Your free tier is buying compute for a farm, not customers.
Free trials attract operations that want the compute behind the grant, not the product. They spin up cheap synthetic identities in bulk, run each trial to its ceiling, and never intend to pay.
Does this sound like you?
If even a couple of these feel familiar, it’s probably already happening on your platform.
Trial sign-ups climb month over month, and free-to-paid conversion falls.
What it means: You're growing accounts, not customers.
Your compute bill grows faster than your revenue, month after month.
What it means: You're paying for usage that was never going to convert.
The same trials burn their whole allowance in hours, then go quiet forever.
What it means: The grant was the product they came for.
Brand-new accounts start consuming heavily minutes after signing up.
What it means: Sign-up and activation are one scripted motion, not a person.
How the attack actually works
No security background needed — here’s the whole play, start to finish.
The setup
An operation mints cheap synthetic identities in bulk — disposable addresses, fresh browser profiles.
The harvest
Each one activates its free grant, runs it to the ceiling, and is abandoned.
The discovery
You find out from the compute invoice — after the capacity is already spent.
How SignalGate stops it
One call on your critical path. The verdict comes back before anything happens.
Synthetic-identity correlation
Identifies when supposedly unrelated sign-ups share the behavioral fingerprint of a single origin within a window — the tell of a trial farm.
Sign-up velocity anomaly detection
Learns the rhythm of genuine trial sign-ups on your own base and flags those that move like an operation, not a person.
Pre-grant verdict
The verdict fires when the trial is requested, not when the invoice arrives. No compute spent, no retroactive suspensions, no support tickets from real users whose account disappeared after the fact.
Fingerprinting catches one device pretending to be many. SignalGate catches the opposite — many genuinely different devices working as one operation — the fraud that device fingerprinting alone was never built to see.
Wire it in, in minutes
Start with two fire-and-forget calls to /v0/log — log the action and the target action. No blocking, no user impact, nothing on your critical path.
Log trial starts and conversions
from datetime import datetime, timezone
from signalgate import Client, Event, EncryptedPayload
client = Client(api_key="pk_live_...")
def sg_event(body: dict, method: str) -> Event:
# Each request carries its OWN "signalgate" envelope from the browser SDK
return Event(
user_id=body["user_id"],
ip=request.headers.get("X-Forwarded-For", request.remote_addr),
method=method,
timestamp=datetime.now(timezone.utc).isoformat(),
payload=EncryptedPayload(**body["signalgate"]),
)
@app.post("/api/trial/start")
def start_trial():
body = request.get_json()
# ...your trial-provisioning logic...
client.log(sg_event(body, method="trial.start")) # AFTER the grant is issued
return {"ok": True}
@app.post("/api/trial/converted")
def trial_converted():
body = request.get_json()
# ...your upgrade-to-paid logic...
client.log(sg_event(body, method="trial.converted")) # its own fresh envelope
return {"ok": True}Within days the dashboard shows how much of your traffic is one coordinated operation — before you turn on blocking.
Stop fraud before it reaches your backend.
Free for everyone through 2026. Two lines of code. No demo required.