Is ALTCHA European?

Verified European

Yes. ALTCHA is under verified European control.

ALTCHA's operator is BAU Software s.r.o., IČO 19414480, VAT CZ19414480, registered at Lidická 700/19, Veveří, 602 00 Brno. It was incorporated on 8 June 2023 under file C 134480 at the Regional Court in Brno. The current official extract on 15 September 2026 lists Daniel Regéci as sole shareholder with a 1/1 share and sole managing director. ARES corroborates the ownership and VIES returned the company name and address for a valid VAT number. Cloud, Sentinel and WordPress terms select Czech law and courts, subject to applicable mandatory rules.

Latest

Nothing new on file since the check on 15 September 2026. Seen news about ALTCHA? Send it with a source.

Controlled by: Daniel Regéci, sole shareholder of BAU Software s.r.o.
Control sits in: Czechia
Seat: Czech Republic
Last checked: 15 September 2026

About ALTCHA

ALTCHA provides a proof-of-work captcha widget under the MIT licence, alongside the hosted ALTCHA Cloud service, self-hosted Sentinel server and WordPress plugin. The widget can run with your own challenge server. Sentinel and the current WordPress plugin have separate commercial licences; the WordPress Free Plan permits production use.

altcha.org

Evidence 5

Sources were opened and read on the date of the check. Registers and websites change; if one of these no longer says what we cite it for, tell us.

Product

ALTCHA

altcha.org ↗

Czech captcha with an open source widget and hosted or self-hosted options

BAU Software s.r.o. in Brno operates ALTCHA. The current Czech register identifies Daniel Regéci as its sole shareholder, establishing European control. Cloud's DPA commits end-user processing to the EU. Self-hosted deployments use infrastructure chosen by the customer, while account, billing and supporting services have separate data flows.

Instead of: hCaptcha and reCAPTCHA
Pricing: The MIT widget is free, and WordPress has a free production plan. Cloud starts at 47 euro/month for 3 sites, with 1,000 API requests/day, bursts up to 100/hour and a 30-day trial. Sentinel Professional starts at 99 euro/month; its 30-day trial is for non-production evaluation. WordPress Pro starts at 18.90 euro/month for 1 site with a 14-day trial. Prices exclude VAT.
Suits: Developers choosing between hosted and self-hosted captcha

Free plan

Operations

Who runs the parts of the service we could observe from outside, checked 15 September 2026. A provider's control can differ from where its servers stand.

Part	Provider	Provider control	What we saw
Core hosting	ALTCHA Cloud / undisclosed origin providers	Unknown	The Cloud DPA commits end-user processing exclusively to the EU. It authorizes hosting and other subprocessors without a named schedule; origin providers and regions are not independently established. This EU processing commitment does not cover all account and billing data. The DPA summary's no-further-subprocessors statement conflicts with the downloadable contract. [1] [2] [3]
Core hosting	Customer-selected self-hosted infrastructure	None	The MIT widget and customer-operated challenge server, Sentinel and WordPress can run on customer-controlled infrastructure. BAU says it does not process customer application data during normal self-hosted operation; licence validation and separately agreed support access have different scopes. Hosting location and suppliers depend on the customer. [1] [2] [3] [4]
Public website	Bunny CDN	Unknown	altcha.org CNAME altcha-web-next.b-cdn.net; cloud.altcha.org CNAME altcha-cloud.b-cdn.net. Both returned BunnyCDN server headers. These identify website and dashboard edge delivery, replacing the earlier CDN77-only attribution. Edge IPs and network ASNs do not establish origin location or the CDN supplier's ultimate control. [1] [2] [3] [4]
Supporting service	Bunny CDN / Cloud API edge	Unknown	The documented EU endpoint eu.altcha.org resolves through eu-altcha-org.b-cdn.net. us.altcha.org also has a Bunny CNAME, but its current production role is unverified. A hostname or edge address alone does not establish US end-user processing or disprove the current EU Cloud DPA. [1] [2] [3] [4]
Incoming email	Proton Mail	European	MX records for altcha.org point to mail.protonmail.ch (10) and mailsec.protonmail.ch (20). This identifies inbound business mail, not the Cloud verification database. [1] [2]
Outgoing email	Proton Mail	European	The altcha.org SPF record authorizes _spf.protonmail.ch. SPF is sender authorization, not a complete observation of every transactional email delivery route. [1] [2]
Supporting service	IBM NS1	Not European	Authoritative DNS uses dns1.p06.nsone.net through dns4.p06.nsone.net. NS1 is an IBM product; authoritative DNS is separate from Cloud origin hosting and ALTCHA ownership. [1] [2]
Supporting service	Amazon Web Services	Not European	The privacy policy names AWS for possible hosting, infrastructure, email delivery, security or operations. It does not provide a region or per-service deployment schedule. This disclosure alone does not prove that EU end-user verification data is processed outside the EU. [1]
Payments	Paddle	Unknown	Terms say Paddle.com may act as merchant of record, with direct invoicing available to eligible EU customers. Paddle is also named in the privacy policy. The applicable checkout entity and ultimate control are not established here; account and billing processing has a wider geographic scope than Cloud end-user data. [1] [2] [3]
Supporting service	BAU Software / Sentinel licence validation	European	Sentinel periodically contacts eu.altcha.org by default. Current documentation says version 1.15.0 onward sends application version, Node ID and process ID. A purchased licence file supplied as LICENSE_JSON supports offline validation. The self-hosted agreement describes licence identifiers and heartbeat data separately from customer application data. [1] [2] [3]
Supporting service	jsDelivr / optional widget delivery	Unknown	The Cloud quick-start example loads the widget from cdn.jsdelivr.net using its GitHub repository path. This is optional client-side script delivery; installing and serving the MIT widget locally avoids that browser fetch. It is not evidence that jsDelivr stores Cloud verification data. [1] [2]

Cloud's downloadable DPA permits subprocessors and promises EU end-user processing, while the summary page says there are no further subprocessors. A named schedule is missing; account and billing data may be processed outside the EU. The website, dashboard and EU API use Bunny CDN; DNS uses IBM NS1 and mail uses Proton. The privacy policy names AWS and Paddle without a complete deployment map. Sentinel normally keeps application data on customer infrastructure, but licence checks contact eu.altcha.org unless offline validation is configured. Its verification logs default to a configurable 72-hour retention with IP anonymization. The Cloud quick-start optionally loads the widget from jsDelivr. Current Cloud terms have no fixed retention period, and API rate limits return HTTP 429 when exceeded.

Badge

ALTCHA can show its verified European ownership with a badge that links back to this page. If the verdict ever changes, the badge stops working.

Embed code

<a href="https://eu-alt.eu/company/altcha"><img src="https://eu-alt.eu/badges/altcha/ownership-blue.svg" alt="ALTCHA: European owned, verified by eu-alt.eu" width="360" height="96" loading="lazy"></a>

Also available in black and white, and as a compact badge: change blue to black or white, or ownership to ownership-compact.