The GDPR captcha without cookies. Never routed through Google.
No cookies, no Google, no data leaving the EU. The privacy-first reCAPTCHA replacement for teams that defend every visitor data flow in an audit.
50,000 requests/month free. Complete threat engine. No credit card, ever.
import { useTrustSig } from '@trustsig/react'; const { scan } = useTrustSig(); const { token } = await scan();
{
is_bot: false,
score: 0,
action: "ALLOW",
req_id: "0000..0000",
}Human verifiedimport { useTrustSig } from '@trustsig/react'; const { scan } = useTrustSig(); const { token } = await scan();
{
is_bot: false,
score: 0,
action: "ALLOW",
req_id: "0000..0000",
}Human verifiedAlready in production
Publishing platforms, fintech and national charities across Europe already run TrustSig on their forms.
PublitPrint-on-demand and digital book distribution for publishers.Publishing · Sweden
LEI SystemOfficial Legal Entity Identifier registration agent.Fintech · Estonia
Disability Sport WalesNational charity for inclusive and disability sport.Charity · Wales
Three things every visitor never has to give up.
Most CAPTCHAs pay for bot detection with your visitors' privacy. TrustSig runs the whole check without collecting any of it.
No cookies, ever
Nothing is written to or read from the visitor's device, so the ePrivacy consent requirement is never triggered and no banner is owed.
No personal data
Only ephemeral, non-identifying signals are evaluated, then discarded. There is no profile, no stored fingerprint, nothing to hand over in a subject access request.
No lag
Data is hosted in EU, but a global content delivery network assures low-latency and frictionless user experience, where EU-located visitors are served by EU servers.
No cookies, ever
Nothing is written to or read from the visitor's device, so the ePrivacy consent requirement is never triggered and no banner is owed.
No personal data
Only ephemeral, non-identifying signals are evaluated, then discarded. There is no profile, no stored fingerprint, nothing to hand over in a subject access request.
No lag
Data is hosted in EU, but a global content delivery network assures low-latency and frictionless user experience, where EU-located visitors are served by EU servers.
Privacy is the default, not a setting.
Live in five minutes. No cookies, no consent banner.
One call. Cookieless and in-EU, end to end.
- L1CollectA tamper-resistant client agent reads ephemeral request signals. No cookies, no device storage.
- L2ResolveSignals form a short-lived risk profile in memory. Nothing identifying is persisted.
- L3ScoreThe engine scores 200+ network, device and behaviour signals.
- L4DecideOne verdict returns in around 20ms: allow or block. Then the signals are gone.
Built so the audit questions never come up.
Data minimisation is not a policy bolted on afterwards. The system keeps only what a verdict needs and nothing that could identify a person.
- Anonymised risk score
- Coarse request metadata
- Verdict and timestamp
- Cookies or local storage
- Names, emails, or other PII
- Cross-site tracking IDs
- Slow
import { TrustSig } from "@trustsig/react";
<TrustSig publicKey="pk_live_..." />import { verify } from "@trustsig/server";
const { action } = await verify(req.token);
if (action === "block") return res.status(403);03 Platform Comparison
How TrustSig compares on privacy.
Most CAPTCHAs detect bots by collecting visitor data. Here is what that means for a data protection audit, side by side.
| Capability | TrustSigEU hosted · No cookies · Invisible | reCAPTCHA | hCaptcha | CF Turnstile |
|---|---|---|---|---|
| Cookies set | None | Yes | Yes | None |
| Hosting | EU | United States | US / global | Global edge |
| Consent banner needed | No | Yes | Often | No |
| Routed through Google | Never | Always | No | No |
| Privacy by design and by default | Yes | No | Partial | Partial |
| User friction | Invisible | Image puzzles | Image puzzles | Sometimes |
Comparison based on publicly available documentation, June 2026.
Comparison based on publicly available documentation, June 2026.
We were drowning in relentless API abuse. We tried other anti-bot services and none of them stopped the sophisticated attackers. We switched to TrustSig and it eliminated every last trace of the abuse, without adding a cookie banner or a single CAPTCHA for our users.
Built in compliance with the standards that matter
TrustSig is designed to align with the EU privacy framework end to end.
DPA available for everyone
A Data Processing Agreement is available for everyone as the annex of Terms of Service, but really matters for TrustSig Pro customers (fraud prevention).
Start free. Stay free until you grow.
No card. EU-hosted on every tier.
Starter
For personal projects and sites getting started with bot protection.
- 50,000 requests / month2 domains
- Full threat protection suite
- Bot farm blocking
- No CAPTCHAs for visitors
- Community support
Growth
For growing businesses with moderate traffic and multiple properties.
- 300,000 requests / month20 domains • €5 per 100k extra reqs
- Full threat protection suite
- Bot farm blocking
- No CAPTCHAs for visitors
- Email support
Business
For established companies needing high-volume protection and priority SLA.
- 750,000 requests / month25 domains • €5 per 100k extra reqs
- Full threat protection suite
- Bot farm blocking
- No CAPTCHAs for visitors
- Priority support
Enterprise: unlimited volume · SLAs · on-prem · dedicated support.
One check is a single verification request: a page view, form submit, or login attempt that TrustSig evaluates. You only spend a check when traffic actually hits a protected surface, so bot floods do not quietly drain your quota.
GDPR questions
It can be used under the GDPR, but it sets cookies, profiles visitors, and transfers data to Google in the US, which requires consent and carries Schrems II risk. Some EU data protection authorities have ruled against specific deployments. TrustSig avoids the question: no cookies, no personal data, no risks.
No. TrustSig sets no cookies and stores nothing on the device, so it falls outside ePrivacy consent and loads before any banner.
Customer's (data controller's) legitimate interest under GDPR Art. 6(1)(f): security and fraud prevention, explicitly supported by Recital 47, 49 and 71. No user consent is required. If your legal team needs support with legitimate interest assessment, contact our legal at legal@trustsig.eu.
Yes - a DPA is available to all customers as a standard annex to our Terms of Service. It is primarily intended to help TrustSig Pro customers meet their legal requirements, since fraud prevention may, where the customer chooses to enable it, process certain personal data identifiers.
No. The signals are ephemeral and non-identifiers, and TrustSig doesn't have any practical means and additional context to reverse these signals into a natural person, so they do not constitute personal data under the GDPR.
reCAPTCHA is not banned in the EU, but specific deployments have been penalised by national regulators for missing adequate consent or transparency. Whether any given deployment is compliant depends on its configuration and legal review, but the structural risk of cookies, behavioural data collection and US data transfer is well documented. TrustSig avoids the issue by design: no cookies, no PII and no risk.
TrustSig runs without Google and without cookies. Nothing in detection touches a Google endpoint, nothing is written to the user's device, and it is hosted in the EU, which answers most procurement questions about data protection.
Yes. You swap the reCAPTCHA snippet for the TrustSig widget and keep your existing form flow, so most teams are live in a few minutes. There is no Google account, no site key tied to Google, and no consent banner to wire up.
Yes. A free WordPress plugin protects your login, comment and contact forms without cookies or tracking. Install it, add your key, and your forms are covered.
Stop bots. Not your users.
Free. No card. No cookie banner. Live in 5 minutes.
Drops in with one snippet, rip it out anytime.