Strictly necessary cookies (session, security) are always on. Analytics uses Pirsch (cookieless). With your consent, any advertising on the site can be personalised via cookies. Without consent, ads stay generic and untracked, but may still appear.
Read the privacy notice
US-incorporated CAPTCHA service operated by Intuition Machines, Inc. (San Francisco). Marketed as a privacy-friendlier reCAPTCHA replacement but remains a US processor with direct CLOUD Act exposure.
Alternatives
8
CLOUD Act · none
1
Free tier
5
Disclosure:Some links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.
Which are the closest hCaptcha alternatives?
Ordered by feature parity and migration friction, which is weighted higher than feature breadth.
Munich-area CAPTCHA (Scoria Labs GmbH) with a published two-name sub-processor chain for the widget: Hetzner and bunny.net, both EU, from 15 EUR/month.
Public DPA: Not assessedSub-processors: YesOpen source: No
Munich-area CAPTCHA (Scoria Labs GmbH) with a published two-name sub-processor chain for the widget: Hetzner and bunny.net, both EU, from 15 EUR/month.
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedThis listingEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Vienna CAPTCHA (Captcha GmbH, part of the Krone Multimedia group) with named processors, from 8.90 EUR/month, but the site itself runs on AWS CloudFront and Google analytics.
Public DPA: No
Sub-processors: Yes
Open source: No
Austria
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedThis listingEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
UK bot-protection service (Prosopo Limited) with the category's most transparent DPA, naming seven sub-processors, four EU and three US; free tier of 10,000 requests a month.
Public DPA: Yes
Sub-processors: Yes
Open source: No
United Kingdom
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedThis listingEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
German cookie-free proof-of-work CAPTCHA (Friendly Captcha GmbH) from 9 EUR/month, but the DPA and its sub-processor list are password-protected and EU-only hosting is a paid tier.
Public DPA: No
Sub-processors: No
Open source: No
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedThis listingEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Invisible proof-of-work form spam filter (Formspark team), free to 1,000 challenges a month, with a published sub-processor list that is mostly American and no legal entity named.
Public DPA: No
Sub-processors: Yes
Open source: No
IE
Ireland
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedThis listingEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Beyond compliance: how these alternatives compare on the capabilities you actually use day to day.
Table 2Capabilities by product
Feature
CaptchaFox
TrustCaptcha
ALTCHA
captcha.eu
Prosopo
Friendly Captcha
mosparo
Botpoison
Self-hostable
No
No
Yes
No
No
No
Yes
No
No cookies or browser storage
Yes
Not assessed
Yes
Not assessed
Not assessed
Yes
Yes
Not assessed
Invisible challenge
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Proof-of-work
Not assessed
Yes
Yes
Not assessed
Not assessed
Yes
Not assessed
Yes
Bot risk scoring
Yes
Yes
Not assessed
Not assessed
Yes
Not assessed
Not assessed
Not assessed
WCAG accessibility conformance
Not assessed
Yes
Yes
Not assessed
Yes
Yes
Yes
Yes
CMS plugins
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Free tier
No
No
Yes
No
Yes
Yes
Yes
Yes
Source: vendor documentation, as of Aug 2026.
What are you leaving behind with hCaptcha?
What are you leaving behind with hCaptcha?
Listed for transparency. Every product on this page is benchmarked against this baseline.
Listed for transparency. Every product on this page is benchmarked against this baseline.
US-based
hCaptchaUS-incorporated
US-incorporated CAPTCHA service operated by Intuition Machines, Inc. (San Francisco). Marketed as a privacy-friendlier reCAPTCHA replacement but remains a US processor with direct CLOUD Act exposure.
Ownership
US-owned
CLOUD Act
Direct
Related European alternatives
hCaptcha sits in CAPTCHA & bot protection. Compare neighbouring tools with the same hosting, ownership and CLOUD Act checks.
For every product we read the public DPA, sub-processors document, hosting region declaration, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.
