Arcjet
Arcjet is a developer security platform that embeds AI-powered runtime protection directly into application code via WebAssembly, offering JavaScript and Python SDKs across 15+ frameworks to block bots, prompt injection, and data leakage.
- Company typePrivate
- Founded2024
- HeadquartersSan Francisco, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What Arcjet does
Arcjet is a developer-focused application security platform that embeds runtime security directly into application code via WebAssembly modules, rather than relying on perimeter tools such as WAFs or HTTP middleware. Founded by David Mytton (formerly of console.dev) and incorporated as Arcjet Labs, Inc., the company is headquartered in San Francisco with a distributed team across the USA, Canada, and Italy. The platform ships SDKs for JavaScript/TypeScript and Python supporting 15+ frameworks, including Next.js, Astro, Nuxt, React Router, SvelteKit, Bun, FastAPI, and Flask, and integrates natively with Vercel, Netlify, and Clerk.
The platform's core technology is a WebAssembly-based runtime policy engine that performs in-process, context-aware security enforcement with less than 100ms of added latency. Product capabilities include bot protection, rate limiting, email validation, attack protection, sensitive information redaction, AI prompt injection detection, and the newer Arcjet Guards service that extends security into AI agent workflows and non-HTTP code paths. Arcjet combines a proprietary local AI attack detection model with an open-source bot intelligence package (@arcjet/well-known-bots) published on GitHub.
Arcjet operates a product-led, freemium go-to-market model. Developers discover and adopt the platform through npm/PyPI, GitHub, and self-serve onboarding at app.arcjet.com, with a free trial available and commercial production tiers generating subscription revenue. The platform is used by 1,000+ developers protecting 500+ applications, with Thatch as a publicly cited customer. Arcjet has raised $11.9M total: a $3.6M seed led by Andreessen Horowitz with Seedcamp in September 2024, followed by an $8.3M Series A led by Plural in October 2025.
Arcjet firmographics
Firmographics- Name
- Arcjet
- Legal name
- Arcjet Labs, Inc.
- Website
- https://arcjet.com
- Company type
- Private
- Founded year
- 2024
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- Arcjet is a developer security platform that embeds AI-powered runtime protection directly into application code via WebAssembly, offering JavaScript and Python SDKs across 15+ frameworks to block bots, prompt injection, and data leakage.
- Ownership category
- akta.pro rank
Arcjet industry classification
Industry- Product category
- Application Security Software
- NAICS
- Custom Computer Programming Services (541511), Computer Systems Design and Related Services (54151)
- SIC
- Services-Computer Programming Services (7371), Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- Platform Engineering & Internal Developer Platforms (IDP) (BPAEAKAC)
- akta.pro secondary industries
- Application Security & DevSecOps Services (BPAKAHAJ), Developer Portals, SDKs & Documentation Platforms (BPAMADAG), Privacy Management (Consent, DSAR, RoPA) (HDADAFAH)
Keywords
Where Arcjet is headquartered
LocationHeadquarters
- HQ city
- San Francisco
- HQ country
- United States
- HQ region
- North America
Offices3 records
Markets served
Arcjet business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Marketing or Sales, Infrastructure, Operations
Revenue model
- SDK-based Security Platform Subscription: Arcjet provides security capabilities (bot detection, rate limiting, email validation, attack protection, AI prompt injection protection, data redaction) embedded directly into application code via SDKs. The platform offers a free tier for developers and a commercial tier for production workloads. Revenue is generated through usage-based or subscription-based pricing for commercial deployments.
- Enterprise/Developer Commercial Tiers: Arcjet offers its security platform with tiered commercial plans targeting developers and enterprise teams. Thousands of developers have deployed the SDK to production environments. New developers are offered a free trial. The company is backed by Plural, Andreessen Horowitz, and Seedcamp, indicating commercial adoption of its platform.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Monthly | Free trial tier for new developers to evaluate the platform |
Go-to-market motion2 records
Distribution channels4 records
Marketing channels5 records
Arcjet product offering
Product offeringCore offering
Arcjet provides a developer security platform delivered as SDKs (JavaScript/TypeScript and Python) that embed application-layer security directly into code via a WebAssembly runtime. The SDKs bundle bot protection, rate limiting, email validation, sensitive information detection, Shield WAF, signup form protection, and AI-specific capabilities including prompt injection protection, Advanced Bot Signals, and Guards for AI agent workflows and non-HTTP code paths. The platform is consumed self-serve by developers and teams through a freemium model with paid commercial tiers for production workloads.
