Castle

Castle is a comprehensive, developer-first security platform designed to provide the trust infrastructure for the modern internet. It empowers businesses to protect themselves from a wide array of sophisticated threats, including automated bots, credential stuffing, account takeovers (ATO), fake account creation, and content abuse. Trusted by leading companies like Canva, Rockstar Games, and Atlassian, Castle offers a robust solution that operates seamlessly in the background to secure user accounts and platform integrity.

The core of Castle's effectiveness lies in its unique dual-layer fraud defense architecture. This system combines edge-level protection, which can be deployed with no code via a Cloudflare integration, with deep in-app monitoring through powerful SDKs. Signals flow between these two layers, creating a unified defense system where early-stage blocking at the edge sharpens the detection of more subtle threats within the application. This approach ensures comprehensive coverage against evolving attack vectors.

How to use Castle

Integrating Castle is designed to be fast and straightforward, allowing businesses to go live in minutes.

1. Sign Up & Choose a Plan: Create a free account to start. You can evaluate the platform with up to 1,000 API calls per month.
2. Integration: Choose your preferred integration method. For rapid deployment, connect Castle to your Cloudflare stack with no code required. For deeper insights and control, integrate Castle's lightweight SDKs (available for web and mobile) into your application's backend and frontend.
3. Monitor and Analyze: Initially, you can run Castle in 'monitoring mode'. This allows you to observe user behavior, device data, and risk scores without actively blocking traffic. The analytics dashboard provides deep insights into potential threats and user patterns.
4. Configure Policies: Use the intuitive Rules Engine to create custom logic. Define rules to allow, challenge (e.g., with MFA), or deny actions based on risk scores, behavioral signals, device fingerprints, or any custom data.
5. Activate Protection: Once you are confident in your rules, switch to 'blocking mode' to actively prevent fraud and abuse in real-time, securing critical user flows like signups, logins, and transactions.

Core Features of Castle

• Dual-Layer Fraud Defense: Combines edge and in-app security for holistic threat detection.
• AI-Powered Risk Scoring: Self-learning AI models that score the risk of account takeover, bot activity, and general abuse in real-time.
• Advanced Device Fingerprinting: Achieves 99.5% accuracy in identifying unique devices, detecting headless browsers, emulators, and device tampering.
• Behavioral Analysis: Tracks user sessions, device interactions, and behavior, enriched with your business context to spot anomalies.
• Real-time Rules Engine: Allows you to build and manage complex risk logic to allow, challenge, or deny actions without deploying new code.
• Comprehensive Analytics: A powerful suite for proactive threat hunting, network analysis, session monitoring, and backtesting rules on historical data.
• Email & IP Intelligence: Assesses email reputation, detects disposable domains, and analyzes IP risk, including proxy and Tor detection.
• Developer-First API: A single, well-documented API to retrieve threat insights and orchestrate security responses across your entire stack.

Use Cases for Castle

Castle is versatile and can be applied to protect various aspects of an online platform:

• Account Takeover (ATO) Prevention: Identifies and blocks credential stuffing attacks and suspicious login attempts from unfamiliar devices or locations.
• Fake Account & Signup Fraud: Weeds out bots and malicious actors at the registration stage by analyzing email reputation, IP risk, and behavioral patterns.
• Multi-Accounting Prevention: Prevents users from creating multiple accounts to abuse promotions, referral programs, or community guidelines.
• Content & Spam Abuse: Automatically blocks repetitive, low-quality, or malicious content submitted by bots or bad actors.
• Transaction & Payment Fraud: Stops credit card testing, promo abuse, and other forms of financial fraud.
• SMS Pumping Elimination: Protects against abuse of SMS-based two-factor authentication, which can lead to inflated costs.

Advantages of Castle

Castle provides a significant competitive edge through its modern approach to security:

• Frictionless Security: Operates silently, ensuring that legitimate users have a smooth experience while only high-risk interactions are challenged.
• Rapid Deployment: Go from signup to active protection in minutes, not months.
• High Scalability: The infrastructure is built to process billions of monthly requests with a median response time of 100ms.
• Unified Platform: Eliminates the need for multiple, disconnected security tools by providing a complete stack of data, APIs, and management tools.
• Transparent & Predictable Pricing: Offers a clear pay-as-you-go model that scales with your business needs.

Pricing and Plans

Castle offers a flexible, transparent pricing structure suitable for businesses of all sizes.

• Free Plan: $0/month. Includes up to 1,000 API calls per month, 3 seats, 1 environment, and 3 days of data exploration. Ideal for evaluation and small projects.
• Pro Plan: Starts at $200/month for the first 100,000 API calls. Includes 5 seats, 2 environments, 7 days of data exploration, and chat/email support. Designed for production applications.
• Enterprise Plan: Custom pricing starting at $4,000/month. Offers unlimited API calls, up to 18 months of data history, unlimited seats, dedicated support with a Slack channel, SLAs, and the option for pricing based on Monthly Tracked Users (MTU).