CaptchaFox
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Scoria Labs GmbH, Fokkerstr. 2, 85399 Hallbergmoos, Germany (HRB 283108, Munich Local Court)
Munich-area CAPTCHA (Scoria Labs GmbH) with a published two-name sub-processor chain for the widget: Hetzner and bunny.net, both EU, from 15 EUR/month.
CaptchaFox is a European service hosted in Germany, with at most minor, transient US exposure under the CLOUD Act. It is listed under CAPTCHA & bot protection.
Assessment notes
CaptchaFox is operated by Scoria Labs GmbH in Hallbergmoos near Munich and has the cleanest published processor chain in this category. Both of its privacy policies carry a named sub-processor table, and the one that governs the widget, the part that actually touches your visitors, contains exactly two entries: Hetzner Online GmbH (Germany, infrastructure) and BunnyWay d.o.o. (Slovenia, CDN), both EU-incorporated. The service-user side adds Simple Analytics B.V. (Netherlands, itself listed in our web-analytics category) and Stripe Payments Europe Ltd. (Ireland) for billing, which is the only US-owned link in the chain and touches account data rather than visitor data: Minor. The vendor states EU-only processing with no third-country transfers, and the observed infrastructure is consistent with that. One thing holds the score at 3/5 and it is procedural, not technical: the DPA is available on request only ("reach out and we will provide the agreement"), not as a page a buyer can read before signing up, which caps the score under our rubric regardless of how good the rest looks.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 1 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About CaptchaFox
CaptchaFox is a bot-protection and CAPTCHA service operated by Scoria Labs GmbH from Hallbergmoos near Munich. The widget verifies visitors without setting cookies and without writing anything persistent to the browser, which is the practical reason to move off reCAPTCHA: no cookie banner entry, no consent dependency for the form to work, and a legitimate-interest basis under Art. 6(1)(f) rather than consent. Beyond the challenge itself the platform offers bot detection with risk signals, proxy and VPN detection, custom rules, geolocation rules and widget theming, with integrations and plugins for WordPress, React and Angular.
What sets it apart in this category is documentation rather than technology. CaptchaFox publishes a named sub-processor table on a public page, which almost nobody else here does, and the table that covers the widget lists exactly two companies: Hetzner Online GmbH in Germany for infrastructure and BunnyWay d.o.o. in Slovenia for content delivery. Both are EU-incorporated, so the chain a visitor's IP address actually travels through has no US link in it at all. The service-user policy adds Simple Analytics B.V. (Netherlands) for the vendor's own website analytics and Stripe Payments Europe Ltd. (Ireland) for card billing; Stripe's Irish entity sits under a US parent, which is the single reason the exposure is recorded as minor rather than none: Minor.
Pricing starts at €15 per month for 10,000 requests across 2 domains, then Growth at 39 EUR (30,000 requests), Team at 85 EUR (100,000 requests, plus intelligence APIs) and a custom Enterprise tier with a 99.95% uptime SLA. There is a free trial but no permanent free tier. The one gap for a procurement reader is the data processing agreement: CaptchaFox states a DPA is included on every plan, but you have to email for it, and the current sub-processor list and technical measures come with it rather than being published. Under our rubric a DPA that cannot be read before signing up caps the score at 3/5, which is the only thing separating this listing from the top of the category. Best fit: teams leaving reCAPTCHA who want the processor chain named and verifiable in advance.
Sub-processor map · 4
-
Stripe Payments Europe Ltd. USIreland
Card payments and billing (service-user path)
-
BunnyWay d.o.o. (bunny.net) EUSlovenia
Content delivery network (widget path; Ljubljana, Slovenia)
-
Hetzner Online GmbH EUGermany
Infrastructure hosting (widget path; Industriestr. 25, Gunzenhausen, Germany)
-
Simple Analytics B.V. EUNetherlands
Web analytics on the vendor's own website (service-user path)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Stripe Payments Europe Ltd. | Ireland | Card payments and billing (service-user path) | US |
| BunnyWay d.o.o. (bunny.net) | Slovenia | Content delivery network (widget path; Ljubljana, Slovenia) | EU |
| Hetzner Online GmbH | Germany | Infrastructure hosting (widget path; Industriestr. 25, Gunzenhausen, Germany) | EU |
| Simple Analytics B.V. | Netherlands | Web analytics on the vendor's own website (service-user path) | EU |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of CaptchaFox
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
CzechiaEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: Yes -
-
Belgium · $2/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Austria · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
ALTCHA
Czechia
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: Yes
|
— |
Botpoison
Belgium
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
$2/mo |
captcha.eu
Austria
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€9/mo |