ALTCHA is an open-source CAPTCHA alternative built on proof of work and published by BAU Software s.r.o. in Brno, Czechia. The widget asks the visitor's browser to compute a puzzle rather than asking the visitor to do anything, sets no cookies and stores nothing in the browser, and is built to conform to WCAG 2.2 AA and the European Accessibility Act, which matters more than it sounds: an inaccessible CAPTCHA is a legal exposure of its own from June 2025 onwards. The core project is MIT licensed with around 2,600 stars on its repository, and there are official integrations for React, Angular and WordPress plus documented migration guides from reCAPTCHA, hCaptcha and Cloudflare Turnstile.
There are two ways to run it, and they audit very differently. Self-hosted, you deploy the widget and verification server on your own infrastructure and there is no third-party processor at all, which is the strongest posture available anywhere in this category. ALTCHA Cloud is the managed option, advertised with EU-hosted infrastructure and EU-only endpoints, sold in Cloud, Cloud Plus and Cloud Max tiers that differ in the number of protected sites and API capacity rather than in features, with monthly or annual billing and a free trial. There is also ALTCHA Sentinel, a self-hostable threat-detection server with adaptive challenges, spam filtering and classification.
On paperwork ALTCHA is ahead of most of the category: a DPA is published as a downloadable PDF, and there are per-regulation compliance pages for GDPR, WCAG, EAA and others. On infrastructure it is behind: the privacy policy names Amazon Web Services as the provider for hosting, infrastructure, email delivery and security, and Paddle.com as the payment processor, and it states that account and billing data may be processed outside the EU. So the EU-residency commitment covers the data ALTCHA processes for you, while the operator underneath is American: Material. Cloud plan prices are not published on the pricing page. Best fit: teams who will self-host, and anyone who needs an accessibility-conformant challenge.