing is based on our legitimate interest in security under Art. 6(1)(f) GDPR and our legal obligation to protect data under Art. 32 GDPR. No cookies are set on your browser by Imunify360 itself. If the optional CAPTCHA challenge is shown, separate Google reCAPTCHA terms apply. Cookies and trackers ## What Imunify360 sets and contacts - Tracking method Server-side security software running on the web hosting infrastructure. Processes HTTP request metadata (IP, User-Agent, payload) but does not set browser cookies for end users by default; integrates with optional reCAPTCHA challenge layer that does - Server location CloudLinux Inc., headquartered in the United States. Runs locally on the customer's server; cloud threat intelligence database hosted in the US - Cookieless mode available Yes - Data transferred outside the EU Suspicious request fingerprints, attack signatures, and malicious IP submissions are sent to CloudLinux servers in the US for threat intelligence sharing. Transfers are covered by Standard Contractual Clauses in the Imunify360 EULA / DPA. ### Cookies set (2) | Name | Type | Duration | Purpose | | ---------------------- | ------------------ | -------- | ------------------------------------------------------------------------------------------------------------------------- | | imunify360\_xs | Strictly necessary | Session | Set only when the optional CAPTCHA challenge is triggered. Maintains the challenge session until the visitor is verified. | | imunify360\_temp\_test | Strictly necessary | 1 day | Test cookie used to verify cookie support before issuing a CAPTCHA challenge to a suspicious visitor. | ### Third-party domains contacted (4) - `imunify360.com` - `cloudlinux.com` - `updates.imunify360.com` - `iplists.imunify360.com` Questions ## Frequently asked questions about Imunify360 Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Imunify360 set cookies on visitors' browsers? No, not by default. Imunify360 is server-side and inspects requests at the web server level. Cookies appear only if the optional CAPTCHA challenge layer is enabled and configured to use Google reCAPTCHA, which sets its own cookies and is subject to separate consent. ### Do I need visitor consent to use Imunify360? No. Imunify360 itself does not set cookies or access information on the visitor's device, so Art. 5(3) ePrivacy does not apply. The lawful basis for processing IP and request data is legitimate interest plus the Art. 32 GDPR security obligation. ### What is the legal basis for processing personal data via Imunify360? Legitimate interest under Art. 6(1)(f) GDPR (network and information security), supported by the legal obligation under Art. 32 GDPR to ensure the security of processing. For essential or important entities under NIS2, the legal obligation aspect is reinforced. ### Is data transferred to the United States? Yes, hashed signatures and IP reputation submissions are sent to CloudLinux Inc. in the US. Transfers are covered by Standard Contractual Clauses in the CloudLinux DPA. The data minimisation is good: only metadata and hashes, not full request bodies. ### Do I need a DPIA? A streamlined DPIA is sufficient for typical hosting deployments. Run a more detailed DPIA if you process special category data, operate as a critical NIS2 entity, or use Imunify360 in combination with reCAPTCHA and behavioural rate-limiting. ### How do I implement Imunify360 in compliance? Sign the CloudLinux DPA, document Imunify360 in your Record of Processing Activities under security, disclose the US threat intelligence transfer in your privacy notice, configure log retention to match NIS2 obligations, test the false-positive workflow, and treat the optional reCAPTCHA layer as a separate processor with its own consent requirements. ### What alternatives to Imunify360 exist? EU-friendly WAF alternatives include ModSecurity with OWASP CRS (open source, self-hosted), BitNinja (Hungary, EU), Wordfence (US, plugin for WordPress), Sucuri (US, cloud-based WAF) and the WAF capabilities of Cloudflare or Bunny.net. For a fully EU stack, ModSecurity self-hosted plus fail2ban is the canonical choice. ### How do I update my privacy notice? Add an entry in your privacy notice describing the server security processing under Art. 6(1)(f) GDPR and Art. 32, naming CloudLinux Inc. as a processor for threat intelligence sharing with the US transfer disclosed. No cookie policy entry is needed unless the optional reCAPTCHA layer is enabled. Same category ## More services: Security [See the whole category](https://www.flowconsent.com/en/services/security) ### [Alibaba Cloud Verification Code](https://www.flowconsent.com/en/services/security/alibaba-cloud-verification-code) [Alibaba Cloud Verification Code is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Alibaba Cloud Verification Code provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Alibaba Cloud Verification Code ensures optimal performance at scale.](https://www.flowconsent.com/en/services/security/alibaba-cloud-verification-code) [Essential](https://www.flowconsent.com/en/services/security/alibaba-cloud-verification-code) · ### [Wordfence](https://www.flowconsent.com/en/services/security/wordfence) [Wordfence is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Wordfence supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Wordfence enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/security/wordfence) [Essential](https://www.flowconsent.com/en/services/security/wordfence) · ### [Anura](https://www.flowconsent.com/en/services/security/anura) [Anura is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. Anura enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, Anura empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/security/anura) [Marketing](https://www.flowconsent.com/en/services/security/anura) · ### [Login with Amazon](https://www.flowconsent.com/en/services/security/login-with-amazon) [Login with Amazon is an identity and authentication platform providing secure login, single sign-on (SSO), and multi-factor authentication for websites and applications. It supports social login, passwordless authentication, and user management with enterprise-grade security. Login with Amazon simplifies identity implementation for developers while ensuring compliance. With adaptive authentication and anomaly detection, Login with Amazon protects user accounts while maintaining a frictionless experience.](https://www.flowconsent.com/en/services/security/login-with-amazon) [Essential](https://www.flowconsent.com/en/services/security/login-with-amazon) · ### [Confiant](https://www.flowconsent.com/en/services/security/confiant) [Confiant is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Confiant supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Confiant ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/confiant) [Essential](https://www.flowconsent.com/en/services/security/confiant) · ### [ipstack](https://www.flowconsent.com/en/services/security/ipstack) [ipstack is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. ipstack supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, ipstack ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/security/ipstack) [Essential](https://www.flowconsent.com/en/services/security/ipstack) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)