Overview

Castle is an active, San Francisco-based fraud prevention and bot detection company founded in 2015 by Swedish entrepreneurs Johan Brissmyr and Sebastian Wallin.The company emerged from Y Combinator's Winter 2016 batch with a developer-first approach to account security: a single JavaScript snippet that builds behavioral profiles for every user, flagging suspicious activity before accounts are compromised.

Unlike traditional security tools that burden end users with CAPTCHAs and friction, Castle routes that responsibility to the businesses serving those users.The company raised a $2M seed round in 2016 and a $9.2M Series A led by Index Ventures in 2019, and has since expanded its product from account takeover prevention into a broader fraud prevention platform covering bots, SMS pumping, API abuse, and multi-accounting.

Castle remains active as of February 2026.This report covers the company's founding, product evolution, traction, and market position — it is not a post-mortem.

Founding Story

Johan Brissmyr and Sebastian Wallin both grew up in Malmö, Sweden, a mid-sized city in the country's south that has produced a disproportionate number of European tech founders. Brissmyr holds a Master of Science in Computer Science from Lund University's Faculty of Engineering.^[1] Before Castle, he co-founded two earlier ventures: Popdevelop, a software development company, and SettleBox, a portable digital identity product for online marketplaces.^[2] Neither became a breakout company, but they gave Brissmyr hands-on experience with the authentication and identity problems that plague consumer-facing applications.

The direct predecessor to Castle was Userbin, which Brissmyr co-founded in 2014. Userbin was an authentication service built for consumer apps — essentially a drop-in login layer that developers could integrate without building their own auth stack.^[3] The product was technically sound but commercially difficult. "The consumer authentication space is a difficult market to break into as there are many choices, including open-source options," Brissmyr later said.^[4] Userbin did not succeed as a company.

The failure of Userbin produced a specific insight: authentication infrastructure is a commodity, but the problem of what happens after login — detecting whether the person who just authenticated is actually who they claim to be — remained largely unsolved for most businesses. Account takeovers, credential stuffing attacks, and fake account creation were growing problems, and most companies lacked the engineering resources to build behavioral detection systems in-house.

In 2015, Brissmyr and Wallin founded Castle in Malmö to address that gap directly. Their founding vision was explicit about shifting responsibility: "We started Castle because we wanted to figure out a way to shift security responsibility from end users to the companies who serve them," Brissmyr explained at the Series A announcement.^[5]

The founders applied to Y Combinator and were accepted into the Winter 2016 batch. In early 2016, they relocated from Sweden to the Bay Area to participate.^[6] The move was a significant commitment — leaving an established life in Malmö for a three-month accelerator program in a city where they had no existing network. The bet paid off: YC provided both the capital and the credibility to attract Castle's first institutional investors.