coss.com vs Castle
Castle goes deeper on devices and bots, on web and mobile. coss.com Risk gives reasons for each decision, checks content too, with no per-assessment price.
Both are called from your server at sign-up, login and payment, and answer with a score and a decision you act on: allow, challenge or deny at Castle, allow, review or block at coss.com. Castle fingerprints devices and watches behavior across web and native apps, and keeps separate abuse, account takeover and bot scores. coss.com Risk works from email, IP, velocity, your lists and rules, what users write and what you report back, without browser fingerprinting.
At a glance
Castle's side was checked on against its own pages. Prices are list prices.
| Feature | coss.com | Castle |
|---|---|---|
| Price | Assessments and email, IP and content checks are part of your plan; live phone checks $0.01 per check | Pay per request: $0.005 for Risk and Filter, $0.001 for IP Intelligence. Pro $200 a month of usage; Enterprise from $4,000 a month |
| Free | Assessments, and 100 risk phone checks a month | $5 of usage a month: 1,000 Risk calls or 5,000 IP lookups, sharing one budget |
| Request rate | 100 per second per API key, bursts of 200 | 1 a second on Free, 5 on Pro, unlimited on Enterprise |
| Decisions | allow, review or block, with one score from 0 to 1 and its reasons | allow, challenge or deny from your policies, with abuse, account takeover and bot scores from 0 to 1 |
| Your own logic | Allow and block lists, then up to 50 rules, then score thresholds; in the dashboard or through the API | Policies in order, on event type, lists, scores and signals; lists of user ids, IPs, transactions or custom values |
| Devices | coss/device: a random id in localStorage, coarse facts and automation markers; no canvas or WebGL fingerprinting, no cookies | Castle.js: canvas and WebGL fingerprinting, mouse and keyboard interactions, first-party cookies and local storage |
| Native appscoss/device is browser-only; assessments work without a device token | — | iOS, Android, React Native and Flutter SDKs |
| Bots | Automation markers, plus your Turnstile or hCaptcha token, verified with the provider | A bot score from device fingerprints and interaction patterns; spoofed, headless and emulated device signals |
| Logins | New country and new network per user, velocity, and identifiers you reported as fraud | An account takeover score, with new country, device, device type, ISP, OS and language signals |
| Payments | checkout events: amount, card country and funding, billing country; card fingerprints kept as keyed hashes and remembered once reported | $transaction events: purchases, withdrawals, deposits, transfers and more, with payment method and merchant details |
| Email and IP | Disposable and undeliverable domains, typos, new domains, duplicate mailboxes; Tor, cloud and hosting networks, ASN and country. VPNs guessed from the network, unless coss.com has address-level data | Disposable, fraudulent and unreachable email domains; Tor, VPN, proxy, residential proxy and data center IPs |
| What people writeNot in Castle's signals reference | Spam, phishing, malware and fraud scores from an AI model; the text is never stored | — |
| Phone numbersNot in Castle's signals reference | Line type and carrier, as a check on its own | — |
| Learning from outcomes | Feedback flags the mailbox, card, browser and IP next time, and suggests weights you choose to apply | Crowd-wide statistics and self-learning AI |
| Data kept | Email, IP and user agent 90 days; decisions and reasons 1 year; each environment's memory is keyed hashes only | 3 days on Free, 7 on Pro, up to 18 months on Enterprise |
| Testing | Sandbox keys, with fixed inputs that trigger each reason and their own counters and lists | Sandbox environments on the same pipeline, with mock request tokens that set the score and action |
| Compliance programscoss.com doesn't list certifications here | — | SOC 2 Type II; lists itself as GDPR Ready |
Which to choose
Both are good at what they do. Here is where each one fits better.
Choose Castle when
Bots are your main problem
Castle reads device fingerprints and interaction patterns such as mouse movement and timing, and keeps a separate bot score. coss.com only sees automation markers and your captcha's answer.
You protect native apps
Castle has iOS, Android, React Native and Flutter SDKs, with jailbreak and emulator detection. coss/device runs in browsers only.
