Feroot

Feroot Security is a Toronto-based cybersecurity company providing AI-powered client-side (browser) security and compliance automation for websites and mobile apps. Its platform gives organizations visibility into the third-party JavaScript, trackers, cookies, and data flows running in the browser, and automates compliance with PCI DSS 4.0.1 (requirements 6.4.3 script inventory and 11.6.1 tamper detection), HIPAA, GDPR, CCPA/CPRA, and 50+ global regulations. Products include DXComply (privacy compliance and consent auditing), PaymentGuard (PCI DSS 4.0.1 automation for payment pages), and DXSecure (real-time client-side script security against formjacking, Magecart, and data exfiltration). Feroot is SOC 2 Type 2 certified and a PCI Security Standards Council Associate Member. Backed by Y Combinator, True Ventures, Haystack, and Stonemill Ventures.

Feroot is profiled on the APIs.io network. Tagged areas include Company, Security, Client-Side Security, Application Security, and Compliance.

Feroot’s developer surface includes pricing, engineering blog, and 11 more developer resources.

🌐 Visit website 📡 Source on GitHub

24.2/100 emerging ▬ flat Agent 0/100 human only Full breakdown ↓
scored 2026-08-17 · rubric v0.11.0

0 APIs

CompanySecurityClient-Side SecurityApplication SecurityCompliancePCI DSSPrivacyJavaScript Security

Kin Score

Kin Score How this is scored →
scored 2026-08-17 · rubric v0.11.0

Composite quality — 24.2/100 · emerging

Contract Quality 0.0 / 21

Developer Ergonomics 0.4 / 17

Commercial Clarity 10.3 / 17

Operational Transparency 1.7 / 11

Governance 1.3 / 10

Discoverability 4.9 / 9

Regulatory Posture 5.6 / 15

Agent readiness — 0/100 · human only

Machine-Readable Contract 0 / 18

Agentic Access Contract 0 / 10

MCP Server 0 / 12

Machine-Readable Auth 0 / 10

Idempotency 0 / 9

Stable Error Semantics 0 / 8

Request/Response Examples 0 / 7

Rate-Limit Signaling 0 / 7

Typed Event Surface 0 / 6

Agent Skills 0 / 5

Well-Known Catalog 0 / 4

Consent & Bot Identity 0 / 3

A2A Agent Card 0 / 8

Dry-Run / Simulate Mode 0 / 4

Regulatory Posture applies to this provider. Its tags matched the Payments regime, so Regulatory Posture carries 15 points of the composite. If this regime is wrong for your business, say so on your provider repo — the applicability map is public and we will correct it.

The six quality facets above are damped to 85 points between them, because the conditional facet above carries the other 15. That is why each facet's contribution is shown against a damped maximum: raising a quality facet moves the composite by 85% of its nominal weight, not 100%. The full arithmetic is at apis.io/rating/.

Improve this rating by publishing the missing artifacts — every area above can be raised, and the full rubric is at apis.io/rating/. This rating is computed from github.com/api-evangelist/feroot: open an issue to ask a question, or submit a pull request to add artifacts. Want it done for you? Prioritized profiling — $2,500 →

Get Started 1

Portal, sign-up, and the first successful call

Login

Agent Surfaces 1

MCP servers, agent skills, and machine-readable catalogs

LLMsTxt

LLMsTxt

Design & Contract 2

Pagination, idempotency, versioning, errors, and events

Lifecycle

Lifecycle

Conformance

Conformance

Access & Security 3

Authentication, authorization, and security posture

TrustCenter

TrustCenter

Compliance

Compliance

DomainSecurity

DomainSecurity

Operate 1

Status, limits, changes, and where to get help

StatusPage

StatusPage

Commercial 3

Pricing, plans, and the legal terms of use

Pricing

Pricing

PrivacyPolicy

PrivacyPolicy

TermsOfService

TermsOfService

Company 2

The organization behind the API

Website

Website

Blog

Blog

Source (apis.yml)

aid: feroot
name: Feroot
description: Feroot Security is a Toronto-based cybersecurity company providing AI-powered client-side (browser) security
  and compliance automation for websites and mobile apps. Its platform gives organizations visibility into the third-party
  JavaScript, trackers, cookies, and data flows running in the browser, and automates compliance with PCI DSS 4.0.1 (requirements
  6.4.3 script inventory and 11.6.1 tamper detection), HIPAA, GDPR, CCPA/CPRA, and 50+ global regulations. Products include
  DXComply (privacy compliance and consent auditing), PaymentGuard (PCI DSS 4.0.1 automation for payment pages), and DXSecure
  (real-time client-side script security against formjacking, Magecart, and data exfiltration). Feroot is SOC 2 Type 2 certified
  and a PCI Security Standards Council Associate Member. Backed by Y Combinator, True Ventures, Haystack, and Stonemill Ventures.
url: https://raw.githubusercontent.com/api-evangelist/feroot/refs/heads/main/apis.yml
accessModel:
  pricing: unknown
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Unknown
  confidence: low
  source: []
  generated: '2026-07-22'
  method: derived
image: https://www.feroot.com/wp-content/uploads/2025/11/cropped-favicon-feroot-270x270.png
x-type: company
x-source: vc-portfolio
x-backed-by:
- true-ventures
x-tier: stub
x-tier-reason: portfolio-lead
specificationVersion: '0.20'
created: '2026-07-17'
modified: '2026-07-19'
tags:
- Company
- Security
- Client-Side Security
- Application Security
- Compliance
- PCI DSS
- Privacy
- JavaScript Security
apis: []
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: Website
  url: https://www.feroot.com/
- type: Pricing
  url: https://feroot.com/pricing/
- type: Blog
  url: https://feroot.com/blog/
- type: PrivacyPolicy
  url: https://feroot.com/privacy-policy/
- type: TermsOfService
  url: https://feroot.com/terms-of-use/
- type: Login
  url: https://app.feroot.com/
- type: LLMsTxt
  url: llms/feroot-llms.txt
- type: TrustCenter
  url: https://trust.feroot.com/
- type: Compliance
  url: https://trust.feroot.com/
- type: StatusPage
  url: https://status.feroot.com/
- type: Lifecycle
  url: lifecycle/feroot-lifecycle.yml
- type: Conformance
  url: conformance/feroot-conformance.yml
- type: DomainSecurity
  url: security/feroot-domain-security.yml
x-enrichment:
  date: '2026-07-19'
  status: backfilled
  pass: local-v1
  note: backfilled from .gitignore signal + verified work evidence