Botpoison is an invisible spam filter for web forms built on proof of work, from the team that also runs Formspark. There is no puzzle and nothing for the visitor to click: the browser computes a challenge in the background and the submission carries the result. It is deliberately small in scope, low-code, and aimed at contact forms and signup forms rather than at traffic-level bot filtering, with a free plan covering 1,000 challenges a month, then 2 USD for 5,000 and 7 USD for 50,000, unlimited installations on every tier.
It earns its place here for a reason that has nothing to do with the technology: Botpoison publishes its sub-processors by name on a public page, which puts it ahead of most of this category on transparency. Read the list, though, and the sovereignty picture is clear. The named processors are Amazon Web Services for cloud infrastructure, Formspark for customer support, Google Analytics for website analytics, Sentry for error reporting and Stripe for payments. Four of those five are US-incorporated, and AWS and Sentry sit in the operational path rather than in billing. The privacy policy states that the products and web properties are operated from Belgium and that information is transferred to and stored in Ireland, so the data is in the EU while the infrastructure operator is American: Material. Live infrastructure is consistent, with the site served from Amazon S3 behind CloudFront and corporate mail on Google Workspace.
The gap that matters most for a European buyer is not on the list at all. No legal entity is published anywhere on the site: no company name, no registration number and no registered address appear in the terms, the privacy policy or a legal notice, only the trading name and a copyright line. For a service sold to EU businesses, which are themselves subject to imprint requirements, that is a meaningful omission, and it is why the country recorded here rests entirely on the vendor's own sentence about operating from Belgium. There is no DPA either. Best fit: small sites and indie developers who want a free, invisible spam filter and are not making a sovereignty decision. Teams that are should look at the self-hosted or named-chain options in this category first.