MIT-licensed proof-of-work CAPTCHA from Brno (BAU Software s.r.o.) with a public DPA and EU-only Cloud endpoints, though the Cloud itself runs on AWS.
- FROM
- —
- CLOUD ACT
- MATERIAL
A single roll-up of ownership and CLOUD Act exposure.
Prosopo Limited (company no. 13421250), 27 Old Gloucester Street, London WC1N 3AX, United Kingdom
UK bot-protection service (Prosopo Limited) with the category's most transparent DPA, naming seven sub-processors, four EU and three US; free tier of 10,000 requests a month.
Prosopo, in the CAPTCHA & bot protection category, offers EU hosting with the United Kingdom as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.
Prosopo, whose widget is branded Procaptcha, is operated by Prosopo Limited, a UK company registered in London, so it is not an EU operator and its ownership signal is recorded as other. Its transparency, though, is the best in this category: a publicly readable DPA that includes a named sub-processor list, plus separate end-user and service-user privacy policies and a dedicated GDPR page. That list is also the finding. The named sub-processors are Contabo (Germany), Hetzner (Germany), OVHcloud (France), Bunny (Slovenia), AWS, Cloudflare for DNS resolution, and Hostwinds, so three of the seven are US-owned and sit in the delivery path rather than in billing: Material. The vendor describes hosting as dedicated EU-based data centres plus worldwide edge distribution, which means EU residency is the intent but the edge is global. A genuinely free tier of 10,000 requests per month and a free 30-day trial of the paid plan make it the easiest entry point here.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
Where ultimate control over the operating company sits.
Prosopo is a bot-protection platform whose CAPTCHA widget is branded Procaptcha, operated by Prosopo Limited from London. The product goes wider than a challenge widget: invisible verification with a challenge fallback, a built-in honeypot, known-abusive-network blocking, disposable-email filtering on the free tier, then bot risk scores exposed to your application, device and context-aware detection, IP reputation and location rules, VPN, proxy and datacentre traffic filtering, analytics and custom theming on the paid tier. There are integrations for WordPress and its plugin ecosystem, and migration comparisons against reCAPTCHA, hCaptcha, Cloudflare Turnstile and Friendly Captcha.
For this directory the interesting thing is the paperwork. Prosopo publishes a data processing agreement as a readable page, no login and no email request, and clause 5 of that agreement lists its current sub-processors by name: Contabo, Hetzner, OVHcloud, Bunny, AWS, Cloudflare for DNS resolution, and Hostwinds. Nobody else in this category exposes their infrastructure chain that plainly, and the list is worth reading closely rather than just crediting: four of the seven are EU-incorporated, and three, AWS, Cloudflare and Hostwinds, are US-owned and sit in the serving path rather than in billing. The service-user policy describes hosting as dedicated EU-based data centres with edge distribution worldwide, routing each request to a nearby data centre, so European residency is the design intent while the edge is global: Material.
The operator is UK, not EU, which is why the ownership signal here reads as other rather than EU-owned; UK adequacy currently covers transfers, but it is a political decision subject to periodic renewal rather than a structural guarantee. Pricing is the friendliest in the category: a genuinely free tier with 10,000 requests a month and one protected site, then a Professional plan with up to 1 million requests, 50 sites and a 30-day free trial, then custom Enterprise; prices are shown in USD, EUR or GBP in the app rather than as a fixed figure on the page. Best fit: teams that want to see the whole chain before committing, and small sites that need free rather than trial.
Cloud infrastructure
DNS resolution
Infrastructure hosting
Content delivery network
Infrastructure hosting
Infrastructure hosting
Infrastructure hosting
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (AWS) | United States | Cloud infrastructure | US |
| Cloudflare, Inc. | United States | DNS resolution | US |
| Hostwinds LLC | United States | Infrastructure hosting | US |
| BunnyWay d.o.o. (bunny.net) | Slovenia | Content delivery network | EU |
| Contabo GmbH | Germany | Infrastructure hosting | EU |
| Hetzner Online GmbH | Germany | Infrastructure hosting | EU |
| OVHcloud | France | Infrastructure hosting | EU |
MIT-licensed proof-of-work CAPTCHA from Brno (BAU Software s.r.o.) with a public DPA and EU-only Cloud endpoints, though the Cloud itself runs on AWS.
Invisible proof-of-work form spam filter (Formspark team), free to 1,000 challenges a month, with a published sub-processor list that is mostly American and no legal entity named.
Vienna CAPTCHA (Captcha GmbH, part of the Krone Multimedia group) with named processors, from 8.90 EUR/month, but the site itself runs on AWS CloudFront and Google analytics.