Skip to content
CLOUD Act flagged on every listing
EU VETTED

Prosopo

VERIFIED

Prosopo Limited (company no. 13421250), 27 Old Gloucester Street, London WC1N 3AX, United Kingdom

CAPTCHA & bot protection · United Kingdom

UK bot-protection service (Prosopo Limited) with the category's most transparent DPA, naming seven sub-processors, four EU and three US; free tier of 10,000 requests a month.

In short

Prosopo, in the CAPTCHA & bot protection category, offers EU hosting with the United Kingdom as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

Prosopo, whose widget is branded Procaptcha, is operated by Prosopo Limited, a UK company registered in London, so it is not an EU operator and its ownership signal is recorded as other. Its transparency, though, is the best in this category: a publicly readable DPA that includes a named sub-processor list, plus separate end-user and service-user privacy policies and a dedicated GDPR page. That list is also the finding. The named sub-processors are Contabo (Germany), Hetzner (Germany), OVHcloud (France), Bunny (Slovenia), AWS, Cloudflare for DNS resolution, and Hostwinds, so three of the seven are US-owned and sit in the delivery path rather than in billing: Material. The vendor describes hosting as dedicated EU-based data centres plus worldwide edge distribution, which means EU residency is the intent but the edge is global. A genuinely free tier of 10,000 requests per month and a free 30-day trial of the paid plan make it the easiest entry point here.

CLOUD ACT
Ownership
Sub-procs
7 · 3 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
Jump to
Overview

About Prosopo

Prosopo is a bot-protection platform whose CAPTCHA widget is branded Procaptcha, operated by Prosopo Limited from London. The product goes wider than a challenge widget: invisible verification with a challenge fallback, a built-in honeypot, known-abusive-network blocking, disposable-email filtering on the free tier, then bot risk scores exposed to your application, device and context-aware detection, IP reputation and location rules, VPN, proxy and datacentre traffic filtering, analytics and custom theming on the paid tier. There are integrations for WordPress and its plugin ecosystem, and migration comparisons against reCAPTCHA, hCaptcha, Cloudflare Turnstile and Friendly Captcha.

For this directory the interesting thing is the paperwork. Prosopo publishes a data processing agreement as a readable page, no login and no email request, and clause 5 of that agreement lists its current sub-processors by name: Contabo, Hetzner, OVHcloud, Bunny, AWS, Cloudflare for DNS resolution, and Hostwinds. Nobody else in this category exposes their infrastructure chain that plainly, and the list is worth reading closely rather than just crediting: four of the seven are EU-incorporated, and three, AWS, Cloudflare and Hostwinds, are US-owned and sit in the serving path rather than in billing. The service-user policy describes hosting as dedicated EU-based data centres with edge distribution worldwide, routing each request to a nearby data centre, so European residency is the design intent while the edge is global: Material.

The operator is UK, not EU, which is why the ownership signal here reads as other rather than EU-owned; UK adequacy currently covers transfers, but it is a political decision subject to periodic renewal rather than a structural guarantee. Pricing is the friendliest in the category: a genuinely free tier with 10,000 requests a month and one protected site, then a Professional plan with up to 1 million requests, 50 sites and a 30-day free trial, then custom Enterprise; prices are shown in USD, EUR or GBP in the app rather than as a fixed figure on the page. Best fit: teams that want to see the whole chain before committing, and small sites that need free rather than trial.

Sub-processors

Sub-processor map · 7

Source ↗
  • Amazon Web Services (AWS) US
    United States

    Cloud infrastructure

  • Cloudflare, Inc. US
    United States

    DNS resolution

  • Hostwinds LLC US
    United States

    Infrastructure hosting

  • BunnyWay d.o.o. (bunny.net) EU
    Slovenia

    Content delivery network

  • Contabo GmbH EU
    Germany

    Infrastructure hosting

  • Hetzner Online GmbH EU
    Germany

    Infrastructure hosting

  • OVHcloud EU
    France

    Infrastructure hosting

3 of 7 sub-processors are US-incorporated. CLOUD Act exposure applies.
Certifications

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-08-10).
Features

Capability matrix

Self-hostable No
Invisible challenge Yes
Bot risk scoring Yes
WCAG accessibility conformance Yes
CMS plugins Yes
Free tier Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option No
Pricing

Pricing & tiers

FREEMIUM
Custom pricing

Contact vendor for tier or volume pricing.

View pricing page ↗
Public documents

Public documents

  • Data Processing Addendum (DPA)
    prosopo.io/data-processing-agreement…
    Open ↗
  • Sub-processors list
    prosopo.io/data-processing-agreement…
    Open ↗
  • Terms of Service
    prosopo.io/terms-and-conditions…
    Open ↗
Alternatives

Alternatives in this category

ALTCHA
Czechia
EU-HOSTED

MIT-licensed proof-of-work CAPTCHA from Brno (BAU Software s.r.o.) with a public DPA and EU-only Cloud endpoints, though the Cloud itself runs on AWS.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
Botpoison
Belgium · Founded 2021
EU-HOSTED

Invisible proof-of-work form spam filter (Formspark team), free to 1,000 challenges a month, with a published sub-processor list that is mostly American and no legal entity named.

Public DPA Sub-processors Open source
FROM
$2/mo
CLOUD ACT
MATERIAL
captcha.eu
Austria
EU-HOSTED

Vienna CAPTCHA (Captcha GmbH, part of the Krone Multimedia group) with named processors, from 8.90 EUR/month, but the site itself runs on AWS CloudFront and Google analytics.

Public DPA Sub-processors Open source
FROM
€9/mo
CLOUD ACT
MATERIAL