MIT-licensed proof-of-work CAPTCHA from Brno (BAU Software s.r.o.) with a public DPA and EU-only Cloud endpoints, though the Cloud itself runs on AWS.
- FROM
- —
- CLOUD ACT
- MATERIAL
A single roll-up of ownership and CLOUD Act exposure.
Captcha GmbH, Muthgasse 2, 1190 Vienna, Austria (FN 602312d, Commercial Court Vienna)
Vienna CAPTCHA (Captcha GmbH, part of the Krone Multimedia group) with named processors, from 8.90 EUR/month, but the site itself runs on AWS CloudFront and Google analytics.
captcha.eu, in the CAPTCHA & bot protection category, offers EU hosting with Austria as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.
captcha.eu is operated by Captcha GmbH in Vienna, and the notable ownership fact is that it is not an independent startup: its own privacy policy names Krone Multimedia GesmbH & Co KG as the processor for technical development, support, marketing and sales, and Mediaprint for accounting, both at the group's Vienna addresses. In other words the product sits inside Austria's largest newspaper group, which is unambiguously EU ownership but worth knowing. The disclosure is genuinely good: it names its processors rather than describing categories, listing Krone Multimedia (AT), Mediaprint (AT), Stripe Payments Europe Ltd. (IE), Google Ireland Limited for web analytics and advertising performance measurement, and Didomi SAS (France) as consent platform. What contradicts the domain name is the infrastructure: captcha.eu is served from Amazon S3 behind CloudFront, its mail runs on Microsoft 365, and Google Ireland handles ad measurement, so a vendor selling escape from Google is itself measuring on Google and delivering from a US CDN: Material. No public DPA.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
Where ultimate control over the operating company sits.
captcha.eu is a GDPR-positioned CAPTCHA service operated by Captcha GmbH from Muthgasse in Vienna, sold to businesses with ready-made plugins for the common CMS platforms and a documented API. The product itself is a straightforward challenge-response service with an invisible mode, priced by request volume, and the marketing is squarely aimed at European operators who want to remove Google reCAPTCHA from their forms.
The ownership is the part worth reading carefully, and the vendor is upfront about it. The end-user privacy policy names Krone Multimedia GesmbH & Co KG as the commissioned processor for technical development, support, marketing and sales, and the service-user policy adds Mediaprint Zeitungs- und Zeitschriftenverlag for accounting, both companies in the Kronen Zeitung group and both at Vienna addresses, with Captcha GmbH sharing Krone Multimedia's building. So this is a product of Austria's largest newspaper group rather than an independent vendor. That is EU ownership by any measure, and it also means the operator is a substantial company rather than a two-person project.
Disclosure is above average for this category: alongside the two group companies the policies name Stripe Payments Europe Ltd. (Ireland) for billing, Google Ireland Limited for web analytics and advertising performance measurement, and Didomi SAS in Paris as consent management platform. What sits awkwardly against the domain name is the infrastructure. The site is served from Amazon S3 behind Amazon CloudFront, corporate mail runs on Microsoft 365, and the vendor's own consent banner declares five advertising partners with profiling purposes. None of that necessarily touches the verification path, but a company whose pitch is getting Google off your forms is itself measuring with Google and delivering from a US CDN: Material. There is no public DPA. Pricing is Basic at €9, Growth at 35.90 EUR and Advanced at 179.90 EUR per month, with a free trial and roughly 17% off on annual billing.
Static hosting and content delivery for captcha.eu (observed in live response headers, not named by the vendor)
Web analytics and advertising performance measurement
Corporate and support email (from public MX records, not named by the vendor)
Card payments and billing
Consent management platform
Technical development, support, marketing and sales (group company, named in the end-user privacy policy)
Accounting and downstream commercial processing (group company)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (S3 and CloudFront) | United States | Static hosting and content delivery for captcha.eu (observed in live response headers, not named by the vendor) | US |
| Google Ireland Limited | Ireland | Web analytics and advertising performance measurement | US |
| Microsoft Corporation (Microsoft 365) | United States | Corporate and support email (from public MX records, not named by the vendor) | US |
| Stripe Payments Europe Ltd. | Ireland | Card payments and billing | US |
| Didomi SAS | France | Consent management platform | EU |
| Krone Multimedia GesmbH & Co KG | Austria | Technical development, support, marketing and sales (group company, named in the end-user privacy policy) | EU |
| Mediaprint Zeitungs- und Zeitschriftenverlag GmbH & Co KG | Austria | Accounting and downstream commercial processing (group company) | EU |
MIT-licensed proof-of-work CAPTCHA from Brno (BAU Software s.r.o.) with a public DPA and EU-only Cloud endpoints, though the Cloud itself runs on AWS.
Invisible proof-of-work form spam filter (Formspark team), free to 1,000 challenges a month, with a published sub-processor list that is mostly American and no legal entity named.
Munich-area CAPTCHA (Scoria Labs GmbH) with a published two-name sub-processor chain for the widget: Hetzner and bunny.net, both EU, from 15 EUR/month.