European Bot Protection and CAPTCHA Tools

#1 Friendly Captcha

Munich, Germany Founded 2020 Free tier / From €9/month Demo on request

Best for: Websites needing GDPR-compliant bot protection

• Operating company. Friendly Captcha
• Jurisdiction. EU (Germany)
• Source code. Closed source
• Replaces. Google reCAPTCHA, hCaptcha

Friendly Captcha asks the visitor's browser to solve a small cryptographic puzzle in the background, so a human sees nothing to click while a bot that submits thousands of forms has to pay for the computation each time. The vendor describes this proof-of-work approach as a replacement for the image puzzles and behavioural tracking of reCAPTCHA and hCaptcha, and states that the puzzle difficulty can be raised during an attack.

The company was founded in 2020 and is based in Munich, so GDPR applies directly. The tool page lists a free tier and paid plans from €9 a month, and the vendor says it uses no cookies and no user tracking. The honest limit is in the mechanism itself: proof-of-work makes abuse more expensive, it does not make it impossible, and it costs some battery on mobile devices.

Standout feature. It is the only entry here that relies on proof-of-work instead of a puzzle or a behaviour check, so the visitor does nothing at all.

#2 Captcha.eu

Vienna, Austria Starter €8.90 per month (1 protected website, up to 1,000 requests a month), Growth €35.90 per month (5 websites, up to 10,000 requests), Advanced €179.90 per month (10 websites, up to 100,000 requests); yearly billing is 10% cheaper at €96.12, €387.72 and €1,942.92 per year. All prices are net, excluding VAT. Custom plan for large companies on request. 100 free verification requests to try, no credit card required. Demo on request

Best for: Sites that want an Austrian-hosted CAPTCHA with published net prices and an accessibility certificate

• Operating company. Captcha GmbH
• Jurisdiction. EU (Austria)
• Where the data sits. Hosted in Austria (per pricing page); requests processed at the point of presence closest to the visitor (per the 'Why Captcha.eu' page)
• Source code. Closed source
• Replaces. Google reCAPTCHA, hCaptcha

Captcha.eu offers two modes from Captcha GmbH in Vienna: a check that runs invisibly and a one-click widget for sites that prefer a visible confirmation. The vendor names machine learning and crypto-challenges as its detection methods and states that it sets no cookies, tracks no end users and shows no image puzzles.

All plans are described as hosted in Austria, and prices are published net of VAT from €8.90 a month for one site and 1,000 requests, up to €179.90 for ten sites and 100,000 requests. TÜV Austria awarded the captcha application a silver Web Accessibility Certificate Austria; the vendor notes that this covers its test page, not customer forms, and GDPR compliance is self-declared. There is no permanent free plan, only 100 free requests, and the software is closed source.

Standout feature. It pairs Austrian hosting with a TÜV Austria accessibility certificate for the widget itself, which no other entry here can show.

#3 ALTCHA

Brno, Czechia Cloud from €47 per month (3 sites, 30-day free trial); Cloud Plus €137; Cloud Max €187; Sentinel and plugin prices not shown Demo on request

Best for: Sites that want an open-source CAPTCHA they can host themselves or run in an EU cloud

• Operating company. BAU Software s.r.o.
• Jurisdiction. EU (Czech Republic)
• Where the data sits. ALTCHA Cloud: EU-only endpoints; Sentinel: your own infrastructure
• Source code. Closed source
• Replaces. Google reCAPTCHA, hCaptcha, Cloudflare Turnstile

ALTCHA comes from BAU Software s.r.o. in Brno, which its terms name as the contracting entity, and it exists in three forms: the open-source widget on GitHub under the MIT licence, the self-hosted Sentinel platform, and the managed ALTCHA Cloud with EU-only endpoints. That split lets a developer inspect the client code and then decide where verification runs.

Cloud plans are priced by number of sites: €47 a month for three sites with a 30-day free trial, €137 for ten and €187 for fifty. The homepage states that the widget meets WCAG 2.2 AA and that no cookies or personal data are involved. Limits to weigh: the widget needs JavaScript, Sentinel and plugin prices are not shown, and the ownership of the Czech company is not stated on its pages.

Standout feature. It is the only commercial CAPTCHA here that can run fully air-gapped on your own servers while its widget code stays open for inspection.

#4 Netacea

Manchester, United Kingdom Enterprise pricing on request; quoted per engagement Demo on request

Best for: Enterprise teams fighting scraping, credential stuffing and API abuse at login, checkout and API endpoints

• Operating company. Netacea Limited
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Source code. Closed source
• Replaces. PerimeterX/HUMAN, Akamai Bot Manager, Kasada

Netacea is a bot management platform from Netacea Limited in Manchester that detects traffic server-side, without an agent on the protected site, and responds automatically instead of waiting for an analyst. Because analysis runs on the vendor's side, changes to the detection logic do not travel through your own release cycle.

The company is registered in England and Wales and its contracts are governed by English law, so the jurisdiction is the United Kingdom, covered by an adequacy decision but outside the EEA.

According to the vendor, enterprise brands lose an average of $85 million a year to scraping, credential stuffing and similar automation, and its detection is built around checkout, login and API endpoints. Pricing is quoted per engagement, and Netacea is a specialist that sits next to a CDN or WAF, not in place of one.

Standout feature. Detection and response run entirely on the vendor side, so there is nothing to deploy or update on the protected site.

