Feroot Security

Feroot started in 2017 as a privacy and compliance company — Tsarynny told the TechTO audience in 2018 that it launched the year before, when 'very few people knew how to spell GDPR,' and built its early credibility by hosting small, tightly targeted conferences for chief privacy officers rather than blogging. The company ran out of money in 2020 and repositioned into security. What brought it back, Tsarynny said on the TechTO stage in February 2026, was narrowing to one problem: hackers stealing credit card details out of websites. That focus, plus a couple of first customers, got Feroot into Y Combinator on its third application, after two rejections. The product now inspects what runs in the browser on the front end of a site — the scripts, trackers and forms that touch payment and personal data — and turns that into audit-ready evidence for PCI DSS 4.0.1, HIPAA, GDPR, CCPA and other regimes. Feroot's research team is also known outside the security trade press: in early 2025 it found heavily obfuscated code on DeepSeek's login page linking to infrastructure run by China Mobile, a Chinese state-owned telecom barred from operating in the US. The Associated Press reported the finding first and academic researchers at the University of Calgary and UC Berkeley confirmed the link. Tsarynny testified before the US-China Economic and Security Review Commission on data collection by China's tech sector.