GrayPass
GrayPass provides continuous identity assurance by analyzing real-time interaction rhythms—pointer movement, click timing, and keystroke intervals—to verify that the authenticated user remains in control before sensitive actions execute. It integrates with existing identity providers, passkeys, and MFA, combining device, session, and transaction context with customizable policies to produce action-bound proofs that applications enforce as allow, verify again, hold, or deny. Pricing starts at $500/month.
- Cybersecurity
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
Traditional authentication verifies identity only at login, leaving a gap where an unauthorized person could take over an active session and perform sensitive actions. Applications lack a way to confirm that the expected user is still in control at the moment a high-stakes transaction executes.
Solution
GrayPass adds continuous identity assurance by analyzing real-time interaction rhythms—such as pointer movement, click timing, and keystroke intervals—to verify that the authenticated user remains in control before a sensitive action executes. It integrates with existing identity providers, passkeys, and MFA, combines device, session, and transaction context, and applies customizable policies to produce an action-bound proof that applications can enforce as allow, verify again, hold, or deny. The system does not capture typed content, only timing patterns, preserving privacy while assessing behavioral continuity.
Target Audience
Primary customers are product teams and enterprises that need to protect sensitive actions—such as financial transfers, data changes, or admin operations—by verifying that the right person is still in control beyond initial login.
Features
- Real-time analysis of pointer movement, click timing, and keystroke intervals to establish interaction rhythm
- Integration with existing identity providers, passkeys, and MFA to build on current authentication foundations
- Contextual evidence from device, session, and transaction data to describe where requests originate and what they would change
- Customizable policy engine that weighs evidence against rules for each requested action
- Action-bound proof tied to the exact action the application is about to execute
- Enforcement decisions: allow, verify again, hold, or deny