Botpoison
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Invisible proof-of-work form spam filter (Formspark team), free to 1,000 challenges a month, with a published sub-processor list that is mostly American and no legal entity named.
Botpoison offers EU hosting in Ireland, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under CAPTCHA & bot protection.
Assessment notes
Botpoison is an invisible proof-of-work spam filter for forms, from the team behind Formspark, and it does the one thing most of this category refuses to do: it publishes a named sub-processor list on a public page. That list is also why the score is 2/5, because five names on it are Amazon Web Services (cloud infrastructure), Google Analytics, Sentry (error reporting), Stripe (payments) and Formspark, and the first four are US-incorporated: Material. The privacy policy states the products are operated from Belgium with data stored in Ireland, which puts the data in the EU under a US-owned operator. The bigger problem for a European buyer is that no legal entity is published anywhere: no company name, no registration number, no registered address, on a site selling to EU businesses that are themselves subject to imprint obligations. Country is recorded as Belgium purely on the vendor's own statement. There is no DPA either. Honest disclosure of an American stack is still worth more than silence, and it is why this is listed rather than skipped.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- 6 · 5 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Botpoison
Botpoison is an invisible spam filter for web forms built on proof of work, from the team that also runs Formspark. There is no puzzle and nothing for the visitor to click: the browser computes a challenge in the background and the submission carries the result. It is deliberately small in scope, low-code, and aimed at contact forms and signup forms rather than at traffic-level bot filtering, with a free plan covering 1,000 challenges a month, then 2 USD for 5,000 and 7 USD for 50,000, unlimited installations on every tier.
It earns its place here for a reason that has nothing to do with the technology: Botpoison publishes its sub-processors by name on a public page, which puts it ahead of most of this category on transparency. Read the list, though, and the sovereignty picture is clear. The named processors are Amazon Web Services for cloud infrastructure, Formspark for customer support, Google Analytics for website analytics, Sentry for error reporting and Stripe for payments. Four of those five are US-incorporated, and AWS and Sentry sit in the operational path rather than in billing. The privacy policy states that the products and web properties are operated from Belgium and that information is transferred to and stored in Ireland, so the data is in the EU while the infrastructure operator is American: Material. Live infrastructure is consistent, with the site served from Amazon S3 behind CloudFront and corporate mail on Google Workspace.
The gap that matters most for a European buyer is not on the list at all. No legal entity is published anywhere on the site: no company name, no registration number and no registered address appear in the terms, the privacy policy or a legal notice, only the trading name and a copyright line. For a service sold to EU businesses, which are themselves subject to imprint requirements, that is a meaningful omission, and it is why the country recorded here rests entirely on the vendor's own sentence about operating from Belgium. There is no DPA either. Best fit: small sites and indie developers who want a free, invisible spam filter and are not making a sovereignty decision. Teams that are should look at the self-hosted or named-chain options in this category first.
Sub-processor map · 6
-
Amazon Web Services (AWS) USUnited States
Cloud infrastructure (data stated by the vendor as stored in Ireland)
-
Google Ireland Limited (Google Workspace) USIreland
Corporate and support email (from public MX records, not on the vendor's list)
-
Google LLC (Google Analytics) USUnited States
Website analytics
-
Sentry USUnited States
Error reporting
-
Stripe, Inc. USUnited States
Payment processing
-
Formspark EUSwitzerland
Customer support (sibling product of the same team; listed separately in our forms-surveys category)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (AWS) | United States | Cloud infrastructure (data stated by the vendor as stored in Ireland) | US |
| Google Ireland Limited (Google Workspace) | Ireland | Corporate and support email (from public MX records, not on the vendor's list) | US |
| Google LLC (Google Analytics) | United States | Website analytics | US |
| Sentry | United States | Error reporting | US |
| Stripe, Inc. | United States | Payment processing | US |
| Formspark | Switzerland | Customer support (sibling product of the same team; listed separately in our forms-surveys category) | EU |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Botpoison
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
CzechiaEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: Yes -
-
Austria · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
ALTCHA
Czechia
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: Yes
|
— |
captcha.eu
Austria
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€9/mo |
CaptchaFox
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
€15/mo |