Hosted CAPTCHA and bot protection from Germany
GermanyEUEU hosted Ownership reviewed, controller unresolvedHigh non-EU dependencyScope verdict
Scoria Labs GmbH is identified in the imprint as HRB 283108, Munich Local Court, at Fokkerstr. 2, 85399 Hallbergmoos, VAT DE361369461, represented by Timon Graßl. The checked primary sources do not disclose shareholders, voting rights or a controlling parent. Management, German incorporation and European hosting do not establish ultimate control. The authoritative German terms dated 25 June 2026 apply German law; customer claims go to the company's seat, while the company can also sue at the customer's seat.
Operational dependency warning
Current public evidence shows 5 non-European infrastructure or email dependencies across 5 providers: MongoDB Atlas / MongoDB Inc., Namecheap Mail, Namecheap Private Email, Postmark / AC PM LLC, Stripe Payments Europe / Stripe Inc.. The reviewed operational path is therefore not entirely European.
CaptchaFox is a hosted bot-protection service operated by Scoria Labs GmbH in Hallbergmoos, Germany. It provides adaptive challenges, a verification API and integrations for web frameworks, WordPress and mobile apps. Growth adds invisible challenges; Team adds intelligence APIs and custom rules. Hidden mode can still display a challenge when the service considers one necessary.
The public client integrations do not provide the detection backend for self-hosting. For example, the React Native SDK has an MIT licence, while the service depends on CaptchaFox's hosted API. Enterprise lists custom dedicated infrastructure without establishing an on-premises offering. The operator claims WCAG 2.2 AA accessibility; this review did not obtain an independent audit.
The end-user policy says the widget uses no cookies or permanent browser storage. It initially processes IP addresses, browser/device details, operating system and timestamps, then anonymizes identifying data as early as possible. That is processing of personal data, not proof that no personal data is collected. The separate customer portal uses a two-day login cookie.
Excluding VAT: Starter EUR 18/month, Growth EUR 46/month and Team EUR 102/month; annual billing displays EUR 15, EUR 39 and EUR 85 per month respectively. Included monthly requests: 10,000, 30,000 and 100,000; domains: 2, 6 and 10; users: 1, 2 and 5. Enterprise is quoted. The FAQ describes a seven-day trial requiring a card with automatic charging afterwards. The homepage separately advertises a free plan without confirming its limits; permanent free availability remains unclear. Occasional quota spikes incur no automatic overage fee or shutdown according to the FAQ.
Data and operations
Verified operational dependencies, shown separately from ownership and from the service's core data hosting.
Core service hosting
Public website
Supporting services
Incoming business email
Why this matters
Published MX records route incoming business email through Namecheap Mail. Correspondent details and message content can therefore enter this non-European provider's systems; MX does not reveal the configured storage region.
Authorised outbound email
Why this matters
This domain authorises Namecheap Private Email to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.
Authorised outbound email
Customer email delivery
Why this matters
The service documents Postmark / AC PM LLC for customer email delivery. When selected, message content and recipient details can pass through this non-European provider. The cited source explains the configuration and location.
Supporting services
Why this matters
The published disclosure lists MongoDB Atlas / MongoDB Inc. for supporting services. Depending on the function, account or customer data may reach this non-European provider. See the source for the documented scope.
Payment processing
Why this matters
When this payment method is used, Stripe Payments Europe / Stripe Inc. processes payment and billing data. This role alone does not establish access to the service's other customer content.
Supporting services
Supporting services
Austrian CAPTCHA and bot protection from the Krone group
AustriaEU hostedEU controlled
Czech captcha with an open source widget and hosted or self-hosted options
Czech RepublicEU hostedOpen sourceFree planEU controlled
Open source proof of work captcha service
Open sourceOpen source
Open source spam protection for web forms
SwitzerlandOpen sourceEU controlled
