Projects & Services

A Project is the central container in TrustComponent. It bundles one or more services together with the team, billing, and governance that surround them — and this page covers all of it: from creating a Project to plans, invoices, members, API keys, webhooks, contracts, and the audit log.

A service is a single product instance inside a Project. There are three service types today:

A Project can hold a single service or several bundled together. Bundling is useful when the same team and the same invoice should cover multiple products — for example a CAPTCHA plus a status page for the same website. Each service has its own plan, features, and usage, but they share the Project’s team, billing profile, contracts, audit log, API keys, and webhooks.

flowchart TD
    U["Users
(people with a TrustComponent login)"]
    O["Organization
(optional)"]
    P1["Project A"]
    P2["Project B"]
    S1["CAPTCHA"]
    S2["StatusPage"]
    S3["VAT Checker"]
    U --> P1
    U --> P2
    O -.owns & manages.-> P1
    O -.owns & manages.-> P2
    P1 --> S1
    P1 --> S2
    P2 --> S3

Organizations are an optional layer above Projects, for teams that run many Projects or take part in the reselling / partner program — see Organizations & Reselling. You don’t need one for everyday use.

1. Sign in. If you already have an account, sign in. Otherwise create a user account.
2. Choose services. Go to Create new, pick one or more services, and configure each one’s plan tier and volume. Have an offer code from sales? Redeem it right here.
3. Choose how to start — a 14-day free trial (recommended) or activate a paid plan right away. CAPTCHA also offers a free Non-Commercial plan.
4. Billing & payment (paid plans) — enter your billing profile (TrustComponent serves business customers in the EU, UK, and Switzerland) and pick a payment method: card or bank transfer.
5. Review & create — name the Project (max. 50 characters), optionally link it to an Organization, and confirm.
6. Configure the service. Follow the product-specific guide: CAPTCHA, StatusPage, or VAT Checker.

You can create as many Projects as you need, and rename a Project any time under Settings → General.

Settings → Services & Plans lists every service booked in the Project with its pricing plan, status, included / max events, and base price.

• Pricing models — plans are either flat (fixed monthly fee, paid in advance) or usage-based (included events plus a per-event overage price).
• Status — a service shows as Active, Active · Paid, Trial (with days left), Trial expired, Non-commercial (CAPTCHA’s free plan), or Cancelled (with the effective date).
• Trials — new services start with a 14-day free trial unless you activate a paid plan right away. From a running trial, Subscribe now converts to paid.
• Add a service — bundle another service into the Project with Add Service.
• Change plan — upgrade or downgrade a service’s plan at any time; Restore undoes a pending cancellation before it takes effect.
• Offer codes — redeem a code (AB2C-D2EFG-HI34-JKL5) from sales to switch the Project to individually agreed terms; you see the new services and monthly total before accepting.

Usage-based plans count events per calendar month (validations, monitor checks, CAPTCHA verifications). When a service reaches its plan’s maximum events, it is paused until the counter resets at the start of the next month — upgrade the plan to raise the cap.

Cancellation lives at the bottom of Services & Plans:

• With multiple services you choose which to cancel; cancelling all services deletes the whole Project.
• You pick a reason (missing features, not working as expected, too expensive, no further need, …) and can leave a comment.
• Deletion takes effect after a grace period — until then the data is retained and the cancellation can be restored.

Settings → Billing & Payment holds three things:

Billing profile — the legal entity on your invoices: company name, address, country, VAT ID (validated; optional for German companies), invoice language, optional extra invoice-copy recipients, and an optional customer reference that appears in the invoice header (and as e-invoice BuyerReference).

Invoice recipient & payment method — invoices go to one member of the Project, who must hold the Admin role. Pay by card (processed by Stripe) or bank transfer; payment methods are managed on your user profile and selected per Project.

Invoices — issued monthly with itemized line items per service and add-on, in EUR (prices excl. VAT). Each invoice is downloadable as PDF (with embedded e-invoice XML). Credit notes are issued for refunds and adjustments.

Every Project has a team of members, managed under Settings → Members & Roles. Each member holds exactly one role; higher roles include the lower ones:

Two protections always apply:

• A Project must keep at least one Admin — you can’t demote or remove the last one.
• The invoice recipient must remain a member with the Admin role.

Seats: how many members a Project can have is a plan limit, shown as a badge (e.g. 3 / 5 users) — the highest seat allowance among the Project’s services counts. Pending invitations occupy a seat.

1. Click Create Invitation, enter the person’s email address, and pick a role (default: Member).
2. The invitee must already have a TrustComponent account with that email — otherwise ask them to sign up first.
3. They receive an email and see the invitation on their dashboard Home page; accepting adds them to the team.

Invitations expire after 7 days. There’s no resend — delete the pending invitation and create a new one. Inviting the same person again replaces their previous invitation.

For sign-in through your own identity provider (OIDC), see Single Sign-On.

API keys authenticate server-side requests to the TrustComponent API — fetching CAPTCHA results, pushing heartbeats, validating VAT IDs. Manage them under Settings → API Keys.

• Keys are prefixed ak_ and shown in full exactly once, at creation — copy it then; afterwards only a masked form (ak_AbCd…WxYz) is displayed. We store only a hash, so a lost key can’t be recovered — create a new one.
• Optional description (max. 256 characters) to tell keys apart.
• Optional expiration: 30 days, 6 months, 1 year, or never (default).
• A key is scoped to its Project and carries no role or scope restrictions — treat it like an admin credential and rotate by deleting and re-creating.
• Creating and deleting keys requires the Admin role, and both are recorded in the audit log.

Use it as a bearer token:

Authorization: Bearer ak_your_key_here

Webhook endpoints push event notifications to an HTTPS URL you control — for example when a VAT validation result is ready. They’re managed on the same Settings → API Keys page.

An endpoint consists of:

Each endpoint gets a signing secret (prefixed whsec_) used for the TC-Webhook-Signature header — verify it on every delivery; you can rotate the secret at any time. A Test action sends a synthetic platform.webhook-endpoint.test event so you can verify your integration end-to-end.

The endpoint’s detail page shows the latest deliveries: timestamp, event type, status (Sent, Pending, Waiting for retry, Failed, Cancelled), attempt count, and the HTTP response. Failed deliveries are retried automatically up to 5 times with increasing backoff.

Full delivery mechanics — signature verification with code samples, retry schedule, and the event catalog — are in the Webhooks API reference.

Legal agreements with TrustComponent are concluded and stored per Project under Governance → Contracts. The most common one is the Data Processing Agreement (DPA) for GDPR Art. 28.

1. Open Governance → Contracts → Create Data Processing Agreement.
2. Enter your company details (name, address, country, optional contact) — this is the data controller on the agreement.
3. Confirm and create: the DPA is generated and signed self-service, becomes Active immediately, and is stored with its version.

Contracts are either platform-generated (like the DPA) or uploaded after offline signing. They move from Pending approval — where you can Accept or Decline them in the dashboard — to Active, and can later be Cancelled, Revoked, or Superseded by a newer version (the version chain is preserved). Every contract is downloadable as PDF at any time, including archived ones.

The Consents table below the contracts records lighter acceptances (terms and conditions, privacy policy, contract confirmations) with timestamp and version.

Governance → Audit Logs is the tamper-evident record of every meaningful change in the Project — across all services and the platform itself.

Each entry captures:

Use the date-range picker to browse (default: the last 24 hours). How far back you can look is your plan’s audit retention (typically one year); entries themselves are kept for up to two years.

Export — download the current range as JSON, CSV, or Excel (plan feature).