Product overview
Arcjet is a developer-centric security platform that embeds application-layer security directly into code, contrasting with traditional perimeter security solutions like WAFs. The platform operates via SDKs (JavaScript/TypeScript and Python) that run as WebAssembly modules inside application code. The core products include the JavaScript SDK (v1.0 stable) and Python SDK, which provide security building blocks including Bot Protection, Rate Limiting, Email Validation, Sensitive Information Detection, Shield WAF, and Signup Form Protection. Advanced AI-specific capabilities include AI Prompt Injection Protection, Advanced Bot Signals, and Arcjet Guards (which extends protection into AI agent workflows and non-HTTP code paths). The platform integrates with frameworks like Next.js, Astro, Nuxt, React Router, SvelteKit, Bun, Deno, NestJS, Express, Fastify, Hono, Flask, and FastAPI, and platforms including Vercel, Netlify, Clerk, Vercel AI SDK, and LangChain.
Differentiator
Problem solved
Functional benefit
Brands
- AI Prompt Injection Protection: Security capability that detects and blocks hostile prompts at the application boundary before they reach production AI models
- Arcjet Guards
- Advanced Bot Signals
- Python SDK
- JavaScript SDK v1.0
Products and services
- JavaScript SDK (v1.0) Production-ready SDK for embedding AI-powered application security features (bot detection, rate limiting, email validation, data redaction) directly into JavaScript/TypeScript applications via a WebAssembly module.
- Python SDK SDK extending Arcjet's application-layer security platform to Python-based services and APIs, enabling bot protection, rate limiting, email validation, and abuse prevention for FastAPI and Flask-style applications.
- AI Prompt Injection Protection Security capability that detects and blocks hostile prompts at the application boundary before they reach production AI models, providing inline decision points in the request lifecycle with full context including identity, session state, and business logic.
- Arcjet Guards Runtime security service that extends Arcjet protection into AI agent workflows, queue consumers, and non-HTTP code paths, enforcing security policies inside tool calls and workflow steps.
- Advanced Bot Signals Security feature that protects web application actions from modern browser automation and automated abuse without CAPTCHAs by combining browser telemetry with application context for targeted enforcement at high-risk points.
- Nuxt and React Router SDKs Native framework SDKs for Nuxt and React Router, enabling developers using these JavaScript frameworks to embed Arcjet's bot protection, rate limiting, and attack prevention features with minimal setup.
Quantifiable outcome
- Hundreds of thousands of developers have deployed Arcjet SDKs across 500+ applications in production.
- +2 more outcomes
Companies that use Arcjet
Customer profileNamed customers1 record
Segments3 records
Ideal customer profiles2 records
Arcjet technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration5 records
AI capability7 records
Feature8 records
Arcjet partnerships and signals
Strategic signalPartnerships
One partnership is on record.
- VercelcoreArcjet provides native integration with the Vercel AI SDK and Vercel deployment platform, enabling developers building on Vercel to easily add Arcjet's AI security features (prompt injection detection, bot protection, rate limiting) to their applications.
Scale indicators5 records
Recent moves6 records
Expansion highlights5 records
Arcjet competitors and assessment
Company assessmentBroad incumbents
- Snyk: Snyk is a developer-first security platform spanning code, dependencies, containers, and IaC. Comparable as a developer-embedded security tooling incumbent expanding into runtime application protection, though broader in scope than Arcjet's in-code runtime focus.
- Cloudflare: Cloudflare delivers WAF, Bot Management, and Turnstile at the edge and is increasingly bundling developer-friendly security primitives. Broad incumbent competing with Arcjet's bot protection and Shield WAF capabilities across a much larger surface area.
