tirreno
tirreno, operated by Tirreno Technologies Sàrl (Switzerland), is an open-source security framework for event tracking, threat detection, and risk scoring. It serves SaaS, fintech, healthcare, government, and e-commerce platforms via a freemium Community Edition and a proprietary Enterprise Edition.
- Company typePrivate
- Founded2024
- HeadquartersPrilly, Switzerland
- Headcount1–10
- GTM typeB2B
- OfferingSoftware
What tirreno does
Tirreno Technologies Sàrl, operating under the brand tirreno, is a Swiss developer of an open-source security framework focused on event tracking, threat detection, and risk scoring embedded directly inside customer applications. The product targets account takeover, credential stuffing, fake registration, payment fraud, API abuse, insider threats, and behavioral anomalies that bypass inline defenses, serving use cases across SaaS platforms, internal enterprise applications, API-first architectures, and mission-critical/air-gapped deployments in verticals including banking/fintech, healthcare, government, and e-commerce.
The platform is built on PHP 8.0-8.3 with PostgreSQL 12+, Apache, and Docker-based deployment. Its core is a rule engine with 109 built-in detection rules organized by category (account takeover, behavior, country, device, email, IP, phone, blacklist) and 12 pre-configured rule presets, supplemented by custom-rule authoring, a sensor API for event ingestion, a Blacklist API, an optional IP Enrichment API, and a built-in dashboard with review queue, single-user investigation view, and field audit trail. Official tracker SDKs ship for PHP, Python, and Node.js, and the framework is distributed via GitHub (1.4K stars), Docker Hub, and Packagist under AGPL-3.0.
Monetization follows a freemium-to-enterprise model: the Community Edition is free and self-hosted with a 2,000 requests/month free IP enrichment tier, while the Enterprise Edition is sold under proprietary license via custom quotes for multi-application support, SIEM integration, and developer support. Billing is processed through Paddle as Merchant of Record. The company is registered in Canton of Vaud (CHE-389.595.358), headquartered at Rue Galilée 7, Yverdon-les-Bains, Switzerland, with no disclosed external funding, no named enterprise customers, and a 1-10 employee footprint as of the input snapshot.
tirreno firmographics
Firmographics- Name
- tirreno
- Legal name
- Tirreno Technologies Sàrl
- Website
- https://tirreno.com
- Company type
- Private
- Founded year
- 2024
- Operating status
- Operating
- Headcount range
- 1–10 employees
- Short description
- tirreno, operated by Tirreno Technologies Sàrl (Switzerland), is an open-source security framework for event tracking, threat detection, and risk scoring. It serves SaaS, fintech, healthcare, government, and e-commerce platforms via a freemium Community Edition and a proprietary Enterprise Edition.
- Ownership category
- akta.pro rank
tirreno industry classification
Industry- Product category
- Security Analytics Software
- NAICS
- Other Computer Related Services (541519), Computer Systems Design and Related Services (54151)
- SIC
- Services-Computer Programming Services (7371), Services-Computer Programming, Data Processing, Etc. (7370)
- akta.pro primary industry
- Software Supply Chain & Dependency Security (SBOM, Signing) (HDADACAD)
Keywords
Where tirreno is headquartered
LocationHeadquarters
- HQ city
- Prilly
- HQ country
- Switzerland
- HQ region
- Europe
Offices1 record
Markets served
tirreno business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Technology or R&D, Personnel, Infrastructure, Marketing or Sales, Operations
Revenue model
- Community Edition: Free open-source version available on GitHub under AGPL-3.0 license. Self-hosted, with optional IP enrichment pack (2,000 free API requests/month).
- Enterprise Edition: Proprietary license for mission-critical organizations with multi-application support, advanced fraud prevention capabilities, SIEM integration, and developer support. Subscription model with usage-based pricing tiers.
