FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Security

Qualva

EssentialOfficial website

Japanese fraud and risk scoring service that collects browser fingerprints and behavioural signals to compute a transaction risk score for ecommerce and payment flows.

Block Qualva until consentScan my site
Overview

What does Qualva do?

What Qualva is

Qualva is a Japanese fraud and risk management service used by ecommerce, payments and account creation flows. It collects device and behavioural signals from the browser and computes a transaction level risk score that the operator can use to allow, challenge or block an operation.

Data and cookies

The SDK reads canvas and font metrics, screen and platform attributes, plugins, language, mouse and keyboard timings and writes a first party device cookie (qlv_device) plus a session token (qlv_session). The scoring API receives the IP, user agent, transaction context and the operator session identifier.

GDPR and ePrivacy posture

Browser fingerprinting reads information from the visitor device. Article 5(3) ePrivacy applies, so consent is required before the SDK fingerprint signals are collected. The risk score may amount to automated decision making with significant effects under Article 22 GDPR if a payment is blocked, requiring meaningful information and a right to human review.

Transfers to Japan

Japan benefits from a partial GDPR adequacy decision since 2019, but only for data subject to the Japanese supplementary rules. Confirm with Qualva K.K. which scope applies, sign Standard Contractual Clauses where adequacy does not cover the dataset, and document the Transfer Impact Assessment.

Implementation steps

Gate the SDK behind your CMP, document the fingerprinting in the cookie register, complete a DPIA, build a human review path for blocked transactions, sign the DPA and SCCs, and provide a privacy notice that explains the logic of the risk score in plain language.

Compliance

Qualva and the GDPR

Qualva is classified as “Essential”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy) for the Qualva SDK cookies and fingerprinting signals. Legitimate interest (Art. 6(1)(f)) can be invoked for the strictly fraud prevention scoring of completed transactions, but the front end fingerprinting still requires consent.
Risk level
high
Applicable regulations
GDPR, ePrivacy Directive, UK GDPR, Japan APPI

Impact assessment (DPIA)

A DPIA is required because Qualva combines automated decision making (fraud risk score), browser fingerprinting, behavioural data and a transfer to Japan. Document the categories, retention, the meaningful information about the logic and the safeguards under Article 22 GDPR.

Sample text for your banner

We use Qualva to detect fraudulent activity. With your consent, the Qualva SDK collects device and behavioural signals on this page and transmits them to servers in Japan to compute a risk score.
Cookies and trackers

What Qualva sets and contacts

Tracking method
JavaScript fraud and risk scoring SDK that collects browser fingerprints, device signals, behavioural metrics and transaction context, with first party cookies for session continuity and a server side scoring API.
Server location
Japan (Qualva K.K.)
Data transferred outside the EU
Qualva processes behavioural and device data on Japanese infrastructure. Japan benefits from a partial GDPR adequacy decision (for data covered by Japanese supplementary rules). Outside that scope, SCCs and a Transfer Impact Assessment apply.

Cookies set (3)

NameTypeDurationPurpose
qlv_devicefirst_party1 yearLong lived device identifier used to recognise the same browser across sessions for fraud risk scoring.
qlv_sessionfirst_partySessionSession identifier used to link the events of a single visit to the risk score request.
qlv_probethird_partySessionProbe cookie used by the Qualva SDK to detect proxies and inconsistent network configurations.

Third-party domains contacted (3)

  • qualva.com
  • api.qualva.com
  • cdn.qualva.com
Questions

Frequently asked questions about Qualva

Can't find your question? Write to us, we answer fast.

What cookies does Qualva set?

The Qualva SDK writes qlv_device (long lived device identifier) and qlv_session (session). Some integrations use a third party probe cookie to detect proxies.

Is consent required to load Qualva?

Yes. Browser fingerprinting and the SDK cookies trigger Article 5(3) ePrivacy. Consent must be obtained before the SDK loads the device signals.

What is the legal basis for Qualva processing?

Consent (Art. 6(1)(a) GDPR) for the front end fingerprinting and cookies. Legitimate interest (Art. 6(1)(f)) for fraud prevention scoring of completed transactions, weighed in a Legitimate Interest Assessment.

Does Qualva transfer data to a third country?

Yes, to Japan. Japan has a partial adequacy decision since 2019. Confirm the scope of adequacy with Qualva K.K. and sign SCCs for any data outside that scope.

Do I need a DPIA for Qualva?

Yes. The combination of automated decision making, fingerprinting, behavioural data and a transfer to Japan is a textbook DPIA trigger under Article 35 GDPR.

How do I implement Qualva compliantly?

Gate the SDK behind the CMP, document the fingerprinting, sign the DPA and SCCs, configure retention to the minimum, build a human review path for blocked transactions and explain the logic of the score in a plain language privacy notice.

What are the alternatives to Qualva?

EU friendly alternatives include Sift, Riskified, Forter, Ravelin (UK), SEON (Hungary) and Fraugster. Each has its own posture on fingerprinting and data residency.

How do I update my cookie policy when adding Qualva?

List qlv_device and qlv_session with name, purpose, retention and processor (Qualva K.K., Japan). Mention the Japan transfer and the SCCs. Disclose the use of the score under Article 22 in your privacy notice.

Same category

More services: Security

See the whole category

ipdata

ipdata is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. ipdata integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, ipdata helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

Kerberos

Kerberos is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Kerberos integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Kerberos helps organizations maintain robust websites that meet user expectations and technical requirements.

Essential

Amazon Cognito

Amazon Cognito is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. Amazon Cognito supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, Amazon Cognito enables informed decisions that improve experience and drive results.

Essential

DDoS-Guard

DDoS-Guard is a comprehensive web security solution that protects websites and applications from cyber threats including DDoS attacks, SQL injection, and cross-site scripting. It provides web application firewall (WAF) capabilities, real-time threat detection, and automated incident response. DDoS-Guard offers SSL/TLS encryption, bot management, and security monitoring. With compliance reporting and vulnerability scanning, DDoS-Guard strengthens your overall security posture.

Essential

AntiBot.Cloud

AntiBot.Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. AntiBot.Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, AntiBot.Cloud ensures optimal performance at scale.

Essential

Drata

Drata is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Drata supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Drata ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Essential

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site