captcha.eu
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Captcha GmbH, Muthgasse 2, 1190 Vienna, Austria (FN 602312d, Commercial Court Vienna)
Vienna CAPTCHA (Captcha GmbH, part of the Krone Multimedia group) with named processors, from 8.90 EUR/month, but the site itself runs on AWS CloudFront and Google analytics.
captcha.eu offers EU hosting in Austria, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under CAPTCHA & bot protection.
Assessment notes
captcha.eu is operated by Captcha GmbH in Vienna, and the notable ownership fact is that it is not an independent startup: its own privacy policy names Krone Multimedia GesmbH & Co KG as the processor for technical development, support, marketing and sales, and Mediaprint for accounting, both at the group's Vienna addresses. In other words the product sits inside Austria's largest newspaper group, which is unambiguously EU ownership but worth knowing. The disclosure is genuinely good: it names its processors rather than describing categories, listing Krone Multimedia (AT), Mediaprint (AT), Stripe Payments Europe Ltd. (IE), Google Ireland Limited for web analytics and advertising performance measurement, and Didomi SAS (France) as consent platform. What contradicts the domain name is the infrastructure: captcha.eu is served from Amazon S3 behind CloudFront, its mail runs on Microsoft 365, and Google Ireland handles ad measurement, so a vendor selling escape from Google is itself measuring on Google and delivering from a US CDN: Material. No public DPA.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 7 · 4 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About captcha.eu
captcha.eu is a GDPR-positioned CAPTCHA service operated by Captcha GmbH from Muthgasse in Vienna, sold to businesses with ready-made plugins for the common CMS platforms and a documented API. The product itself is a straightforward challenge-response service with an invisible mode, priced by request volume, and the marketing is squarely aimed at European operators who want to remove Google reCAPTCHA from their forms.
The ownership is the part worth reading carefully, and the vendor is upfront about it. The end-user privacy policy names Krone Multimedia GesmbH & Co KG as the commissioned processor for technical development, support, marketing and sales, and the service-user policy adds Mediaprint Zeitungs- und Zeitschriftenverlag for accounting, both companies in the Kronen Zeitung group and both at Vienna addresses, with Captcha GmbH sharing Krone Multimedia's building. So this is a product of Austria's largest newspaper group rather than an independent vendor. That is EU ownership by any measure, and it also means the operator is a substantial company rather than a two-person project.
Disclosure is above average for this category: alongside the two group companies the policies name Stripe Payments Europe Ltd. (Ireland) for billing, Google Ireland Limited for web analytics and advertising performance measurement, and Didomi SAS in Paris as consent management platform. What sits awkwardly against the domain name is the infrastructure. The site is served from Amazon S3 behind Amazon CloudFront, corporate mail runs on Microsoft 365, and the vendor's own consent banner declares five advertising partners with profiling purposes. None of that necessarily touches the verification path, but a company whose pitch is getting Google off your forms is itself measuring with Google and delivering from a US CDN: Material. There is no public DPA. Pricing is Basic at €9, Growth at 35.90 EUR and Advanced at 179.90 EUR per month, with a free trial and roughly 17% off on annual billing.
Sub-processor map · 7
-
Amazon Web Services (S3 and CloudFront) USUnited States
Static hosting and content delivery for captcha.eu (observed in live response headers, not named by the vendor)
-
Google Ireland Limited USIreland
Web analytics and advertising performance measurement
-
Microsoft Corporation (Microsoft 365) USUnited States
Corporate and support email (from public MX records, not named by the vendor)
-
Stripe Payments Europe Ltd. USIreland
Card payments and billing
-
Didomi SAS EUFrance
Consent management platform
-
Krone Multimedia GesmbH & Co KG EUAustria
Technical development, support, marketing and sales (group company, named in the end-user privacy policy)
-
Mediaprint Zeitungs- und Zeitschriftenverlag GmbH & Co KG EUAustria
Accounting and downstream commercial processing (group company)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (S3 and CloudFront) | United States | Static hosting and content delivery for captcha.eu (observed in live response headers, not named by the vendor) | US |
| Google Ireland Limited | Ireland | Web analytics and advertising performance measurement | US |
| Microsoft Corporation (Microsoft 365) | United States | Corporate and support email (from public MX records, not named by the vendor) | US |
| Stripe Payments Europe Ltd. | Ireland | Card payments and billing | US |
| Didomi SAS | France | Consent management platform | EU |
| Krone Multimedia GesmbH & Co KG | Austria | Technical development, support, marketing and sales (group company, named in the end-user privacy policy) | EU |
| Mediaprint Zeitungs- und Zeitschriftenverlag GmbH & Co KG | Austria | Accounting and downstream commercial processing (group company) | EU |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of captcha.eu
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
CzechiaEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: Yes -
-
Belgium · $2/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
ALTCHA
Czechia
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: Yes
|
— |
Botpoison
Belgium
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
$2/mo |
CaptchaFox
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
€15/mo |