ALTCHA
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
BAU Software s.r.o., Lidická 700/19, 602 00 Brno, Czechia (VAT CZ19414480)
MIT-licensed proof-of-work CAPTCHA from Brno (BAU Software s.r.o.) with a public DPA and EU-only Cloud endpoints, though the Cloud itself runs on AWS.
ALTCHA offers EU hosting in Czechia, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under CAPTCHA & bot protection.
Assessment notes
ALTCHA is an open-source proof-of-work CAPTCHA (MIT) published by BAU Software s.r.o. in Brno, with an optional hosted Cloud tier. It is one of only two vendors in this category with a publicly downloadable DPA, and the Cloud service commits to EU-only endpoints and EU-only data residency for data processed on the customer's behalf. The MIT licence is the strongest part of the posture: the widget and the verification server can be self-hosted on your own EU infrastructure, which removes the vendor from the data path entirely. Against that, the Cloud tier's own privacy policy names Amazon Web Services for hosting, infrastructure and email delivery, and Paddle.com as merchant of record for billing, with account and billing data explicitly stated as possibly processed outside the EU. AWS operates the EU regions but is US-owned, so the hosted product carries material exposure even with EU residency: Material. Self-hosting is what changes that, and it is why the self-hosted score is recorded separately.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 3 · 1 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About ALTCHA
ALTCHA is an open-source CAPTCHA alternative built on proof of work and published by BAU Software s.r.o. in Brno, Czechia. The widget asks the visitor's browser to compute a puzzle rather than asking the visitor to do anything, sets no cookies and stores nothing in the browser, and is built to conform to WCAG 2.2 AA and the European Accessibility Act, which matters more than it sounds: an inaccessible CAPTCHA is a legal exposure of its own from June 2025 onwards. The core project is MIT licensed with around 2,600 stars on its repository, and there are official integrations for React, Angular and WordPress plus documented migration guides from reCAPTCHA, hCaptcha and Cloudflare Turnstile.
There are two ways to run it, and they audit very differently. Self-hosted, you deploy the widget and verification server on your own infrastructure and there is no third-party processor at all, which is the strongest posture available anywhere in this category. ALTCHA Cloud is the managed option, advertised with EU-hosted infrastructure and EU-only endpoints, sold in Cloud, Cloud Plus and Cloud Max tiers that differ in the number of protected sites and API capacity rather than in features, with monthly or annual billing and a free trial. There is also ALTCHA Sentinel, a self-hostable threat-detection server with adaptive challenges, spam filtering and classification.
On paperwork ALTCHA is ahead of most of the category: a DPA is published as a downloadable PDF, and there are per-regulation compliance pages for GDPR, WCAG, EAA and others. On infrastructure it is behind: the privacy policy names Amazon Web Services as the provider for hosting, infrastructure, email delivery and security, and Paddle.com as the payment processor, and it states that account and billing data may be processed outside the EU. So the EU-residency commitment covers the data ALTCHA processes for you, while the operator underneath is American: Material. Cloud plan prices are not published on the pricing page. Best fit: teams who will self-host, and anyone who needs an accessibility-conformant challenge.
Sub-processor map · 3
-
Amazon Web Services (AWS) USUnited States
Hosting, infrastructure, email delivery and security for ALTCHA Cloud; the vendor commits to EU-only endpoints and EU data residency for customer-processed data
-
BunnyWay d.o.o. (bunny.net) EUSlovenia
Content delivery for the documentation site (observed in live response headers, not named by the vendor)
-
Paddle.com non-USUnited Kingdom
Merchant of record for payments and billing; account and billing data may be processed outside the EU
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (AWS) | United States | Hosting, infrastructure, email delivery and security for ALTCHA Cloud; the vendor commits to EU-only endpoints and EU data residency for customer-processed data | US |
| BunnyWay d.o.o. (bunny.net) | Slovenia | Content delivery for the documentation site (observed in live response headers, not named by the vendor) | EU |
| Paddle.com | United Kingdom | Merchant of record for payments and billing; account and billing data may be processed outside the EU | non-US |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of ALTCHA
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Belgium · $2/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Austria · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Botpoison
Belgium
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
$2/mo |
captcha.eu
Austria
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€9/mo |
CaptchaFox
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
€15/mo |