Supported use and customer responsibilities

Use GrayPass for transparent, proportionate assurance at consequential application actions. Keep collection, policy, and review focused on the session and the bound request. The applicable agreement defines use restrictions and contractual remedies.

Surveillance and unrelated profiling

Behavioral evidence is collected for application security. Employee productivity scoring, attention monitoring, engagement rankings, disciplinary surveillance, sensitive-trait inference, and unrelated profiling are prohibited uses.

Keep identifiers within the authorized application context. Cross-site or cross-customer tracking, population identity matching, and re-identification outside that context are prohibited.

Covert collection

Explain the security purpose, evidence categories, and actions covered before collection. Provide an explicit choice and browser permission for camera collection. Offer research participation through its separate consent flow.

Covert collection and pressuring users into unrelated data collection are prohibited. Preserve the ordinary non-camera workflow when users decline camera access.

Inappropriate decision authority

Maintain your application's authentication, identity verification where applicable, and account permissions. Use GrayPass session and action evidence within those controls. Sole-factor authentication and identity-proofing uses are outside the supported integration model.

Employment, credit, insurance, housing, education, immigration, law-enforcement, and other rights or livelihood decisions require their own appropriate evidence and human review. GrayPass session assurance supplies no evidence of eligibility for those decisions. Automated adverse decisions based on it without appropriate human review are prohibited.

Report coverage, signed decisions, and evaluation results according to the property they measure. Attribute results to the tested population, workflow, and conditions.

Research and data handling

Obtain consent before behavioral research. Research retention requires deployment and environment enablement, a current subject consent receipt, and per-frame opt-in. Follow the research choices procedure for grant, withdrawal, and deletion.

Use opaque identifiers and narrowly selected action context. Keep passwords, payment-card data, identity documents, and unrelated sensitive records out of metadata and context. Cross-context template reconstruction and matching are prohibited.

Product safeguards

GrayPass scopes subjects to tenants and environments, returns template-presence metadata in exports, separates research consent from ordinary processing, and scopes browser tokens to evidence and ceremony operations. Your access controls, disclosures, and review procedures complete the integration's governance.

Reporting concerns

Contact founders@graypass.org for guidance on a proposed use, misuse reports, or a private vulnerability report. Start with a description and synthetic example; use the agreed secure process for any required personal records.