TrustCaptcha
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Trustcaptcha GmbH, Hans-Böckler-Straße 32, 80995 Munich, Germany (HRB 287710, Munich Local Court)
Munich proof-of-work CAPTCHA (Trustcaptcha GmbH) on Hetzner Nuremberg, from 8 EUR/month, with audit logs but no published DPA or sub-processor list.
TrustCaptcha is a European service hosted in Germany, with at most minor, transient US exposure under the CLOUD Act. It is listed under CAPTCHA & bot protection.
Assessment notes
TrustCaptcha is a proof-of-work CAPTCHA from Trustcaptcha GmbH in Munich, now sold under the TrustComponent brand alongside a status page and a VAT checker. The jurisdiction and infrastructure are straightforward: German GmbH, and the service resolves to Hetzner in Nuremberg, so both the operator and the servers are in Germany. Every plan is advertised as including "GDPR, EU hosted & DPA". What we could not do is verify the paperwork, and that is what holds the score at 3/5: there is no public DPA URL and no named sub-processor list, only a privacy policy that describes recipients by role (hosting providers, error logging, accounting, analytics, payment processors, advertising networks). The named third parties that do appear are Stripe Payments Europe Ltd. (Ireland) for billing, plus a Google Ads conversion cookie and an OpenReplay session-replay cookie on the vendor's own marketing site: Minor. The proof-of-work design is worth noting on its own, because it shifts the work to the visitor's browser instead of profiling the visitor.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Not assessed
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About TrustCaptcha
TrustCaptcha is a CAPTCHA built on dynamic proof-of-work, operated by Trustcaptcha GmbH in Munich and sold under the wider TrustComponent brand, which also covers a status page product and a VAT-ID checker. Rather than asking a visitor to identify traffic lights or profiling their behaviour against a global signal graph, the widget makes the browser compute a small cryptographic puzzle whose difficulty adapts to the assessed risk. That design choice is the reason it can work without a behavioural profile of the visitor, and it pairs with honeypot verification, bot detection and risk scoring, IP allow and block lists, custom access rules and geoblocking, bypass keys, environments, team seats with roles, and audit logs on the higher tiers.
On jurisdiction it is a simple read: a German GmbH registered in Munich, with the service resolving to Hetzner infrastructure in Nuremberg, so operator and servers are both in Germany. Every plan is marketed as "GDPR, EU hosted & DPA", and there is a 99.9% uptime commitment from the entry tier upwards.
The gap is documentation. There is no publicly reachable DPA and no named sub-processor list: the privacy policy lists recipients by function (hosting providers, error logging, accounting service providers, IT service providers, analytics, data storage, payment processors, advertising networks) without naming any of them. The named third parties we could confirm are Stripe Payments Europe Ltd. in Ireland for payments, a Google Ads click identifier stored as an optional advertising cookie, and an OpenReplay session-replay cookie, the last two on the vendor's own marketing site rather than in the widget path: Minor. Pricing is the most accessible in the category, starting at €8 per month for 1,000 verifications and one website, then Advanced at 36 EUR (10,000 verifications, 5 websites) and Team at 168 EUR (50,000 verifications). Best fit: German and EU teams that want a cheap, EU-hosted, non-profiling CAPTCHA and can live without published compliance documents.
Sub-processor map · 4
-
Google Ireland Limited (Google Ads) USIreland
Advertising conversion tracking on the vendor's own marketing site (optional cookie, stores the gclid)
-
OpenReplay USUnited States
Session replay on the vendor's own marketing site (optional analytics cookie)
-
Stripe Payments Europe Ltd. USIreland
Card payments and billing
-
Hetzner Online GmbH EUGermany
Infrastructure hosting (Nuremberg; determined from live infrastructure, not named by the vendor)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Google Ireland Limited (Google Ads) | Ireland | Advertising conversion tracking on the vendor's own marketing site (optional cookie, stores the gclid) | US |
| OpenReplay | United States | Session replay on the vendor's own marketing site (optional analytics cookie) | US |
| Stripe Payments Europe Ltd. | Ireland | Card payments and billing | US |
| Hetzner Online GmbH | Germany | Infrastructure hosting (Nuremberg; determined from live infrastructure, not named by the vendor) | EU |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of TrustCaptcha
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
on requestData Processing Addendum (DPA)— on request
-
missingSub-processors list— missing
-
OpenTerms of Servicetrustcaptcha.com/en…
Alternatives in this category
-
CzechiaEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: Yes -
-
Belgium · $2/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Austria · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
ALTCHA
Czechia
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: Yes
|
— |
Botpoison
Belgium
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
$2/mo |
captcha.eu
Austria
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€9/mo |