Prosopo security and procurement: certifications, data location and contracts
What a security review of Prosopo needs: ISO 27001 status, where data is processed, subprocessors, the DPA, support response times, audit logs and how every block can be traced. One page for your vendor questionnaire.
5 min read
This page collects what a security or procurement review of Prosopo usually asks for. If your questionnaire asks something that is not here, send it to us and we will answer it directly.
Company
Prosopo Limited is incorporated in England and Wales, company number 13421250. Contracts and the Data Processing Agreement are governed by the law of England and Wales.
Certifications
ISO 27001 certification is in progress, and SOC 2 is on the roadmap behind it. If your process needs a completed attestation before signature, tell us your date and we will tell you whether we can meet it.
Procaptcha is built to meet WCAG 2.1 AA. See accessible CAPTCHA for how it handles users who cannot complete a visual challenge.
Where data is processed
Prosopo runs across points of presence in the US, LATAM, APAC and the EU, so verification stays fast wherever your users are and the service keeps running if one node fails.
On the Enterprise and Custom plans, processing can be restricted entirely to the EU. Custom adds data residency terms or a dedicated database.
Subprocessors
The current subprocessors are Contabo, Hetzner, OVHcloud, Bunny, AWS and Cloudflare (DNS resolution). The Data Processing Agreement holds the authoritative list, along with:
- breach notification without undue delay,
- deletion of personal data when the service ends,
- your right to audit, once a year or after a breach.
How decisions can be traced
Every block comes with a reason your team can read, such as Solver service detected or Automation driver present, rather than a risk score.
Every block and challenge carries an X-Prosopo-Request-Id header, and allowed requests forward it to your origin. Any decision can be looked up by that ID. Enterprise and Custom include audit logs, and decision records can be exported to your own SIEM.
Rules your team writes in Access Rules are recorded as your policy, so a block can be traced to a policy your team wrote rather than to a model. This is what GDPR Article 22 and the EU AI Act's oversight requirements ask for. See the compliance guides.
Deployment and testing
Prosopo Protect runs as a script tag on your forms, an edge worker on Cloudflare Workers or AWS Lambda@Edge, or both. Every deployment starts with 14 days in preview mode: Protect checks your live traffic and records what it would have blocked, but blocks nothing until you switch it on.
The Procaptcha widget stack is open source, so the code that runs in your users' browsers can be reviewed before deployment.
Support and SLA
Enterprise includes a dedicated support engineer and business-hours support. Custom adds 24/7 support with a 15-minute P1 response, and a custom SLA with service credits. Support comes from the engineers who build the detection. Live service status is on the status page.
See pricing for what each plan includes.
Filling in a vendor security questionnaire?
A Bot Exposure Assessment is a 30-minute call with an engineer. We look at your traffic, show where your current setup leaves gaps, and agree how a trial would be judged. Nothing to install first.
Questions
Something else? Ask an engineer.
Is Prosopo ISO 27001 or SOC 2 certified?
ISO 27001 certification is in progress, and SOC 2 is on the roadmap behind it. If your procurement needs a completed attestation by a set date, tell us the date early and we will confirm whether we can meet it.
Where does Prosopo process data?
Prosopo runs across points of presence in the US, LATAM, APAC and the EU. On the Enterprise and Custom plans, processing can be restricted entirely to the EU. The Custom plan adds data residency terms or a dedicated database.
Who are Prosopo's subprocessors?
Contabo, Hetzner, OVHcloud, Bunny, AWS and Cloudflare (DNS resolution). The current list is kept in the Data Processing Agreement, which also sets out breach notification, deletion on termination and audit rights.
Is Prosopo GDPR compliant?
Prosopo is a UK company acting as a data processor under a published Data Processing Agreement covering UK and EU data protection law. Every block returns a readable reason, which is what GDPR Article 22's meaningful-information requirement asks for when an automated decision affects a person.
Can we audit what Prosopo blocked?
Yes. Every block and challenge carries an X-Prosopo-Request-Id header, allowed requests forward it to your origin, and any decision can be looked up by that ID along with the reason it was made. Enterprise and Custom include audit logs, and decision records can be exported to your own SIEM.
What support and SLA does Prosopo offer enterprise customers?
Enterprise includes a dedicated support engineer and business-hours support. Custom adds 24/7 support with a 15-minute P1 response and a custom SLA with service credits. Support comes from the engineers who build the detection.
Can we review Prosopo's code before deploying it?
The Procaptcha widget stack is open source on GitHub, so the client code that runs in your users' browsers can be reviewed before deployment. Every Protect deployment also starts with 14 days in preview mode, where it records what it would have blocked without blocking anything.