#5 Prosopo

London, United Kingdom Founded 2021 Free $0 (10,000 requests a month); Professional $139 per month (1M requests); Enterprise from $1,990 per month; Custom from $3,300 per month Demo on request

Best for: Teams that want a free CAPTCHA now and a path to site-wide and API protection from the same vendor

• Operating company. Prosopo Limited
• Jurisdiction. United Kingdom (adequacy decision, outside the EEA)
• Where the data sits. Not checked (compliance section not opened)
• Source code. Closed source
• Replaces. Google reCAPTCHA, hCaptcha, Cloudflare Turnstile

Prosopo has two products: Procaptcha, an invisible or accessible CAPTCHA with a spam filter and residential proxy detection, and Prosopo Protect, which adds forms, API and site-wide protection with access rules. The free Procaptcha plan covers 10,000 requests a month for one site, and Protect Enterprise starts at $1,990 a month on a 12-month term.

Prosopo Limited was incorporated in London on 26 May 2021 (Companies House 13421250), where two individuals are listed as persons with significant control and no parent company appears. The UK sits outside the EU. Prices are in US dollars with EUR and GBP switches, the Professional price differs between plan card ($139) and comparison table (from $39), and certifications and data residency were not verified for this page.

Standout feature. It is the only entry that starts on a free form CAPTCHA and extends to site-wide and API protection without changing vendor.

#6 Myra Security

Munich, Germany Founded 2012 Enterprise pricing / Contact for quote Demo on request

Best for: European enterprises, government agencies, critical infrastructure

• Operating company. Myra Security GmbH
• Jurisdiction. EU (Germany)
• Source code. Closed source
• Replaces. Cloudflare, Akamai, AWS Shield

Myra Security is a Munich company founded in 2012 that operates its own CDN, DDoS protection, web application firewall and DNS security, with bot management as one module of that stack. According to the vendor, its scrubbing capacity exceeds 50 Tbps, it meets all 37 BSI criteria for qualified DDoS mitigation, and its bot management uses behavioural analysis and challenge mechanisms.

The tool page lists BSI certification, ISO 27001 based on IT-Grundschutz and a BSI C5 Type 2 attestation, with infrastructure and staff with access to customer systems located in Germany. That fits government agencies, finance and healthcare organisations that must document their supply chain. The price is for enterprises on request, with a sales cycle before any evaluation, and it is more than an ordinary marketing site needs.

Standout feature. It combines bot management with German-only infrastructure and BSI C5 Type 2 attestation, which suits buyers who need a certified German edge.

#7 Link11

Frankfurt, Germany Founded 2005 Enterprise pricing / Contact for quote Demo on request

Best for: European enterprises that need bot management bundled with DDoS protection and a WAF

• Operating company. Link11 GmbH
• Jurisdiction. EU (Germany)
• Source code. Closed source
• Replaces. Cloudflare, Akamai, AWS Shield

Link11 is a Frankfurt company, founded in 2005, whose platform combines always-on DDoS protection, a WAF, bot management, API security, a secure CDN and DNS protection into what it calls Web Application and API Protection. The bot module filters scraping, credential stuffing and inventory hoarding, and lets search engine crawlers through.

According to the vendor, the network has two security operation centers, 13 scrubbing centers and over 40 points of presence, mitigation starts within 0 to 10 seconds, and all traffic is processed on European infrastructure. The tool page lists ISO 27001 and BSI qualification for DDoS protection of critical infrastructure. Pricing is on request, and bot management here is one part of a security suite, so it suits buyers who want the whole suite more than a stand-alone bot tool.

Standout feature. It folds bot filtering into an always-on DDoS and WAF suite that learns normal traffic per customer, so bot rules and attack mitigation share signals.

#8 mosparo

Mellingen, Switzerland Founded 2021 Free and open source (MIT licence); no paid plan listed Demo on request

Best for: Small and mid-size sites that want free, self-hosted spam filtering for forms

• Operating company. mosparo Association (non-profit association)
• Jurisdiction. Switzerland (adequacy decision, outside the EEA)
• Where the data sits. Your own hosting (self-hosted)
• Source code. Closed source
• Replaces. Google reCAPTCHA, Akismet, Cloudflare Turnstile

mosparo is not a company product: the legal notice names the mosparo Association, a non-profit in Mellingen, Switzerland, and the project dates from 2021. Switzerland is in Europe but outside the EU. Instead of a puzzle it checks what was submitted against rules, using the form data, the IP address and the user agent, and the homepage states that it sets no cookies.

The source code is MIT-licensed and installs on regular web hosting, so submissions stay on your own server. That gives the site owner control over the rules and also the upkeep: word lists and other rules need maintenance, no paid support plan is listed and no company or service agreement is named. It covers form spam only, not logins, APIs or traffic-level bot attacks.

Standout feature. It is the only entry that costs nothing and keeps every submission on a server you control, with rules you write yourself.

#9 Bunny.net

Ljubljana, Slovenia Founded 2015 Pay-as-you-go (from €0.01/GB) Demo on request

Best for: Developers and businesses needing fast, affordable CDN with video streaming capabilities

• Operating company. Bunny CDN d.o.o.
• Jurisdiction. EU (Slovenia)
• Where the data sits. 110+ PoPs globally (strong European presence)
• Source code. Closed source
• Replaces. Cloudflare, AWS CloudFront

Bunny.net is a CDN from Bunny CDN d.o.o. in Ljubljana, started in 2015 as BunnyCDN, and it appears in this category through Bunny Shield, a security add-on with WAF, flood and brute-force rules. Shield applies to sites served through bunny.net, so it protects traffic on that network and is not a stand-alone bot product.

The core service is pay-as-you-go delivery from about €0.01 per GB with no minimum, plus edge storage, video streaming, DNS and image optimisation on one account. The tool page counts more than 110 points of presence with a strong European footprint and says the company has grown without venture capital. It lacks edge computing and enterprise-style support contracts, and very large media operations will negotiate better rates elsewhere.

Standout feature. It is the only entry where bot and flood rules come attached to a pay-as-you-go CDN billed from about €0.01 per GB.