1M+ bot checks processed
The invisible captcha alternative. No puzzles, no checkboxes, no cookies, no friction. One SDK call protects your forms, logins, and APIs, and real users never see a thing.
No card. Live in 5 minutes.
import { useTrustSig } from '@trustsig/react'; const { scan } = useTrustSig(); const { token } = await scan();
{
is_bot: false,
score: 0,
action: "ALLOW",
req_id: "0000..0000",
}Human verifiedimport { useTrustSig } from '@trustsig/react'; const { scan } = useTrustSig(); const { token } = await scan();
{
is_bot: false,
score: 0,
action: "ALLOW",
req_id: "0000..0000",
}Human verifiedAlready in production
Publishing platforms, fintech and national charities across Europe already run TrustSig on their forms.
PublitPrint-on-demand and digital book distribution for publishers.Publishing · Sweden
LEI SystemOfficial Legal Entity Identifier registration agent.Fintech · Estonia
Disability Sport WalesNational charity for inclusive and disability sport.Charity · Wales
Of contact-form submissions on unprotected sites are bots, not people.
Drop in one SDK call. Then nothing. Forms keep submitting, logins keep working, bots disappear at the edge.
No puzzles, no traffic lights. Real users are never challenged.
Identification needs no cookies, so there is nothing to consent to.
Decisions land at the edge in around 20ms. No waiting.
No puzzles, no traffic lights. Real users are never challenged.
Identification needs no cookies, so there is nothing to consent to.
Decisions land at the edge in around 20ms. No waiting.
Install in minutes. Bots disappear.
No credit card. Free tier. EU-hosted.
TrustSig scores each request on device and network signals without ever touching personal data. No name, no email, no cookie leaves the browser.
import { TrustSig } from "@trustsig/react";
<TrustSig publicKey="pk_live_..." />import { verify } from "@trustsig/server";
const { action } = await verify(req.token);
if (action === "block") return res.status(403);Your user receives an encrypted risk score from TrustSig's edge network, which your backend can read and enforce.
Advanced heuristic evaluation runs asynchronously, completely outside your request path, adding zero milliseconds to page load.
Verify tokens locally using static keys, no network call required. Or make a lightweight and fast request to our edge.
06 Platform Comparison
Most captcha tools challenge your users with image puzzles, click boxes, and math problems. TrustSig is invisible by design, so visitors face zero friction and never see a challenge.
| Capability | TrustSigEU hosted · No cookies · Invisible | CF Turnstile | reCAPTCHA | hCaptcha |
|---|---|---|---|---|
| User friction | None (invisible) | Minimal puzzle | Puzzle / click | Puzzle / click |
| EU-based | Yes (EU) | Yes (EU) | No (US) | No (US) |
| GDPR-native | Yes | Yes | Partial | No |
| Bypass-resistant | Hardware-level | Easily bypassable | Moderate | Easily bypassed |
| Uses cookies | No | No | Yes | Yes |
| All features in free tier | Yes | No | No | Limited |
| Monetises user behaviour | Never | Never | Partially | Yes |
Comparison based on publicly available documentation, June 2026.
Comparison based on publicly available documentation, June 2026.
We were drowning in relentless API abuse. We tried other anti-bot services, none of them stopped the sophisticated attackers. Then we switched to TrustSig, and it eliminated every last trace of the API abuse we were dealing with.
The core team behind TrustSig brings a decade of national cyber defence experience to enterprise bot protection.
Former Cyber Defence Exercise Manager at NATO CCDCOE, architect of Locked Shields and Crossed Swords, the world's largest live-fire cyber exercises. At TrustSig, he applies that same operational grade to stopping automated attacks.
NATO CCDCOE, CybExer Technologies, 10+ yrs cyber defence
The architectural force behind TrustSig's core signal processing engine and hardware attestation layer. Leads all platform engineering from protocol design to SDK delivery.
Core Engine Architect, Hardware Attestation
Leads security governance and operations across all TrustSig layers, ensuring each layer remains sound, secure and compliant.
CISSP, CISA, CSSLP, ISO27001 Senior LA
No card. EU-hosted on every tier.
For personal projects and sites getting started with bot protection.
For growing businesses with moderate traffic and multiple properties.
For established companies needing high-volume protection and priority SLA.
Enterprise: unlimited volume · SLAs · on-prem · dedicated support.
One check is a single verification request: a page view, form submit, or login attempt that TrustSig evaluates. You only spend a check when traffic actually hits a protected surface, so bot floods do not quietly drain your quota.
No. TrustSig is a threat protection platform, not a CAPTCHA tool. We eliminate the need for CAPTCHAs entirely by providing deterministic signals that allow your infrastructure to block bot traffic with absolute confidence. Your visitors experience nothing. No puzzles, no checkboxes, no friction.
Extremely simple. For free tier usage, you just need to upload the plugin and activate it. No signup, API keys, or complex configuration required. Your forms and login pages are protected instantly upon activation.
Existing CAPTCHA solutions can be defeated in seconds by commercial bot farms, a well-documented industry reality. TrustSig operates at the hardware attestation and traffic behaviour layer, not the challenge layer. We mathematically verify the rendering environment via deterministic hardware cryptography, making circumvention fundamentally harder and economically unviable.
Minimal. A single script tag for web, or a lightweight SDK for iOS and Android. TrustSig operates out-of-band, meaning zero blocking impact on your application startup or user latency. Most teams are fully protected in under an hour.
Yes. Add the client SDK to your frontend and verify the token on your server, and your existing forms and logins keep working. No reverse proxy, no rewrite, no migration project. Visitors simply stop seeing puzzles.
Yes. The Starter tier covers 50,000 requests a month with the full threat engine and no credit card. Paid plans add volume and domains, but every tier ships the same protection.
Free. No card. Live in 5 minutes.
Drops in with one snippet, rip it out anytime.