Your free tier is buying compute for a farm, not customers.
Free trials attract operations that want the compute behind the grant, not the product. They spin up cheap fake accounts in bulk, run each trial to its ceiling, and never intend to pay.
Does this sound like you?
If even a couple of these feel familiar, it’s probably already happening on your platform.
Trial sign-ups climb month over month, and free-to-paid conversion falls.
What it means: You're growing accounts, not customers.
Your compute bill grows faster than your revenue, month after month.
What it means: You're paying for usage that was never going to convert.
Trial after trial burns its whole allowance in hours, then goes quiet forever.
What it means: The grant was the product they came for.
Brand-new accounts start consuming heavily minutes after signing up.
What it means: Sign-up and activation are one scripted motion, not a person.
How the attack actually works
No security background needed — here’s the whole play, start to finish.
The setup
An operation mints cheap fake accounts in bulk — aged OAuth logins, phone numbers to verify with, fresh browser profiles.
The harvest
Each one activates its free grant, runs it to the ceiling, and is abandoned.
The discovery
You find out from usage metering, or the invoice — after the capacity is already spent.
How SignalGate stops it
One call on your critical path. The verdict comes back before anything happens.
Sign-up farm correlation
Identifies when supposedly unrelated sign-ups share the behavioral fingerprint of a single origin within a window — the tell of a trial farm.
Sign-up velocity anomaly detection
Learns the rhythm of genuine trial sign-ups on your own base and flags those that move like an operation, not a person.
Pre-grant verdict
The verdict fires when the trial is requested, not when the invoice arrives. No compute spent, no retroactive suspensions, no support tickets from real users whose account disappeared after the fact.
Fingerprinting catches one device pretending to be many. SignalGate catches the opposite — many genuinely different devices working as one operation — the fraud that device fingerprinting alone was never built to see.
Wire it in, in minutes
Start with two fire-and-forget calls to /v0/log — log the action and the target action. No blocking, no user impact, nothing on your critical path.
Log trial starts and conversions
from datetime import datetime, timezone
from signalgate import Client, Event, EncryptedPayload
client = Client(api_key="pk_live_...")
def sg_event(body: dict, method: str) -> Event:
# Each request carries its OWN "signalgate" envelope from the browser SDK
return Event(
user_id=body["user_id"],
ip=request.headers.get("X-Forwarded-For", request.remote_addr),
method=method,
timestamp=datetime.now(timezone.utc).isoformat(),
payload=EncryptedPayload(**body["signalgate"]),
)
@app.post("/api/trial/start")
def start_trial():
body = request.get_json()
# ...your trial-provisioning logic...
if body.get("signalgate"): # current policy: no envelope, skip the log
client.log(sg_event(body, method="trial.start")) # AFTER the grant is issued
return {"ok": True}
@app.post("/api/trial/converted")
def trial_converted():
body = request.get_json()
# ...your upgrade-to-paid logic...
if body.get("signalgate"): # current policy: no envelope, skip the log
client.log(sg_event(body, method="trial.converted")) # its own fresh envelope
return {"ok": True}Within days the dashboard shows how much of your traffic is one coordinated operation — before you turn on blocking.
Stop fraud before it reaches your backend.
Free until December 31, 2026. About ten minutes to start logging. No sales call needed.