GrayPass checks who is still in control after login

GrayPass wants applications to ask a second identity question at the moment it matters: who is actually controlling this session now? Its software checks the evidence before an account exports customer data, moves money or changes administrative permissions, even if the person using it has already signed in successfully.

The distinction is practical. A valid login establishes that someone passed a check earlier. It doesn't, by itself, explain whether the same person still controls the session or whether an agent has permission to carry out the next request. GrayPass adds an assessment at the action itself, while leaving the customer's existing authentication system in place.

The startup, part of Y Combinator's Fall 2026 batch, says it has processed more than 900,000 sessions across customer applications and generated $50,000 in revenue so far in October. Those figures come from its launch announcement; it doesn't provide a customer count or an independent assessment of detection accuracy.

Its system combines device and session information with interaction patterns such as the timing of keystrokes, pointer movement and scrolling. On its website, GrayPass describes these patterns as a “Brainprint.” The company says it measures timing rather than recording the content people type.

That evidence is evaluated against rules set by the application owner. GrayPass can recommend allowing the action, asking for another verification step, holding it or denying it. The application remains responsible for enforcing the result. That division makes the integration point fairly specific: the check sits before a consequential operation, rather than replacing every login or deciding what the application should permit on its own.

Watch the original launch demonstration.

For an allowed action, the company's public YC profile describes short-lived, signed proof tied to the specific operation and application. Binding a result to one action is a different proposition from treating an authenticated session as a continuing blanket authorization. A decision about one export, for example, need not become permission for every subsequent change to the account.

Arav Mathur and Aditya Ranjan founded the company. Their public profiles describe complementary backgrounds: Mathur studied computer science at Waterloo and worked as a growth engineer at Stan, while Ranjan studied neuroscience at McGill and conducted research at SickKids. The product brings behavioral signals into an application-security workflow, but those biographies aren't evidence that any particular detection claim has been validated.

GrayPass also frames agents as part of the problem it wants to address. Recognizing that software is acting inside a session and establishing its authority are separate questions. Its public material makes that distinction explicit, rather than treating every nonhuman action as inherently unauthorized.

For teams evaluating the product, the consequential details are likely to be how it handles ambiguous evidence and how often legitimate users face extra checks. The announcement supplies adoption figures, but no false-positive benchmark. The first deployment decision is therefore narrower than securing an entire application: choose the sensitive action, define the policy and decide what should happen when the evidence isn't strong enough.