Friendly Captcha
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Friendly Captcha GmbH, Wörthsee, Germany (HRB 260542, Munich Local Court)
German cookie-free proof-of-work CAPTCHA (Friendly Captcha GmbH) from 9 EUR/month, but the DPA and its sub-processor list are password-protected and EU-only hosting is a paid tier.
Friendly Captcha offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under CAPTCHA & bot protection.
Assessment notes
Friendly Captcha is the best-known German name in this category, operated by Friendly Captcha GmbH in Wörthsee near Munich with no US parent or funding round found. It is also the listing where the marketing and the published documents diverge most. Three claims from the vendor's submission did not verify against its own pages: the DPA at friendlycaptcha.com/legal/dpa is password-protected, so no buyer can read it before signing; the named sub-processor list exists only as Appendix 3 of that DPA, behind the same password, while the public privacy policy names categories of recipients; and EU-only hosting is not the default, because the homepage states data centres in the EU, US, Asia and around the world, with dedicated EU-only data centres listed as an Advanced-plan feature rather than a baseline. With EU-only processing off by default and the operators of that worldwide network unnamed, CLOUD Act exposure is recorded as Material. ISO/IEC 27001 (audited by TÜV SÜD, per the vendor) and WCAG 2.2 AA "certified by TÜV" are both claimed without a published certificate or report, so neither is recorded as a certification. The product itself is a solid cookie-free proof-of-work widget and the company is genuinely German. What is missing is the evidence, and every item on that list is fixable by publishing a page.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Friendly Captcha
Friendly Captcha is a cookie-free proof-of-work CAPTCHA from Friendly Captcha GmbH, based in Wörthsee near Munich and registered at the Munich Local Court under HRB 260542. It is probably the most widely recognised German entry in this category, and the product does the core job well: the widget runs a cryptographic puzzle in the visitor's browser instead of asking them to solve anything, sets no cookies, and works without a consent banner entry. Pricing runs from a free tier for non-commercial use through Starter at €9, Growth at 39 EUR and Advanced at 200 EUR per month.
It arrived in this directory through a vendor submission, and the submission is the reason the listing reads as it does. Three of the four compliance claims in it did not hold up against Friendly Captcha's own public pages on the day of audit. The data processing agreement at friendlycaptcha.com/legal/dpa returns a page saying the content is password-protected, so a prospective buyer cannot read the agreement before signing up. The named sub-processor list does exist, as Appendix 3 ("Approved Sub-Processors") of that agreement, but it sits behind the same password; the public privacy policy describes only categories of recipients such as IT service providers, data storage and hosting. And EU-only hosting is not the default posture: the homepage states data centres in the EU, the US, Asia and around the world, the service-user privacy policy describes more than 200 data centres worldwide with requests routed to one close to the requester, and the pricing table lists dedicated data centres ("e.g. EU only") as a feature of the Advanced plan at 200 EUR a month and of Enterprise, not of the entry tiers. With EU-only processing off by default and the operators of that network unnamed, CLOUD Act exposure is recorded as Material.
The Security Center states ISO/IEC 27001:2022 certification, audited by TÜV SÜD and valid until August 2029, and the accessibility page claims WCAG 2.2 AA conformance "certified by TÜV". Neither comes with a published certificate, report or audit date, so neither is recorded as a certification here. None of this is a judgment on how well the widget blocks bots, and the company itself is German-owned with no US parent or funding round found in public records. It is a record of what a buyer can verify before signing up. Every one of these gaps is closable by publishing a page, and the entry will be updated when they are. Best fit today: teams who want the best-known German option and either accept the documentation gaps or are buying at the Advanced tier where EU-only data centres become available.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Friendly Captcha
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicefriendlycaptcha.com/legal…
Alternatives in this category
-
CzechiaEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: Yes -
-
Belgium · $2/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Austria · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
ALTCHA
Czechia
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: Yes
|
— |
Botpoison
Belgium
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
$2/mo |
captcha.eu
Austria
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€9/mo |