Privacy-first bot protection · Made in Europe
Bot protection you can audit.
No cookies. No puzzles. Hosted in the EU on every plan, with a public DPA and sub-processor list you can read before you sign up.
Free for up to 1,000 requests a month, commercial sites included. No credit card.
Live demo · Newsletter sign-up
Click the box. A small proof-of-work runs in your browser. Nothing about you is sent or stored.
Don't take our word for it. Open the documents.
- Public DPA (PDF)
- Sub-processor list
- WCAG 2.2 AA audit report
- [Security certification] report
- Hosted in [EU country], every plan
What is Burgcaptcha?
A GDPR-compliant CAPTCHA alternative for websites and apps.
Burgcaptcha is a privacy-first bot protection service. It tells real visitors from automated traffic with a proof-of-work task in the browser and request risk signals, sets no cookies, shows no puzzles and is hosted in the EU. It replaces Google reCAPTCHA and hCaptcha on sign-up, login, checkout and contact forms.
Learn more: GDPR-compliant CAPTCHA · reCAPTCHA alternative · Compare European providers
How it works
Your visitors click once. Bots do the maths.
Burgcaptcha checks the browser, not the person. Real visitors pass in about a second. Automated traffic pays a cost it can’t scale.
1. Proof-of-work in the browser
A small cryptographic task runs in the background. It costs a real device a moment and a bot farm a fortune.
2. Risk signals, not profiles
We look at the request: headless browsers, known bot networks, proxies, AI agents. Suspicious traffic gets a harder task.
3. Nothing stored about the person
No cookies, no fingerprint saved, no tracking across sites. In most setups you don’t need a consent banner entry for it. See the data flow
Transparency
Everything we claim, you can check.
Most providers show a badge and put the paperwork behind a sales call or a password. Your data protection officer can read ours today, without an account.
- Same DPA and EU hosting on every plan, including Free
- 30 days’ notice before we add a sub-processor
- Full audit reports, not just a logo
- Data Processing AgreementPDF · EN / DE · version [X.X], [DATE]
- Sub-processor list with change log[N] sub-processors, all in the EU · updated [DATE]
- Data flow: what we receive and what we keepOne-page diagram for your record of processing
- WCAG 2.2 AA accessibility auditFull report by [auditor] · [DATE]
- [Security certification] report[Status / scope / date]
Developers
Two lines to install. One to switch from reCAPTCHA.
Our API answers in the same format as reCAPTCHA and hCaptcha, so moving over is a change of URL and keys, not a rewrite.
Plugins and SDKs
<script src="https://cdn.[domain].eu/widget.js" defer></script>
<div class="by-captcha" data-sitekey="YOUR_SITE_KEY"></div>POST https://api.[domain].eu/v1/siteverify
secret=YOUR_SECRET&response=TOKEN
→ { "success": true, "risk": "low" }Pricing
Flat steps. No cliff.
Every plan is hosted in the EU and comes with the same DPA. You pay for volume, not for privacy. Prices exclude VAT.
- For small sites, commercial too
Free
€0/ month- 1,000 requests / month
- 1 domain
- EU hosting · public DPA
- Analytics dashboard
- For one growing business
Starter
€7.20/ month- 1,000 requests / month
- 1 domain
- Everything in Free
- Email support in EN / DE
- For shops and agencies
Growth
MOST CHOSEN€31.20/ month- 5,000 requests / month
- 5 domains
- Risk signals: proxy, VPN, headless, AI agents
- Custom rules and geo filters
- For high-traffic platforms
Scale
€160/ month- 50,000 requests / month
- 50 domains
- Everything in Growth
- SSO, audit log, 99.9% uptime SLA
Compare
The same promise. Different paperwork.
Most European captchas use proof-of-work and no cookies. The difference is what you can verify, and on which plan.
| Burgcaptcha | Friendly Captcha | CaptchaFox | Google reCAPTCHA | |
|---|---|---|---|---|
| EU-only hosting | Every plan | Advanced plan and up | Yes | No |
| DPA readable without an account | Public PDF | Password-protected | On request | Not assessed |
| Free plan for commercial sites | Yes, 1,000 requests | Non-commercial only | 7-day trial | Yes, up to 10k assessments |
| Puzzles for visitors | Never | Never | Configurable challenge | Image challenges possible |
| Audit reports you can download | WCAG + security | Badges, no public report | ISO 27001 in progress | Not assessed |
| Support in German | Every paid plan | Not assessed | Not assessed | No |
Based on each provider's public website on [DATE]. Something out of date? Tell us and we'll correct it within a week. Rows marked 'Not assessed' were not part of our review.
FAQ
Questions data protection officers and developers ask
What is Burgcaptcha?
Burgcaptcha is a privacy-first CAPTCHA and bot-protection service. It uses a proof-of-work task in the visitor’s browser and request risk signals instead of puzzles, sets no cookies and is hosted in the EU.
Is Burgcaptcha GDPR compliant?
We process only what is needed to decide whether a request is automated, host everything in the EU and publish our DPA and sub-processor list so your data protection officer can review them before you sign up. Whether your overall setup is compliant depends on your own site, so confirm it with your DPO.
Do I need a cookie banner entry for Burgcaptcha?
Burgcaptcha sets no cookies and stores no identifiers in the visitor’s browser. In most setups you therefore do not need a consent banner entry for it. Because the answer depends on your whole setup, confirm it with your data protection officer.
How is proof-of-work different from an image puzzle?
Instead of asking a person to solve a puzzle, the visitor’s browser solves a small cryptographic task in the background. A real device barely notices it, while a bot farm must pay for the computation on every request. Suspicious traffic receives a harder task.
Is the widget accessible?
Visitors never solve puzzles, and the widget is operable with a keyboard and announces its status to screen readers. We target WCAG 2.2 AA and publish the audit report in the Transparency section.
How do I switch from Google reCAPTCHA or hCaptcha?
Our API answers in the same format as reCAPTCHA and hCaptcha. Replace the script URL and site key in your form, then change the verification URL and secret on your server. No rewrite is needed.
Where is data processed?
In the EU on every plan, including Free. The hosting country is [EU country].
What does Burgcaptcha cost?
There is a free plan for small sites, commercial ones included, and paid plans in flat steps by monthly request volume. Prices exclude VAT. See the Pricing section for the plans.
Can I self-host Burgcaptcha?
Self-hosting is available on the Enterprise and public sector plans, together with custom volume and procurement paperwork in German.
Which CAPTCHA providers are based in Europe?
Several privacy-focused providers are European: Friendly Captcha, CaptchaFox and TrustCaptcha in Germany, captcha.eu in Austria, ALTCHA in Czechia and mosparo in Switzerland. Our comparison lists country, entry price, free option and hosting for each.
How do I book a demo?
Use the demo request form with your work email and a few details about your site. We reply by email to arrange a time.
Read the paperwork first. Install second.
Send our DPA to your data protection officer today. When they're happy, you're live in ten minutes.