GrayPass

GrayPass is a decision layer that checks whether the expected person is still in control of a session before a sensitive action executes. It addresses the gap between login and the moment a consequential action, such as a payout change, actually happens, when the original authentication check may no longer reflect who is acting. GrayPass combines identity, device, session, and transaction context with Brainprint, a privacy-preserving, tenant-scoped representation of interaction patterns derived from typing timing, pointer movement and clicks, and scrolling, then evaluates that evidence against your policy.

The platform returns one of four enforceable decisions with reason codes: allow, verify again, hold, or deny. Your application registers the actions that carry consequence, and your server requests authorization before execution; for allowed actions in enforce mode, GrayPass returns short-lived signed proof bound to that action. A browser SDK derives timing and movement features without capturing typed characters or key codes. Brainprints are customer-scoped, revocable, and deletable, and continuity evidence alone does not establish identity, intent, or permission. The core decision API is in beta, with continuity signals remaining experimental for sandbox and shadow evaluation; registered actions start in shadow mode so production behavior is unchanged.

GrayPass is intended for teams that already operate an identity provider, passkeys, or MFA and want fresh assurance at the point of a protected action without replacing that stack. Evaluation begins through a Request Evaluation form describing your company, the action to protect, and your current stack, starting with a single workflow before changing production behavior. No pricing, plan, or trial details are stated.