GrayPass

Not yet independently verified. GrayPass's figures of more than 900,000 sessions and $50,000 revenue in October are the company's own, from its YC launch page; we have found no independent source for them or for how accurate its behavioural signals are. We will update this when it can be confirmed, and remove this note.

Most account takeovers and insider misuse happen after a successful login, when a stolen session or a borrowed laptop is already past multi-factor authentication. GrayPass, founded in Toronto, puts its check at the point of the dangerous action instead of at the front door.

A decision before each sensitive action

When a user is about to export data, change administrator permissions, move money or let an AI agent act on their behalf, the application asks GrayPass. It combines identity, device and session context with behavioural signals from the session itself, such as typing rhythm, pointer movement and scrolling, and runs them against the customer's own policy. The answer is one of four: allow, verify again, hold for review or deny. The application enforces the result, and an allowed action receives a short-lived signed proof that later steps can check.

GrayPass sits alongside an existing login and MFA stack rather than replacing it. Integration is through a browser SDK, a Node SDK and webhooks.

Behavioural data and privacy

Because it reads how a person types and moves a pointer, the product falls under biometric privacy rules in some places, and its site links pages on Illinois' Biometric Information Privacy Act and the GDPR. Buyers in those jurisdictions will want those terms in the contract. The company says it has processed more than 900,000 sessions and earned $50,000 in revenue so far in October.

The founders are Arav Mathur, the chief executive, a University of Waterloo computer science graduate who was the growth engineer at Stan, and Aditya Ranjan, the chief operating officer, who studied neuroscience at McGill.

Key facts

Maker: GrayPass, Toronto, Canada Launched: 29 October 2026 on Y Combinator's launch board (Fall 2026 batch) Integration: browser SDK, Node SDK, webhooks Pricing: not published; evaluations by request, open until 30 November 2026 per its site Website: graypass.com