Bot protection that stays in Germany.
CaptchaCore is a German project built around a simple question: can bot protection be effective without visitors’ data leaving the EU?
Why
Why this project exists
Every website needs protection against bots. Common tools for this partly load their scripts from servers outside the EU or set cookies — what that means for your own privacy policy is for each operator to assess. We wanted a way where this question doesn’t arise in the first place.
On top of that, image puzzles are a barrier. For people with visual impairments they are often barely solvable, and every drop-off is a lost form. A protection mechanism that locks out your own customers has missed its goal.
CaptchaCore is the attempt to solve both at once: effective protection through proof of work, behavioural analysis and an adaptive risk engine, and still a check nobody notices and that reports nobody to third parties.
How that differs from reCAPTCHA and hCaptcha in practice is set out on the comparison page.
Who
Who is behind it
CaptchaCore is run by SpeedIT Solutions UG (haftungsbeschränkt) from Isernhagen near Hanover. We are not a start-up with a growth mandate but a hosting business that has been running its own servers for years, and learned along the way what bot traffic really looks like.
The application, the database and the processing of your verifications run on our own hardware in a Frankfurt data centre, with no cloud provider in between. That is why we can say with certainty where your data is stored — and that it stays there.
Full details in the legal notice.
The supply chain
Where every byte comes from
Data protection does not end at your own application. It ends at the provider you use yourself. That is why we disclose the entire chain, in full, not only the convenient parts.
| Component | Provider | Registered office | Note |
|---|---|---|---|
| Application, API & database | SpeedIT Solutions UG |  Germany |
Our own hardware, no hyperscaler |
| Data centre | NTT Global Data Centers | Frankfurt am Main |
Housing only, no access to content |
| Widget delivery (CDN) | BunnyWay d.o.o. (Bunny.net) |  Slovenia |
European company, EU endpoint by default |
| Payments: card, SEPA, Sofort | Mollie B.V. |  Amsterdam |
Dutch payment service provider |
| Payments: PayPal | PayPal (Europe) S.à r.l. |  Luxembourg |
European entity, optional |
| Payments: bank transfer | Your bank |  SEPA area |
No payment provider at all |
| Invoicing | Haufe-Lexware GmbH & Co. KG | Freiburg |
Electronic invoices in ZUGFeRD format |
| Fonts | Self-hosted | Germany |
Outfit & JetBrains Mono, no Google Fonts |
| Audience measurement | Our own instance | Germany |
No Google Analytics, no advertising pixel |
There are two endpoints for the widget file. The EU endpoint delivers exclusively via edge locations in EU member states. Anyone who embeds the global endpoint instead has the same file delivered worldwide, which means the CDN operator sees the visitor's IP address and browser identification outside the EU as well, covered by standard contractual clauses.
This affects only the loading of the script file. The verification itself, meaning challenge, risk engine and database, runs exclusively on our servers in Germany and never through the CDN. Anyone who wants to keep the loading inside the EU as well embeds the EU endpoint.
Every sub-processor we use is named in the data processing agreement, which you can conclude electronically in your account as a customer and file as a PDF. Which data is processed for which purpose is set out in the privacy centre.
How
The four principles we want to be judged by
Data minimisation is the architecture, not a setting
Behavioural data never leaves the browser as raw data, only as condensed metrics and a hash. IP addresses are stored truncated and you set the retention period yourself. What is never collected cannot leak, be sold or be seized.
The human notices nothing, the bot pays
Normally there is no puzzle, no traffic lights, no waiting. The computation in the background is imperceptible for a single visitor and expensive for a bot farm making millions of requests. If an interaction does become necessary, it is keyboard operable and marked up for screen readers.
Honesty instead of marketing fog
We name every provider, including the ones not based in Germany. The system status is public, incidents included. Prices are net prices without asterisks, and cancelling does not require a phone call.
Portable, not locked in
Ready-made plugins for WordPress, WoltLab and Symfony, a Composer package for Laravel and a lean REST API for everything else. Anyone who wants full control can run CaptchaCore on their own infrastructure on request.
The counter-check
What we deliberately do not do
A promise only becomes one when it also rules something out.
Where to
What we are working on
Many operators are looking for European solutions for their forms because customers and data protection officers ask concrete questions. For them we are building a component small enough to fit in anywhere.
Connecting more systems directly
After WordPress (including WooCommerce), WoltLab, Symfony and Laravel come Shopware, Joomla and phpBB. Every platform with a form should be able to use CaptchaCore without custom programming.
Sharpening detection without collecting more
The risk engine learns from attack patterns across websites. What matters is the pattern, not the person, which is why it works with truncated IP addresses and hashes.
Evidence instead of assertion
A public system status, traceable reason codes and a data processing agreement you conclude in your account and file as a PDF. External audit reports are the next step.
Missing an integration, or have a requirement that is not listed here? Write to us. Short paths are the advantage of a small team.
Want to try it yourself?
The live demo shows the check from the user's side, the pricing page the terms for commercial use. For private websites CaptchaCore stays free permanently.