Skip to content
CLOUD Act flagged on every listing
EU VETTED

captcha.eu

VERIFIED

Captcha GmbH, Muthgasse 2, 1190 Vienna, Austria (FN 602312d, Commercial Court Vienna)

CAPTCHA & bot protection · Austria

Vienna CAPTCHA (Captcha GmbH, part of the Krone Multimedia group) with named processors, from 8.90 EUR/month, but the site itself runs on AWS CloudFront and Google analytics.

In short

captcha.eu, in the CAPTCHA & bot protection category, offers EU hosting with Austria as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

captcha.eu is operated by Captcha GmbH in Vienna, and the notable ownership fact is that it is not an independent startup: its own privacy policy names Krone Multimedia GesmbH & Co KG as the processor for technical development, support, marketing and sales, and Mediaprint for accounting, both at the group's Vienna addresses. In other words the product sits inside Austria's largest newspaper group, which is unambiguously EU ownership but worth knowing. The disclosure is genuinely good: it names its processors rather than describing categories, listing Krone Multimedia (AT), Mediaprint (AT), Stripe Payments Europe Ltd. (IE), Google Ireland Limited for web analytics and advertising performance measurement, and Didomi SAS (France) as consent platform. What contradicts the domain name is the infrastructure: captcha.eu is served from Amazon S3 behind CloudFront, its mail runs on Microsoft 365, and Google Ireland handles ad measurement, so a vendor selling escape from Google is itself measuring on Google and delivering from a US CDN: Material. No public DPA.

CLOUD ACT
Ownership
Sub-procs
7 · 4 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
Jump to
Overview

About captcha.eu

captcha.eu is a GDPR-positioned CAPTCHA service operated by Captcha GmbH from Muthgasse in Vienna, sold to businesses with ready-made plugins for the common CMS platforms and a documented API. The product itself is a straightforward challenge-response service with an invisible mode, priced by request volume, and the marketing is squarely aimed at European operators who want to remove Google reCAPTCHA from their forms.

The ownership is the part worth reading carefully, and the vendor is upfront about it. The end-user privacy policy names Krone Multimedia GesmbH & Co KG as the commissioned processor for technical development, support, marketing and sales, and the service-user policy adds Mediaprint Zeitungs- und Zeitschriftenverlag for accounting, both companies in the Kronen Zeitung group and both at Vienna addresses, with Captcha GmbH sharing Krone Multimedia's building. So this is a product of Austria's largest newspaper group rather than an independent vendor. That is EU ownership by any measure, and it also means the operator is a substantial company rather than a two-person project.

Disclosure is above average for this category: alongside the two group companies the policies name Stripe Payments Europe Ltd. (Ireland) for billing, Google Ireland Limited for web analytics and advertising performance measurement, and Didomi SAS in Paris as consent management platform. What sits awkwardly against the domain name is the infrastructure. The site is served from Amazon S3 behind Amazon CloudFront, corporate mail runs on Microsoft 365, and the vendor's own consent banner declares five advertising partners with profiling purposes. None of that necessarily touches the verification path, but a company whose pitch is getting Google off your forms is itself measuring with Google and delivering from a US CDN: Material. There is no public DPA. Pricing is Basic at €9, Growth at 35.90 EUR and Advanced at 179.90 EUR per month, with a free trial and roughly 17% off on annual billing.

Sub-processors

Sub-processor map · 7

Source ↗
  • Amazon Web Services (S3 and CloudFront) US
    United States

    Static hosting and content delivery for captcha.eu (observed in live response headers, not named by the vendor)

  • Google Ireland Limited US
    Ireland

    Web analytics and advertising performance measurement

  • Microsoft Corporation (Microsoft 365) US
    United States

    Corporate and support email (from public MX records, not named by the vendor)

  • Stripe Payments Europe Ltd. US
    Ireland

    Card payments and billing

  • Didomi SAS EU
    France

    Consent management platform

  • Krone Multimedia GesmbH & Co KG EU
    Austria

    Technical development, support, marketing and sales (group company, named in the end-user privacy policy)

  • Mediaprint Zeitungs- und Zeitschriftenverlag GmbH & Co KG EU
    Austria

    Accounting and downstream commercial processing (group company)

4 of 7 sub-processors are US-incorporated. CLOUD Act exposure applies.
Certifications

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-08-10).
Features

Capability matrix

Self-hostable No
Invisible challenge Yes
CMS plugins Yes
Free tier No
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option No
Pricing

Pricing & tiers

PAID
from €9/mo
View pricing page ↗
Public documents

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    www.captcha.eu/dsgvo__en…
    Open ↗
  • Terms of Service
    www.captcha.eu/impressum…
    Open ↗
Alternatives

Alternatives in this category

ALTCHA
Czechia
EU-HOSTED

MIT-licensed proof-of-work CAPTCHA from Brno (BAU Software s.r.o.) with a public DPA and EU-only Cloud endpoints, though the Cloud itself runs on AWS.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
Botpoison
Belgium · Founded 2021
EU-HOSTED

Invisible proof-of-work form spam filter (Formspark team), free to 1,000 challenges a month, with a published sub-processor list that is mostly American and no legal entity named.

Public DPA Sub-processors Open source
FROM
$2/mo
CLOUD ACT
MATERIAL
CaptchaFox
Germany
EU-BASED

Munich-area CAPTCHA (Scoria Labs GmbH) with a published two-name sub-processor chain for the widget: Hetzner and bunny.net, both EU, from 15 EUR/month.

Public DPA Sub-processors Open source
FROM
€15/mo
CLOUD ACT
MINOR