Account takeover is what you're defending against
An account takeover score at login, with signals for new devices, device types, ISPs, operating systems and languages. coss.com looks at new countries and networks, velocity and reported identifiers.
You want signals from beyond your own traffic
Castle draws on crowd-wide statistics. coss.com's memory of what it has seen is separate per environment, so a new environment starts empty, apart from public IP data and its email checks.
You need VPN and proxy data per address
Castle flags VPNs, proxies and residential proxies. coss.com mostly infers VPNs from the network and has no residential proxy signal unless it holds address-level data.
Your security review asks for SOC 2
Castle lists SOC 2 Type II on its trust page.
Choose coss.com when
No per-assessment bill
Assessments are part of every coss.com plan, within the rate limit per API key. Castle's Free and Pro plans count each request against a usage budget, at 1 and 5 requests a second.
Decisions you can read and tune
Each assessment lists its reasons, your lists and rules decide before the score, and calibration shows how often each reason was right on your own traffic. coss.com only suggests new weights: you choose which to apply.
It reads what people write
Pass a bio, a listing or a message, and it's scored for spam, phishing, malware and fraud without the text being stored. Phone checks give the line type and carrier on their own.
No browser fingerprinting
coss/device keeps a random id in localStorage and nothing from canvas, WebGL, fonts or audio. It costs accuracy, since clearing storage looks like a new browser, and it's less for you to explain to your users.
Sits next to the rest of your stack
One API key and SDK with email, SMS, Forms and Verify. Forms and Verify already use Risk's signals, and rate limiting is on the same account.
Moving from Castle
- 1
Swap the browser token
castle.createRequestToken() becomes collectDevice() from coss/device, sent to your server with the form. Native apps have no equivalent, so assess them without a device token.
Read the guide - 2
Replace the server calls
$registration becomes event: "signup", $login becomes "login", and $transaction becomes "checkout". Act on decision instead of policy.action, treating review the way you treated challenge. Keep failing open on errors.
Read the guide - 3
Move policies to rules and lists
Recreate each policy as a rule, or as a threshold if it only tests a score, and add list entries with coss.risk.lists.add(). Rules see the fields and reasons coss.com has, which aren't Castle's signals one for one.
Read the guide - 4
Report outcomes as you go
coss.com starts with no history of your users. Send feedback on confirmed fraud and chargebacks so the same mailbox, card or browser is flagged next time, and run both services side by side until you trust the decisions.
Read the guide
Questions
- How much does coss.com Risk cost?
- Assessments and email, IP and content checks are part of every plan, up to 100 per second per API key, bursts of 200. Live phone checks cost $0.01 per check once they get an answer, and every plan includes 100 risk phone checks a month.
- Does coss.com fingerprint browsers like Castle does?
- No. coss/device keeps a random id in localStorage with coarse facts and automation markers, and uses no canvas, WebGL, font or audio fingerprinting. A browser with cleared storage looks like a new one, and the token isn't signed, so treat it as one hint among others.
- Can coss.com Risk protect a mobile app?
- Your server can assess events from any client, using the email, IP, user and velocity signals. There's no native device SDK: coss/device is browser-only. Castle has iOS, Android, React Native and Flutter SDKs.
- Does coss.com Risk cover payments?
- Yes. A checkout event takes the amount and what your processor knows about the card: its fingerprint, country and funding. coss.com compares countries, counts checkouts per card, and remembers cards you report as fraud. It never takes a card number.
- What happens if a signal is slow or unavailable?
- The assessment is made without it, and the missing group is listed in degraded. If the API can't be reached at all, your code decides, and the docs recommend failing open.
- Does coss.com share fraud data between customers?
- No. What an environment remembers for velocity, duplicates and fraud reports stays in that environment, as keyed hashes. Castle's scoring draws on crowd-wide statistics.
Sources
Castle's facts were checked on ; their pages are the final word on their prices and features.
The coss.com side
Try coss.com next to Castle.
A development key costs nothing and delivers nothing, so you can compare with real code.
Add coss.com to this project: read https://coss.com/llms.txt, get a development key with `npx coss-cli init --agents`, and build and test with it.