mosparo
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
mosparo Association, 5507 Mellingen, Switzerland
MIT-licensed self-hosted spam protection from a Swiss non-profit association: you run it on your own server, so there is no processor chain at all.
mosparo is an EU-owned service hosted in Switzerland, with no identified CLOUD Act exposure. It is listed under CAPTCHA & bot protection.
Assessment notes
mosparo is self-hosted spam protection under the MIT licence, published by the mosparo Association, a non-profit association based in Mellingen, Switzerland. There is no hosted service and no vendor account, which is exactly why it scores as it does: you run mosparo on your own infrastructure, the form data is checked on your server, and there is no third party in the path at all, so there is no sub-processor chain to audit and no CLOUD Act surface to assess: None. The DPA criterion does not apply, because the association never processes customer data and has no agreement to publish; under our rubric that exemption covers self-hosted software. The association's own website states that it stores no personal data of visitors, not even IP addresses in log files. The trade-off is the obvious one: no managed option, no SLA, and you carry the operations, updates and security patching yourself.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About mosparo
mosparo is self-hosted spam protection for web forms, released under the MIT licence and maintained by the mosparo Association, a non-profit association registered in Mellingen, Switzerland. It takes a different approach from the rest of this category: rather than challenging the visitor or scoring their behaviour against a remote signal graph, mosparo analyses the submitted form content on your own server, combined with honeypot fields and interaction checks, and decides from that whether the submission is spam. From the visitor's side the result is that there is usually nothing to do at all.
For an EU-sovereignty audit this is the simplest listing on the site to reason about, because there is nothing to audit. You install mosparo on your own infrastructure, so the association never sees a visitor, never receives form data and never becomes a processor. That means no sub-processor chain, no data-transfer question, no DPA to chase and no exposure to any foreign legal regime through the vendor: None. The association's own website states it stores no personal data from visitors, not even IP addresses in log files, and is hosted by zepi, with downloads distributed via GitHub. The project is MIT licensed with roughly 300 stars on its repository and offers integrations for the common CMS and form platforms.
The trade-offs are the ones that always come with self-hosting, and they are real. There is no managed service, so there is nothing to buy and nobody to call: you own the deployment, the updates, the database and the security patching. There is no uptime SLA, no support contract, and no vendor to put in front of an auditor. Detection is content-based, which suits contact and registration forms very well and is a different tool from the traffic-level bot filtering that Prosopo or CaptchaFox offer at the edge. Best fit: teams that already run their own EU infrastructure and for whom the actual requirement is removing every third party from the form path, particularly public-sector and privacy-critical sites.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of mosparo
Integration & access
Compliance & governance
Public documents
-
n/aData Processing Addendum (DPA)— not assessed
-
missingSub-processors list— missing
-
OpenTerms of Servicemosparo.io/legal-notice…
Alternatives in this category
-
CzechiaEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: Yes -
-
Belgium · $2/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Austria · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
ALTCHA
Czechia
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: Yes
|
— |
Botpoison
Belgium
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
$2/mo |
captcha.eu
Austria
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€9/mo |