The reCAPTCHA Alternative. That doesn't send your users to Google.
The best recaptcha alternative — an invisible alternative to reCAPTCHA and google recaptcha alternative that lets you replace reCAPTCHA in five minutes. The recaptcha replacement and recaptcha gdpr alternative for teams who want reCAPTCHA without Google. Cookieless, GDPR Article 25 by design.
50,000 requests/month free. Complete threat engine. No credit card, ever.
Already in production
Publishing platforms, fintech and national charities across Europe already run TrustSig on their forms.
PublitPrint-on-demand and digital book distribution for publishers.Publishing · Sweden
LEI SystemOfficial Legal Entity Identifier registration agent.Fintech · Estonia
Disability Sport WalesNational charity for inclusive and disability sport.Charity · Wales
reCAPTCHA alternative — side by side
Both stop bots. Only one does it without a US data transfer, a consent banner, and an image grid in front of your users. A recaptcha alternative built to replace reCAPTCHA — the recaptcha gdpr alternative compared head-to-head.
| Capability | TrustSig | Google reCAPTCHA |
|---|---|---|
| User friction | None — fully invisible | Image grids, checkbox, v3 score gates |
| Data residency | EU only (Germany) | Processed by Google, US transfer |
| Cookies / tracking | Zero cookies, zero PII | Sets cookies, profiles users |
| GDPR posture | Article 25 by design, no consent needed | Consent + Schrems II exposure |
| Detection method | Hardware-level deterministic signals | Behavioural + reputation scoring |
| Accessibility | Nothing for users to solve | Audio/visual challenges fail screen readers |
| Free tier | Full engine, 50K req/mo, no card | Free but data-funded |
| Server verification | Local — sub-millisecond, no network call | Round-trip to Google on every verify |
Why teams move off reCAPTCHA
The reasons are rarely about detection accuracy. They are about where the data goes and what it does to your users.
It sends user data to Google
Every reCAPTCHA call ships behavioural data to Google in the US. Post-Schrems II that is a documented GDPR risk that several EU DPAs have ruled on. TrustSig processes nothing outside the EU.
It needs a consent banner
Because reCAPTCHA sets cookies and profiles visitors, it is not a strictly necessary cookie — it belongs behind consent. TrustSig sets zero cookies, so it loads before any banner and never blocks your conversion path.
It punishes real users
Image grids and the v3 score gate add friction precisely when a human is trying to convert. TrustSig shows users nothing. Bots are stopped, humans never notice.
It fails accessibility
Visual and audio challenges are a known barrier for assistive technology. An invisible check removes the barrier entirely.
It is opaque
A v3 score with no explanation is hard to tune and hard to defend. TrustSig returns a deterministic verdict you verify locally on your own server.
Free, but you are the product
reCAPTCHA is free because the data has value to Google. TrustSig's free tier includes the complete deterministic threat engine and funds itself on paid plans, not on your visitors.
Replace reCAPTCHA in 5 minutes
Two npm packages, no infrastructure changes. The recaptcha replacement path: remove the reCAPTCHA script and grecaptcha call; drop in the invisible scan and a local verify. Replace reCAPTCHA with the google recaptcha alternative your team can actually defend.
- Frontend — replace the widget
// Before — reCAPTCHA // <script src="https://www.google.com/recaptcha/api.js" /> // const token = await grecaptcha.execute(SITE_KEY, { action: "submit" }) // After — TrustSig (invisible, no widget) import { useTrustSig } from "@trustsig/react" function ActionForm() { const { scan } = useTrustSig() const handleSubmit = async () => { const response = await scan() await fetch("/api/action", { headers: { "X-TrustSig-Response": response?.token || "" }, }) } } - Backend — replace the verify call
// Before — reCAPTCHA (network round-trip to Google) // await fetch("https://www.google.com/recaptcha/api/siteverify", ...) // After — TrustSig (verified locally, zero latency) import { TrustSig } from "@trustsig/server" const ts = new TrustSig({ secretKey: process.env.TRUSTSIG_SECRET_KEY }) app.post("/api/action", async (req, res) => { const token = req.headers["x-trustsig-response"] // no call leaves your server const result = ts.verifyLocal(token) if (result.action === "BLOCK") return res.status(403).json({ error: "Blocked" }) })
Start free. Stay free until you grow.
No card. EU-hosted on every tier.
Starter
For personal projects and sites getting started with bot protection.
- 50,000 requests / month2 domains
- Full threat protection suite
- Bot farm blocking
- No CAPTCHAs for visitors
- Community support
Growth
For growing businesses with moderate traffic and multiple properties.
- 300,000 requests / month20 domains • €5 per 100k extra reqs
- Full threat protection suite
- Bot farm blocking
- No CAPTCHAs for visitors
- Email support
Business
For established companies needing high-volume protection and priority SLA.
- 750,000 requests / month25 domains • €5 per 100k extra reqs
- Full threat protection suite
- Bot farm blocking
- No CAPTCHAs for visitors
- Priority support
Enterprise: unlimited volume · SLAs · on-prem · dedicated support.
One check is a single verification request: a page view, form submit, or login attempt that TrustSig evaluates. You only spend a check when traffic actually hits a protected surface, so bot floods do not quietly drain your quota.
reCAPTCHA migration questions
reCAPTCHA can be used under GDPR, but it sets cookies, profiles visitors, and transfers data to Google in the US — which requires consent and carries Schrems II risk. Several EU data protection authorities have flagged it. TrustSig avoids the question entirely: no cookies, no PII, no transfer outside the EU, so it relies on legitimate interest with no consent banner needed.
No. TrustSig reads deterministic hardware-level signals rather than a behavioural reputation score, so it catches automation that passes a reCAPTCHA v3 score gate while never challenging a real user.
Remove the reCAPTCHA script and grecaptcha call, install @trustsig/react and @trustsig/server, and replace the verify with a local verifyLocal(). Most teams finish in under five minutes per form. No infrastructure changes.
Yes. Install the free plugin from the official WordPress.org directory (https://wordpress.org/plugins/trustsig-security/) — search 'TrustSig' in Plugins › Add New. About 60 seconds and protects login, registration, comments, and WooCommerce — no API key and no code.
The complete deterministic threat engine and 50,000 requests per month, with no credit card. Nothing about detection is locked behind a paywall.
For EU teams the best recaptcha alternative is one that combines accuracy with no Google data transfer. TrustSig is a google recaptcha alternative and recaptcha gdpr alternative that gives you reCAPTCHA without Google — invisible, cookieless, EU-hosted. The complete recaptcha replacement, ready to deploy.
The most common reasons teams compare recaptcha alternatives: a documented recaptcha GDPR concern, the friction of v2 image grids, opaque v3 scores, and the desire for a recaptcha alternative that does not ship behavioural data to a US processor. TrustSig answers each.
Specific deployments have been treated as a reCAPTCHA GDPR violation by EU regulators when cookies, profiling and a Google data transfer combine with weak consent. The recaptcha gdpr alternative is one that removes the structural risk — no cookies, no PII, no third-country transfer. TrustSig does exactly that.
To replace reCAPTCHA, remove the grecaptcha script and verify endpoint, install @trustsig/react and @trustsig/server, and swap the network siteverify for a local verifyLocal(). Most teams replace reCAPTCHA in under five minutes per form — and the recaptcha without Google path is identical for React, Next.js, Vue, vanilla JS, and the WordPress plugin.
Drop reCAPTCHA. Keep your users.
Start free in minutes. No credit card, no consent banner, no data leaving the EU.