CaptchaFox is a bot-protection and CAPTCHA service operated by Scoria Labs GmbH from Hallbergmoos near Munich. The widget verifies visitors without setting cookies and without writing anything persistent to the browser, which is the practical reason to move off reCAPTCHA: no cookie banner entry, no consent dependency for the form to work, and a legitimate-interest basis under Art. 6(1)(f) rather than consent. Beyond the challenge itself the platform offers bot detection with risk signals, proxy and VPN detection, custom rules, geolocation rules and widget theming, with integrations and plugins for WordPress, React and Angular.
What sets it apart in this category is documentation rather than technology. CaptchaFox publishes a named sub-processor table on a public page, which almost nobody else here does, and the table that covers the widget lists exactly two companies: Hetzner Online GmbH in Germany for infrastructure and BunnyWay d.o.o. in Slovenia for content delivery. Both are EU-incorporated, so the chain a visitor's IP address actually travels through has no US link in it at all. The service-user policy adds Simple Analytics B.V. (Netherlands) for the vendor's own website analytics and Stripe Payments Europe Ltd. (Ireland) for card billing; Stripe's Irish entity sits under a US parent, which is the single reason the exposure is recorded as minor rather than none: Minor.
Pricing starts at €15 per month for 10,000 requests across 2 domains, then Growth at 39 EUR (30,000 requests), Team at 85 EUR (100,000 requests, plus intelligence APIs) and a custom Enterprise tier with a 99.95% uptime SLA. There is a free trial but no permanent free tier. The one gap for a procurement reader is the data processing agreement: CaptchaFox states a DPA is included on every plan, but you have to email for it, and the current sub-processor list and technical measures come with it rather than being published. Under our rubric a DPA that cannot be read before signing up caps the score at 3/5, which is the only thing separating this listing from the top of the category. Best fit: teams leaving reCAPTCHA who want the processor chain named and verifiable in advance.