mosparo is self-hosted spam protection for web forms, released under the MIT licence and maintained by the mosparo Association, a non-profit association registered in Mellingen, Switzerland. It takes a different approach from the rest of this category: rather than challenging the visitor or scoring their behaviour against a remote signal graph, mosparo analyses the submitted form content on your own server, combined with honeypot fields and interaction checks, and decides from that whether the submission is spam. From the visitor's side the result is that there is usually nothing to do at all.
For an EU-sovereignty audit this is the simplest listing on the site to reason about, because there is nothing to audit. You install mosparo on your own infrastructure, so the association never sees a visitor, never receives form data and never becomes a processor. That means no sub-processor chain, no data-transfer question, no DPA to chase and no exposure to any foreign legal regime through the vendor: None. The association's own website states it stores no personal data from visitors, not even IP addresses in log files, and is hosted by zepi, with downloads distributed via GitHub. The project is MIT licensed with roughly 300 stars on its repository and offers integrations for the common CMS and form platforms.
The trade-offs are the ones that always come with self-hosting, and they are real. There is no managed service, so there is nothing to buy and nobody to call: you own the deployment, the updates, the database and the security patching. There is no uptime SLA, no support contract, and no vendor to put in front of an auditor. Detection is content-based, which suits contact and registration forms very well and is a different tool from the traffic-level bot filtering that Prosopo or CaptchaFox offer at the edge. Best fit: teams that already run their own EU infrastructure and for whom the actual requirement is removing every third party from the form path, particularly public-sector and privacy-critical sites.