Captcha.eu Due Diligence

Run due diligence on Captcha.eu: check compliance and get alerts when suppliers change.

Austria · www.captcha.eu · 14 vendors

Captcha.eu, operated by Captcha GmbH, provides an invisible, GDPR-compliant bot protection service. It uses advanced behavioral analysis, machine learning, and crypto-challenges to secure websites, forms, and login screens from bots and spam without requiring user interaction or tracking.

Resilience scores

Technology vendors

Services catalogue

2 services in catalogue across 2 categories; runs on 14 sub-vendors.

Insights

Last updated 2026-08-14 · revision 6

14 direct vendors, 164 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

8 in-scope frameworks identified; showing 3.

NIS2 (source) — No public evidence

Evidence: https://www.captcha.eu/impressum__en/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555, https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&&Gesetzesnummer=10007517

Austrian DSG — Evidence found

Evidence: https://www.captcha.eu/dsgvo__en/, https://www.captcha.eu/impressum__en/

EU AI Act (source) — No public evidence

Evidence: https://www.captcha.eu/dsgvo__en/, https://www.captcha.eu/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202401689

Financials

Three-year financials

Financial Resilience Score: 5/10

Captcha GmbH is a recently established Austrian SaaS company (registered 2022-2023, commercial launch 2024) offering GDPR-compliant CAPTCHA/bot-protection services. As a small/micro Austrian GmbH, it benefits from reduced UGB disclosure obligations, meaning no revenue, EBIT, or equity figures are publicly available. This makes independent financial assessment difficult. However, qualitative indicators suggest moderate resilience: the company has secured an impressive roster of blue-chip and public-sector reference customers including ÖBB (Austrian Federal Railways), Österreichische Nationalbank, A1 Telekom, GRAWE, Bauer Media Group, and DGUV. The company's positioning as an EU-hosted, GDPR-compliant alternative to US-based CAPTCHA services (Google reCAPTCHA, Cloudflare Turnstile) aligns with structural regulatory tailwinds post-Schrems II and the EU Data Act. Its recurring SaaS revenue model provides predictable cash flow, and low operational complexity (small team, Austria-hosted infrastructure) keeps costs manageable. Key risks include early-stage scale with likely limited equity cushion, intense competition from well-funded incumbents (many offering free alternatives), low entry pricing (€8.90/month) requiring successful upselling, and customer concentration risk given the relatively small anchor customer base. The score of 5 reflects the balance between strong strategic positioning and reference customers against early-stage financial opacity and competitive pressures.

Key strengths: GDPR-compliant EU-hosted positioning aligned with Schrems II and EU Data Act tailwinds, Blue-chip and public-sector reference customers (ÖBB, OeNB, A1 Telekom, GRAWE, Bauer Media, DGUV), Recurring SaaS subscription revenue model with predictable cash flow, Low operational complexity with Austria-hosted infrastructure and small team, Two-founder managing-director structure providing clear accountability, Active content marketing/SEO growth strategy targeting reCAPTCHA replacement

Risk factors: Early-stage company with likely limited equity cushion, Intense competition from well-funded incumbents including free alternatives (Google reCAPTCHA, Cloudflare Turnstile, hCaptcha), Low entry pricing (€8.90/month starter) requires successful upselling to higher tiers, Customer concentration risk with relatively small anchor customer base, No published financial disclosures makes credit assessment difficult, Key-person risk with only two managing directors/likely founders, No visible external funding announcements - unclear if bootstrapped or funded

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report