Self-hosted anti-spam that still knows every spammer
Self-hosted CAPTCHAs keep your data at home, but they cannot stop a spammer who types by hand. CleanTalk Self-Hosted runs our spam detection inside your infrastructure - with the same reputation database of 8,600,000+ spam IPs and emails that protects 200,000+ websites, updated daily, and not a byte of your users' data leaving your network.
Docker image or dedicated EU instance • API-compatible with CleanTalk Cloud • 3 months free for pilot teams
Puzzles vs. real protection
Self-hosted CAPTCHA (Cap, ALTCHA, mCaptcha)
- Checks that the browser solved a proof-of-work challenge
- Knows nothing about the sender's email or IP
- Lets human spam and headless browsers through
- No updates: the rules you deploy are the rules you keep
CleanTalk Self-Hosted
- Checks sender email and IP against 8.6M+ records, updated daily
- Analyzes the message, links, timing and headers
- Stops human spam and bots alike, with a reason for every verdict
- Runs entirely in your network - EU instance or your own servers
What you get
8.6M+ spam IPs and emails collected from 200,000+ sites, delivered hashed to your instance with signed daily updates.
No request data, no user data, no telemetry leaves your network. Air-gapped mode with offline update bundles on request.
Official SDKs for PHP, Python, Node.js, Go and .NET and the WordPress, Laravel, Drupal and Joomla plugins work by changing one URL.
A local lookup plus analysis. No vendor round trip, no per-request fees - one instance, unlimited sites and requests.
Verdict reasons, allow and block lists, country and stop-word rules, per-tenant keys. Export to your SIEM.
Multi-tenant keys and reporting: one instance protects every site and every customer of a hosting provider, CDN or website builder.
How it works
Pull one Docker image - API, dashboard, database. VPS, Kubernetes or private cloud. Or let us run a dedicated instance for you in an EU data center.
Point your existing integration at the instance. Every form entry, sign-up or message gets a verdict with a reason in milliseconds.
The instance pulls signed, incremental updates of the database and detection logic on your schedule - through your proxy or as an offline bundle.
How CleanTalk Self-Hosted compares
| Feature / Function | Self-hosted CAPTCHA (Cap, ALTCHA, mCaptcha) | mosparo | CleanTalk Self-Hosted |
|---|---|---|---|
| Runs on your servers | Yes | Yes | Yes |
| Checks sender email and IP reputation | No | No | Yes - 8.6M+ records |
| Checks the message text | No | Yes, by your rules | Yes |
| Stops human (manual) spam | No | Partly | Yes |
| Automatic updates of data and logic | No | No - manual rule packs | Yes - signed, daily |
| Dashboard, logs, allow/block lists | Partly | Yes | Yes |
| Multi-tenant keys for platforms | Partly | No | Yes |
| Price | Free | Free | From $99 / month |
Anti-spam since 2012 • 200,000+ websites protected • API-compatible with CleanTalk Cloud
For developers
Pull the image, set the license key, point your SDK at the new URL. The response format is the one you already use with CleanTalk Cloud - allow, comment, reason - so nothing changes in your code. Full docs and the update-feed spec come with the pilot.
For platforms and agencies
Issue a key per tenant from the on-prem dashboard, see per-tenant stats, and keep one instance for the whole platform. Your customers get protection without ever creating an account anywhere.
Two ways to keep data in your jurisdiction
Tell us which one you need in the form - that is how we decide what to build first for the pilot.
- Private CleanTalk instance in an EU data center, used only by you
- Data never leaves the EU, no shared infrastructure
- Nothing to run or update
- Unlimited sites on the instance
- Docker image inside your infrastructure
- Full reputation database, signed daily updates
- Unlimited sites and requests per instance
- Dashboard, logs, lists on your servers
- Engineer on the pilot
- Unlimited instances and clusters
- SSO, audit logs, SLA
- Air-gapped update bundles
- Multi-tenant reporting for platforms
- Engineer on call
Early access: the first 3 months are free for teams that join the pilot and share feedback. Pilot pricing may change at launch.
Frequently Asked Questions (FAQ)
1. How is this different from CleanTalk Cloud?
Same detection and the same database, running in your instance. The cloud sees nothing. You run the instance (or we run a dedicated one for you in the EU) and pay per instance instead of per site.
2. What leaves our network?
Only the update download: signed database and logic updates from CleanTalk. No request data, no user data, no telemetry. The feed can go through your proxy or arrive as an offline bundle for air-gapped systems.
3. Can we keep our current integrations?
Yes. The API is compatible with CleanTalk Cloud, so the official SDKs and CMS plugins work with the on-prem endpoint by changing the URL.
4. How is the database protected?
It is delivered in a hashed form, licensed for use inside your instance for the subscription term, and cannot be extracted as a plain list.
5. Is there a trial?
The early access pilot is the trial: 3 months free, full functionality, a direct line to the engineers.
Keep your users' data at home. Keep the spammers out.
Join the early access pilot: a dedicated EU instance or a self-hosted image with the full reputation database, 3 months free. We reply within one business day and set you up with an engineer, not a sales deck.
