An in-depth review of Castle, the account security and fraud detection platform: features, pricing, pros and cons, and how it stops bots and account takeovers.
Castle's core value proposition is combining two layers of defense: edge-level filtering that intercepts obviously automated or malicious traffic before it reaches a customer's servers, and in-application analytics that continue monitoring user behavior after a session begins, where more sophisticated attacks tend to hide. This dual-layer model, including a direct Cloudflare integration for edge deployment, lets Castle catch both blunt bot traffic and more nuanced account takeover attempts carried out by real people using stolen credentials or session hijacking techniques.
Underlying both layers is a risk-scoring engine that ingests device fingerprints, behavioral biometrics such as typing patterns and mouse movement, IP geolocation and proxy or VPN detection, and email reputation data, producing real-time Bot Score and Abuse Score outputs that typically resolve within about 100 milliseconds. Development teams can wire these scores into policy rules, ranging from silently allowing a request to challenging it with additional verification to denying it outright, and Castle retains historical event data, up to 18 months on higher-tier plans, to support deeper network analysis that can surface clusters of related fraudulent accounts or devices.
Castle markets its pricing as transparent and linearly scaling, in contrast to fraud-prevention vendors that require lengthy sales cycles for any pricing information. The free tier, capped at 1,000 API calls a month, exists purely for evaluation before going live. The Pro tier is self-serve at $200 per month for the first 100,000 calls, with overages billed at $0.002 per additional call and no long-term contractual minimums, making it accessible to startups and mid-sized companies that want to get started without an enterprise sales process. Larger organizations that need custom Monthly Tracked User pricing, extended data retention up to 18 months, dedicated Slack channels, and formal SLAs move into Enterprise agreements that start around $4,000 per month.
Given its customer roster, which includes consumer platforms like Canva and Rockstar Games alongside marketplaces like Rakuten, Castle tends to fit best for consumer-facing digital products and marketplaces with meaningful sign-up and login volume, where account takeover, fake account creation, and promo or content abuse are ongoing operational problems. Its developer-first integration model and self-serve pricing tier make it a reasonable starting point for engineering teams that want to add fraud detection without an immediate enterprise procurement process, while its Enterprise tier and edge integrations serve larger platforms that need deeper historical analysis and guaranteed support.
Castle is an account security and fraud detection platform that analyzes signup, login, and in-app behavior in real time to detect and stop bots, account takeovers, fake account creation, and other forms of account abuse.
Castle offers a free tier for evaluation (up to 1,000 calls/month), a self-serve Pro plan at $200/month for the first 100,000 calls plus $0.002 per additional call, and custom Enterprise pricing starting around $4,000/month with volume or Monthly Tracked User based billing.
Castle was founded in 2015 in Malmo, Sweden by Sebastian Wallin and Johan Brissmyr. The founders relocated to the San Francisco Bay Area in 2016 to join Y Combinator's Winter 2016 batch.
Castle typically returns real-time risk assessments in around 100 milliseconds, making it usable inline in signup, login, and checkout flows without noticeably slowing the user experience.
Yes. Castle offers a direct integration for Cloudflare that allows detection to run at the network edge in addition to in-application analytics, giving customers a combined edge-plus-in-app defense layer.
Castle's customers include consumer and enterprise platforms such as Atlassian, Rockstar Games, Rakuten, Canva, and Framer, spanning gaming, e-commerce, productivity, and design software companies.
Castle is used to detect and prevent account takeovers, fake account creation, multi-accounting and promo abuse, SMS pumping fraud, content abuse, and automated API abuse.
Yes. Castle offers a free tier capped at 1,000 API calls per month specifically for evaluating the platform before going live, with no credit card required to start.