- Akamai Bot Manager: Akamai's App & API Protector and Bot Manager provide enterprise-scale bot mitigation and WAF capabilities. Broad incumbent competing with Arcjet's perimeter-replacement narrative for high-stakes web applications.
Direct peers
- Socket: Socket is a developer-focused supply chain security platform that detects malicious packages and behavioral risks in open-source dependencies. Comparable as a developer-embedded security tool going after the same npm/PyPI install base via similar PLG motion.
- Lakera: Lakera provides enterprise prompt injection and LLM security APIs (Gandalf, Red), competing head-on with Arcjet's AI Prompt Injection Protection. Most directly comparable peer given the shared focus on securing AI endpoints and LLM-integrated applications.
- Kasada: Kasada delivers bot management and account protection with a focus on defeating modern automation, comparable to Arcjet's Advanced Bot Signals capability. Both target sophisticated attackers bypassing traditional CAPTCHAs.
- Protect AI: Protect AI provides security and governance tooling for AI/ML systems, including model and application-layer protections. Comparable peer in the broader AI security category where Arcjet competes on prompt injection and AI abuse protection.
- HUMAN Security: HUMAN Security (formerly White Ops/PerimeterX) offers bot mitigation, account abuse defense, and fraud prevention for web applications. Directly comparable as an enterprise bot-defend solution competing for the same high-stakes application use cases Arcjet targets.
- DataDome: DataDome provides bot protection, fraud detection, and account takeover prevention targeting web and API endpoints. Comparable as a competing solution for Arcjet's bot protection and abuse prevention use cases for production applications.
Emerging players
- Rebuff: Rebuff is an open-source prompt injection detection library for LLM applications. Comparable as an emerging, developer-focused prompt-injection defense; Arcjet is positioned as the more production-grade, managed counterpart with broader SDK coverage.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks5 records
Key highlights7 records
Customer concentration
Arcjet social profiles
Digital presenceArcjet financial estimates
Financial estimateRevenue estimate
Valuation estimate
Arcjet leadership team
Management profileNumber of profiles
Profiles1 record
Arcjet funding detail
Funding detailFunding overview
Funding rounds2 records
Investors3 records
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
Arcjet M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about Arcjet
What does Arcjet do?
Arcjet provides a developer security platform delivered as SDKs (JavaScript/TypeScript and Python) that embed application-layer security directly into code via a WebAssembly runtime. The SDKs bundle bot protection, rate limiting, email validation, sensitive information detection, Shield WAF, signup form protection, and AI-specific capabilities including prompt injection protection, Advanced Bot Signals, and Guards for AI agent workflows and non-HTTP code paths. The platform is consumed self-serve by developers and teams through a freemium model with paid commercial tiers for production workloads.
Is Arcjet a public or private company?
Arcjet is a private company. It is classified as venture growth investor backed and is currently operating.
When was Arcjet founded?
Arcjet was founded in 2024. It employs 11 to 50 people.
Where is Arcjet based?
Arcjet is headquartered in San Francisco, United States, in the North America region.
How does Arcjet make money?
Two revenue lines are on record. SDK-based Security Platform Subscription is the primary driver. The others are enterprise/Developer Commercial Tiers.
Who are Arcjet's main competitors?
Broad incumbents on record are Snyk, Cloudflare and Akamai Bot Manager. Direct peers are Socket, Lakera, Kasada, Protect AI, HUMAN Security and DataDome. Rebuff is listed as an emerging player.
Does Arcjet have an API?
Yes. Arcjet provides SDKs that enable developers to embed security features directly into application code. The SDKs offer methods like protect(), detectPromptInjection(), detectBot(), tokenBucket(), and sensitiveInfo() for implementing AI-powered security including bot detection, rate limiting, email validation, and data redaction. The platform supports JavaScript/TypeScript and Python, with SDKs designed to run inside application code via a WebAssembly module. Developer documentation is at docs.arcjet.com.
What industry is Arcjet in?
Arcjet's product category is Application Security Software. Its primary akta.pro industry code is BPAEAKAC, Platform Engineering & Internal Developer Platforms (IDP), with a secondary code of BPAKAHAJ, Application Security & DevSecOps Services. Its NAICS code is 541511 and its SIC code is 7371.