- IP Enrichment API: 2,000 free API requests per month included. Enterprise options available for high-volume needs with custom pricing.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Freemium | Others | Community Edition (Free) |
| Subscription | Monthly | Enterprise Edition (Custom) |
Go-to-market motion1 record
Distribution channels3 records
Marketing channels5 records
tirreno product offering
Product offeringCore offering
tirreno provides an open-source, self-hosted security framework that ingests user events (logins, registrations, page views, field edits) through official SDKs and a sensor API, processes them via a configurable rule engine with 109 built-in detection rules, and produces trust/risk scores used to detect account takeover, credential stuffing, fraud, insider threats, and API abuse. It is distributed as a free AGPL-3.0 Community Edition on GitHub and Docker Hub, with a paid Enterprise Edition that adds multi-application support, SIEM integration, and developer support for mission-critical organizations.
Product overview
tirreno is a free, open-source security framework for event tracking, threat detection, and risk scoring embedded directly into products. The core offering consists of the Community Edition (open-source) and Enterprise Edition (proprietary with multi-tenant architecture), plus an optional IP Enrichment API with a free monthly tier. The platform includes a built-in Dashboard with Review Queue, Single User View for investigation, Rule Engine with 109 built-in rules, Field Audit Trail, and Blacklist API. Official tracker SDKs for PHP, Python, and Node.js enable integration into any application. tirreno processes user events (logins, registrations, page views, field edits) through a configurable rules engine to calculate trust/risk scores and detect fraud, account takeover, insider threats, and abuse patterns.
Differentiator
Problem solved
Functional benefit
Products and services
- tirreno Community Edition Free open-source security platform for event tracking, behavioral analysis, rule-based risk scoring, dashboard monitoring, review queue, and blacklist management. Targeted at developers and product teams integrating fraud prevention and abuse detection directly into their own products.
- tirreno Enterprise Edition Paid proprietary licensed version of the tirreno security framework for mission-critical organizations requiring multi-application support, advanced fraud prevention capabilities, SIEM integration, and dedicated developer support beyond the open-source Community Edition.
- tirreno IP Enrichment API Standalone API providing IP geolocation, ISP identification, and threat intelligence including datacenter range identification, TOR exit node detection, commercial VPN classification, and abuse list lookups. Used to enrich security event data and improve risk scoring accuracy.
- tirreno PHP Tracker Official PHP SDK for instrumenting PHP-based applications to send security events (logins, registrations, page views, field edits) to tirreno for analysis and risk scoring.
- tirreno Python Tracker Official Python SDK for instrumenting Python-based applications and backend services to send security events to tirreno for analysis and risk scoring.
- tirreno Node.js Tracker Official Node.js SDK for instrumenting Node.js applications and APIs to send security events to tirreno for analysis and risk scoring.
Quantifiable outcome
- 2,000 free API requests/month for IP enrichment evaluation
- +1 more outcomes
Companies that use tirreno
Customer profileSegments8 records
Ideal customer profiles3 records
tirreno technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Integration1 record
AI capability4 records
Feature7 records
tirreno partnerships and signals
Strategic signalPartnerships
Three partnerships are on record, tiered minor.
- PaddleminorPaddle.com Market Limited serves as Tirreno's Merchant of Record for processing website purchases. Handles order processing and customer service inquiries for paid subscriptions purchased through the website.
- InnovaudminorInnovaud is mentioned as a partner/organization that has worked with tirreno. Also mentioned alongside Swiss Data Science Center.
- Swiss Data Science CenterminorSwiss Data Science Center is mentioned as an organization associated with tirreno in the context of the tirreno live demo.
Scale indicators3 records
Recent moves6 records
Expansion highlights5 records
tirreno competitors and assessment
Company assessmentDirect peers
- SEON: SEON offers fraud detection combining digital footprint analysis (email, phone, IP, device) with rule-based risk scoring. It is comparable to tirreno's footprint analysis capability and risk-score output.
- Fingerprint: Fingerprint offers device intelligence and visitor identification APIs used for fraud prevention, account takeover and bot detection. It is comparable to tirreno's device fingerprinting and IP/device signal fusion inside the risk-scoring engine.
- Castle: Castle provides account takeover, fraud and abuse prevention via lightweight event-tracking APIs and a risk-scoring dashboard. It is the closest direct competitor to tirreno's self-hosted / SDK-integrated behavioral analytics model.
