Horizontal · Blue
Download SVG
ALTCHA
Czech captcha with an open source widget and hosted or self-hosted options
Czech RepublicEUEU hostedOpen sourceFree planEU controlledALTCHA provides a proof-of-work captcha widget under the MIT licence, alongside the hosted ALTCHA Cloud service, self-hosted Sentinel server and WordPress plugin. The widget can run with your own challenge server. Sentinel and the current WordPress plugin have separate commercial licences; the WordPress Free Plan permits production use.
BAU Software s.r.o. in Brno operates ALTCHA. The current Czech register identifies Daniel Regéci as its sole shareholder, establishing European control. Cloud's DPA commits end-user processing to the EU. Self-hosted deployments use infrastructure chosen by the customer, while account, billing and supporting services have separate data flows.
ALTCHA's operator is BAU Software s.r.o., IČO 19414480, VAT CZ19414480, registered at Lidická 700/19, Veveří, 602 00 Brno. It was incorporated on 8 June 2023 under file C 134480 at the Regional Court in Brno. The current official extract on 15 September 2026 lists Daniel Regéci as sole shareholder with a 1/1 share and sole managing director. ARES corroborates the ownership and VIES returned the company name and address for a valid VAT number. Cloud, Sentinel and WordPress terms select Czech law and courts, subject to applicable mandatory rules.
Pricing
The MIT widget is free, and WordPress has a free production plan. Cloud starts at 47 euro/month for 3 sites, with 1,000 API requests/day, bursts up to 100/hour and a 30-day trial. Sentinel Professional starts at 99 euro/month; its 30-day trial is for non-production evaluation. WordPress Pro starts at 18.90 euro/month for 1 site with a 14-day trial. Prices exclude VAT.
External verification
EU verification badge
eu-alt.eu independently verified this service's European ownership. Choose a badge style and link it back to the dated evidence on this page.
Evidence last checked:
Horizontal · Black
Download SVG
Embed code
Horizontal · White
Download SVG
Embed code
Compact · Blue
Download SVG
Embed code
Compact · Black
Download SVG
Embed code
Compact · White
Download SVG
Embed code
Data and operations
Infrastructure and email path
Verified operational dependencies, shown separately from ownership and from the service's core data hosting.
Core service hosting
ALTCHA Cloud / undisclosed origin providers
Provider control not verified- Observed
- The Cloud DPA commits end-user processing exclusively to the EU. It authorizes hosting and other subprocessors without a named schedule; origin providers and regions are not independently established. This EU processing commitment does not cover all account and billing data. The DPA summary's no-further-subprocessors statement conflicts with the downloadable contract.
Core service hosting
Customer-selected self-hosted infrastructure
No external provider observed- Observed
- The MIT widget and customer-operated challenge server, Sentinel and WordPress can run on customer-controlled infrastructure. BAU says it does not process customer application data during normal self-hosted operation; licence validation and separately agreed support access have different scopes. Hosting location and suppliers depend on the customer.
Public website
Bunny CDN
Provider control not verified- Observed
- altcha.org CNAME altcha-web-next.b-cdn.net; cloud.altcha.org CNAME altcha-cloud.b-cdn.net. Both returned BunnyCDN server headers. These identify website and dashboard edge delivery, replacing the earlier CDN77-only attribution. Edge IPs and network ASNs do not establish origin location or the CDN supplier's ultimate control.
Supporting services
Bunny CDN / Cloud API edge
Provider control not verified- Observed
- The documented EU endpoint eu.altcha.org resolves through eu-altcha-org.b-cdn.net. us.altcha.org also has a Bunny CNAME, but its current production role is unverified. A hostname or edge address alone does not establish US end-user processing or disprove the current EU Cloud DPA.
Incoming business email
Proton Mail
European provider- Observed
- MX 10 mail.protonmail.ch · 20 mailsec.protonmail.ch
- Evidence
- Current daily MX lookup ↗
Authorised outbound email
Proton Mail
European provider- Observed
- The altcha.org SPF record authorizes _spf.protonmail.ch. SPF is sender authorization, not a complete observation of every transactional email delivery route.
Supporting services
IBM NS1
Non-European provider- Observed
- Authoritative DNS uses dns1.p06.nsone.net through dns4.p06.nsone.net. NS1 is an IBM product; authoritative DNS is separate from Cloud origin hosting and ALTCHA ownership.
Why this matters
The published disclosure lists IBM NS1 for supporting services. Depending on the function, account or customer data may reach this non-European provider. See the source for the documented scope.
Supporting services
Amazon Web Services
US-controlled cloud- Observed
- The privacy policy names AWS for possible hosting, infrastructure, email delivery, security or operations. It does not provide a region or per-service deployment schedule. This disclosure alone does not prove that EU end-user verification data is processed outside the EU.
Why this matters
The published disclosure lists Amazon Web Services for supporting services. Depending on the function, account or customer data may reach this non-European provider. See the source for the documented scope.
Payment processing
Paddle
Provider control not verified- Observed
- Terms say Paddle.com may act as merchant of record, with direct invoicing available to eligible EU customers. Paddle is also named in the privacy policy. The applicable checkout entity and ultimate control are not established here; account and billing processing has a wider geographic scope than Cloud end-user data.
Supporting services
BAU Software / Sentinel licence validation
European provider- Observed
- Sentinel periodically contacts eu.altcha.org by default. Current documentation says version 1.15.0 onward sends application version, Node ID and process ID. A purchased licence file supplied as LICENSE_JSON supports offline validation. The self-hosted agreement describes licence identifiers and heartbeat data separately from customer application data.
Supporting services
jsDelivr / optional widget delivery
Provider control not verified- Observed
- The Cloud quick-start example loads the widget from cdn.jsdelivr.net using its GitHub repository path. This is optional client-side script delivery; installing and serving the MIT widget locally avoids that browser fetch. It is not evidence that jsDelivr stores Cloud verification data.
Austria
Open source
Switzerland