US-incorporated CAPTCHA replacement from Cloudflare, Inc. (San Francisco, NYSE: NET). Cookie-light and free, but the verification runs on US-owned edge infrastructure. Direct CLOUD Act exposure.
Alternatives
8
CLOUD Act · none
1
With BSI C5
0
Free tier
5
DisclosureSome links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.
Top picks
Which are the closest Cloudflare Turnstile alternatives?
Ordered by feature parity and migration friction, which is weighted higher than feature breadth.
CA
CaptchaFox
Germany
EU-BASED
★ #1 PICK
Munich-area CAPTCHA (Scoria Labs GmbH) with a published two-name sub-processor chain for the widget: Hetzner and bunny.net, both EU, from 15 EUR/month.
Munich-area CAPTCHA (Scoria Labs GmbH) with a published two-name sub-processor chain for the widget: Hetzner and bunny.net, both EU, from 15 EUR/month.
DE
Germany
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedThis listingEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Vienna CAPTCHA (Captcha GmbH, part of the Krone Multimedia group) with named processors, from 8.90 EUR/month, but the site itself runs on AWS CloudFront and Google analytics.
—
Austria
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedThis listingEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
UK bot-protection service (Prosopo Limited) with the category's most transparent DPA, naming seven sub-processors, four EU and three US; free tier of 10,000 requests a month.
—
United Kingdom
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedThis listingEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
German cookie-free proof-of-work CAPTCHA (Friendly Captcha GmbH) from 9 EUR/month, but the DPA is password-protected, no sub-processors are named and EU-only hosting is a paid tier.
—
Germany
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedThis listingEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Invisible proof-of-work form spam filter (Formspark team), free to 1,000 challenges a month, with a published sub-processor list that is mostly American and no legal entity named.
IE
Ireland
SOVEREIGNTY
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedThis listingEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Beyond compliance: how these alternatives compare on the capabilities you actually use day to day.
Feature
CaptchaFox
TrustCaptcha
ALTCHA
captcha.eu
Prosopo
Friendly Captcha
mosparo
Botpoison
Self-hostable
✗No
✗No
✓Yes
✗No
✗No
✗No
✓Yes
✗No
No cookies or browser storage
✓Yes
—
✓Yes
—
—
✓Yes
✓Yes
—
Invisible challenge
✓Yes
✓Yes
✓Yes
✓Yes
✓Yes
✓Yes
✓Yes
✓Yes
Proof-of-work
—
✓Yes
✓Yes
—
—
✓Yes
—
✓Yes
Bot risk scoring
✓Yes
✓Yes
—
—
✓Yes
—
—
—
WCAG accessibility conformance
—
✓Yes
✓Yes
—
✓Yes
✓Yes
✓Yes
✓Yes
CMS plugins
✓Yes
✓Yes
✓Yes
✓Yes
✓Yes
✓Yes
✓Yes
✓Yes
Free tier
✗No
✗No
✓Yes
✗No
✓Yes
✓Yes
✓Yes
✓Yes
What you're leaving
What are you leaving behind with Cloudflare Turnstile?
What you're leaving
What are you leaving behind with Cloudflare Turnstile?
Listed for transparency. Every product on this page is benchmarked against this baseline.
Listed for transparency. Every product on this page is benchmarked against this baseline.
CL
Cloudflare TurnstileUS-incorporated
US-incorporated CAPTCHA replacement from Cloudflare, Inc. (San Francisco, NYSE: NET). Cookie-light and free, but the verification runs on US-owned edge infrastructure. Direct CLOUD Act exposure.
US-based
Ownership
US-OWNED
CLOUD ACT
DIRECT
Hosting
Likely AWS · US
SCHREMS II
Default SCC + supp.
KEEP EXPLORING
Related European alternatives
Cloudflare Turnstile sits in CAPTCHA & bot protection. Compare neighbouring tools with the same hosting, ownership and CLOUD Act checks.
For every product we read the public DPA, sub-processors document, hosting region declaration, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.
Type to search products, categories, or alternative-to pages.
↩ openesc close
Search runs on this server. No third-party analytics.
Strictly necessary cookies (session, security) are always on. Analytics uses Pirsch (cookieless). With your consent, any advertising on the site can be personalised via cookies. Without consent, ads stay generic and untracked, but may still appear.
Read the privacy notice →