Broad incumbents
- Sift: Sift is a large, established fraud-detection platform serving digital businesses with ML-based risk scoring across account takeover, payment fraud and content abuse. It addresses the same buyer problems as tirreno but as a broad, multi-product SaaS incumbent.
- MaxMind: MaxMind is the long-standing incumbent in IP geolocation and network intelligence (GeoIP), widely used as a building block in fraud and risk engines. It is the de facto upstream data source tirreno's IP enrichment layer competes against or complements.
- Arkose Labs: Arkose Labs is a scaled bot management and account abuse prevention vendor with a long enterprise customer list. It overlaps with tirreno's bot_detection and account_takeover use cases as part of a broader anti-abuse portfolio.
- HUMAN Security: HUMAN Security (formerly White Ops / PerimeterX) is a major bot management and account abuse vendor protecting applications, APIs and digital advertising. It addresses the same fraud and abuse use cases as tirreno at much greater scale.
- DataDome: DataDome provides bot and online fraud protection as a SaaS service, with API, mobile and web protection layers. It targets the same API abuse and credential stuffing problems tirreno addresses, but as a managed cloud service.
Emerging players
- IPQualityScore: IPQualityScore provides IP reputation, proxy/VPN/TOR detection, email and phone validation APIs used to enrich fraud and risk engines. It is a partial functional overlap with tirreno's IP Enrichment API add-on.
- Sumsub: Sumsub provides identity verification, KYC/AML and fraud prevention, including behavioral analytics for ongoing user risk. It overlaps with tirreno's risk-scoring and behavioral monitoring in the financial services and platform abuse segments.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat4 records
Key risks7 records
Key highlights7 records
Customer concentration
tirreno social profiles
Digital presencetirreno financial estimates
Financial estimateRevenue estimate
Valuation estimate
tirreno leadership team
Management profileNumber of profiles
Profiles1 record
tirreno funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
tirreno M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about tirreno
What does tirreno do?
tirreno provides an open-source, self-hosted security framework that ingests user events (logins, registrations, page views, field edits) through official SDKs and a sensor API, processes them via a configurable rule engine with 109 built-in detection rules, and produces trust/risk scores used to detect account takeover, credential stuffing, fraud, insider threats, and API abuse. It is distributed as a free AGPL-3.0 Community Edition on GitHub and Docker Hub, with a paid Enterprise Edition that adds multi-application support, SIEM integration, and developer support for mission-critical organizations.
Is tirreno a public or private company?
tirreno is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was tirreno founded?
tirreno was founded in 2024. It employs 1 to 10 people.
Where is tirreno based?
tirreno is headquartered in Prilly, Switzerland, in the Europe region.
How does tirreno make money?
Three revenue lines are on record. Community Edition is the primary driver. The others are enterprise Edition and IP Enrichment API.
Who are tirreno's main competitors?
Direct peers on record are SEON, Fingerprint and Castle. Broad incumbents are Sift, MaxMind, Arkose Labs, HUMAN Security and DataDome. Emerging players are IPQualityScore and Sumsub.
Does tirreno have an API?
Yes. tirreno provides a sensor API (POST /sensor/) for event ingestion using form-urlencoded format with Api-Key authentication. It also provides a Blacklist API (POST /api/v1/blacklist/search) for checking if users or IPs are blacklisted. The API supports sending user events including login attempts, registrations, page views, field edits, and more. Official tracker libraries are available for PHP (composer require tirreno/tirreno-tracker), Python (pip install tirreno_tracker), and Node.js (npm install @tirreno/tirreno-tracker). The IP Enrichment API is available as an optional add-on with 2,000 free API requests per month in the Community Edition. Developer documentation is at docs.tirreno.com.
What industry is tirreno in?
tirreno's product category is Security Analytics Software. Its primary akta.pro industry code is HDADACAD, Software Supply Chain & Dependency Security (SBOM, Signing). Its NAICS code is 541519 and its SIC code is 7371.