Prosopo
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Prosopo Limited (company no. 13421250), 27 Old Gloucester Street, London WC1N 3AX, United Kingdom
UK bot-protection service (Prosopo Limited) with the category's most transparent DPA, naming seven sub-processors, four EU and three US; free tier of 10,000 requests a month.
Prosopo offers EU hosting in the United Kingdom, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under CAPTCHA & bot protection.
Assessment notes
Prosopo, whose widget is branded Procaptcha, is operated by Prosopo Limited, a UK company registered in London, so it is not an EU operator and its ownership signal is recorded as other. Its transparency, though, is the best in this category: a publicly readable DPA that includes a named sub-processor list, plus separate end-user and service-user privacy policies and a dedicated GDPR page. That list is also the finding. The named sub-processors are Contabo (Germany), Hetzner (Germany), OVHcloud (France), Bunny (Slovenia), AWS, Cloudflare for DNS resolution, and Hostwinds, so three of the seven are US-owned and sit in the delivery path rather than in billing: Material. The vendor describes hosting as dedicated EU-based data centres plus worldwide edge distribution, which means EU residency is the intent but the edge is global. A genuinely free tier of 10,000 requests per month and a free 30-day trial of the paid plan make it the easiest entry point here.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 7 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Prosopo
Prosopo is a bot-protection platform whose CAPTCHA widget is branded Procaptcha, operated by Prosopo Limited from London. The product goes wider than a challenge widget: invisible verification with a challenge fallback, a built-in honeypot, known-abusive-network blocking, disposable-email filtering on the free tier, then bot risk scores exposed to your application, device and context-aware detection, IP reputation and location rules, VPN, proxy and datacentre traffic filtering, analytics and custom theming on the paid tier. There are integrations for WordPress and its plugin ecosystem, and migration comparisons against reCAPTCHA, hCaptcha, Cloudflare Turnstile and Friendly Captcha.
For this directory the interesting thing is the paperwork. Prosopo publishes a data processing agreement as a readable page, no login and no email request, and clause 5 of that agreement lists its current sub-processors by name: Contabo, Hetzner, OVHcloud, Bunny, AWS, Cloudflare for DNS resolution, and Hostwinds. Nobody else in this category exposes their infrastructure chain that plainly, and the list is worth reading closely rather than just crediting: four of the seven are EU-incorporated, and three, AWS, Cloudflare and Hostwinds, are US-owned and sit in the serving path rather than in billing. The service-user policy describes hosting as dedicated EU-based data centres with edge distribution worldwide, routing each request to a nearby data centre, so European residency is the design intent while the edge is global: Material.
The operator is UK, not EU, which is why the ownership signal here reads as other rather than EU-owned; UK adequacy currently covers transfers, but it is a political decision subject to periodic renewal rather than a structural guarantee. Pricing is the friendliest in the category: a genuinely free tier with 10,000 requests a month and one protected site, then a Professional plan with up to 1 million requests, 50 sites and a 30-day free trial, then custom Enterprise; prices are shown in USD, EUR or GBP in the app rather than as a fixed figure on the page. Best fit: teams that want to see the whole chain before committing, and small sites that need free rather than trial.
Sub-processor map · 7
-
Amazon Web Services (AWS) USUnited States
Cloud infrastructure
-
Cloudflare, Inc. USUnited States
DNS resolution
-
Hostwinds LLC USUnited States
Infrastructure hosting
-
BunnyWay d.o.o. (bunny.net) EUSlovenia
Content delivery network
-
Contabo GmbH EUGermany
Infrastructure hosting
-
Hetzner Online GmbH EUGermany
Infrastructure hosting
-
OVHcloud EUFrance
Infrastructure hosting
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (AWS) | United States | Cloud infrastructure | US |
| Cloudflare, Inc. | United States | DNS resolution | US |
| Hostwinds LLC | United States | Infrastructure hosting | US |
| BunnyWay d.o.o. (bunny.net) | Slovenia | Content delivery network | EU |
| Contabo GmbH | Germany | Infrastructure hosting | EU |
| Hetzner Online GmbH | Germany | Infrastructure hosting | EU |
| OVHcloud | France | Infrastructure hosting | EU |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Prosopo
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
CzechiaEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: Yes -
-
Belgium · $2/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Austria · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
ALTCHA
Czechia
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: Yes
|
— |
Botpoison
Belgium
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
$2/mo |
captcha.eu
Austria
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€9/mo |