Every SMS code a company sends is a line item. We replace it with a yes.
A code proves someone holds a phone number. A BotShield token proves a real person is here and said yes to this act, on the phone they already own, and nothing identifying travels with it. Companies pay per check, on a budget they already have. People pay nothing. BotShield systems never learn who anyone is, and we sell to neither side of the check.
FIDO Alliance member · every product stands on a passkeyPaid per connection. Owner of neither line.
A company requests a token where it used to send a code. We connect the question to the person and hand back a signed yes. We bill the connection, never the outcome, and we never hear the call: a different identifier on every line, a signed fact in place of the conversation.
A check.
A gate passed, an action signed, an ask answered: a real person, on their own phone, at the act. Companies pay per check, on a plan. People pay nothing.
A budget that already exists.
Every SMS code a company sends is paid for, per message, forever. A BotShield token takes the same line item and proves more: a person, not a phone number.
Linked once, answering everywhere.
A person links once and every company on the rail can ask. Each one that joins is a reason for the next, and the meter runs on the asks.
Rights management, pointed the other way.
Rights management locks a file to a device and treats the person as the threat. We bind the act to a person, so a seat cannot be lent and a claim cannot be faked — with nothing to install and nothing for a customer to resent.
No scarce compute.
A check is a push and a signature. Nothing we sell waits on a GPU, so the cost of a check does not rise with the market for compute, and the margin holds as the volume grows.
Built, live, filed.
What exists today, in code and on the record.
Live.
Public beta on the web and Google Play. App Store pending.
Built.
One gate, placed on a page or sent to one person. Age is an attribute, never a second gate.
Built.
One act, signed in place with the passkey. The proof binds the exact action.
Built.
Open BotShield behind a partner’s sign-in; the registry in the Console.
Built.
Five MCP tools, hosted at mcp.botshield.ai. An agent proposes; a person answers.
Built.
A key and a scope per agent, registered in the Console. Revoke the key and every link dies.
Tenant #1.
A social marketplace for the arts on the same rails, ours, launching soon.
Member.
Since September 2026. Four marks filed.
Four dated facts. No forecasts.
Public records and public disclosures. No company is named in the body.
Agents reached a federal site on their own.
A lab’s agents used login credentials found online to reach a federal site, working on their own. It paused training and said so. The site could not have told.
Public disclosure →Agents now act with the person’s own credentials.
Two of the largest runtimes shipped agents that act across Stripe, Shopify and QuickBooks with the person’s own credentials. Every one of those acts now needs a yes the other side can check.
The launch posts →19 actions outside their parameters, on the live internet.
In 10 of 122 evaluation runs, agents took 19 distinct actions outside their parameters on the live internet. Nothing on the receiving end could tell.
UK AISI · incident report →$20.9 billion in reported losses.
AI-related complaints up 1,210% in a year. Account takeover alone, $360 million. The FBI says the AI share is undercounted, because victims cannot tell.
IC3.gov · 2025 annual report →We keep only what a person gave us to make a link work. It goes only where they sent it, and they’re told who’s asking before they tap. We sell to neither side of the check, and we’re binding that limit into a trust so no owner, including us, can move it later. In progress.
Ten months, three people, bootstrapped.
Devrin Harris.
Ten years inside Apple on the front line of customer account security, including the two-factor rollout at global scale. BotShield is the answer he wished he could give them.
Ten months. Three people. No outside capital.
The idea crystallised in November 2025. Since then: the app, the console, the engine, the five MCP tools, four marks, a FIDO membership, and a marketplace running on the rails.
Verify a human. Collect almost nothing.
The time went into those two questions before anything was sold. They are answered and built. Putting it in front of companies is what this round funds.
Seed, with the product already live.
Seed.
Sized for launch and runway.
Clean.
No institutional capital. No outside board.
Four.
Live marks, filed.
Shipped.
Live on the web. Take the keys.
What it buys.
Three motions, because the price decides the motion.
Self-serve on the console; sales-assisted with an engineer behind the integration; enterprise, founder-led. Nothing printed that is not staffed.
SOC 2, the audits, the pen tests.
The enterprise sale is gated on it, and a company putting a gate in front of its customers is right to ask. The round pays for the audit, the pen tests and the person who owns them.
The app in front of people.
People link once and answer everywhere; the rail grows with the people on it. The round buys the campaigns that put the app in front of them, and BotShield in front of the companies they use.
A home in Denver.
A place to hire into, to bring a partner to, and to run the company from. Money for the office, not the furniture.
Couchtour, the App Store, the first paid gates.
The tenant we own goes live on the rails; the app lands on both stores; the first companies verify their accounts and place a gate.
Enough to get there.
The round is sized to the plan, not to a headline. The terms follow a conversation.
Investors FAQ
What does BotShield sell, and who pays?
Is the product live, or a prototype?
Who are the customers?
What replaces the SMS code, exactly?
What does BotShield store?
How do I get the deck or the data room?
Open the app first. Then let’s talk.
The product is live today. The deck and the data room follow the call.
BotShield runs in your browser.
Sign in with Apple or Google, add a passkey, and approve what your agents ask — the same account the phone app will use.
Open app.botshield.ai →