GrayPass

Applications authenticate a person at session entry, but sensitive actions like changing a payout account often happen later in the same session, after time has passed and the evidence behind that login has aged. Identity providers, passkeys, and MFA establish who entered, but they do not confirm that the same person is still in control when a consequential action is requested. Without a check at the moment of action, applications must either trust a stale session or force repeated re-authentication. This leaves a gap between proving who logged in and knowing who is acting right now.

GrayPass adds a check at the point a sensitive action is about to execute, evaluating device, session, and transaction context alongside a Brainprint, a privacy-preserving model of how a person interacts with software based on pointer movement, click timing, keystroke gaps, and scrolling patterns. It does not replace existing identity infrastructure; it works alongside the customer's identity provider, passkeys, and MFA. GrayPass weighs this evidence against the customer's policy and returns a decision, allow, verify again, hold, or deny, that the application enforces. For allowed actions in enforce mode, it returns short-lived signed proof bound to that specific action and application. Brainprints are tenant-scoped, can be deleted when a customer deletes the subject, and capture only interaction timing, not typed content or its meaning.