Trust

Prohibited uses

These restrictions are contractual, not aspirational. They are enforced in the product where enforcement is possible, and they are grounds for termination where it is not.

GrayPass may not be used for

1. Employee or contractor surveillance. No productivity measurement, no activity scoring, no attention monitoring, no engagement metrics, no ranking of people. The workforce-analytics product that previously existed in this codebase has been removed; the workforce_analytics capability is marked retired.
2. Universal or cross-site tracking. Subject identifiers are tenant-scoped and environment-scoped keyed hashes. The same person in two tenants has two unrelated identifiers, and there is no product surface that joins them. Do not attempt to correlate GrayPass identifiers across customers, products, or sites.
3. Inferring protected or unrelated traits. Health conditions, disability, neurological status, age, gender, ethnicity, pregnancy, emotional state, sexual orientation, religion, or political affiliation. GrayPass does not produce these and you may not attempt to derive them.
4. Covert monitoring of end users. Your users must be told that behavioral evidence is collected for authorization at consequential actions, in your own privacy disclosure. Silent deployment is prohibited.
5. Automated adverse decisions about a person's rights or livelihood without human review. A GrayPass decision is evidence about control of a session, and nothing else. It is not a basis for hiring, firing, discipline, credit, insurance, housing, education, immigration, or law enforcement outcomes.
6. Use as the sole authentication factor. GrayPass is additive. Do not remove your existing login, MFA, or fraud controls and rely on GrayPass alone.
7. Use as identity verification. GrayPass does not establish who a person is. See enrollment.md.
8. Population-level behavioral research on unconsenting users. Research participation requires an explicit, per-subject consent record plus environment-level participation. Both are off by default.
9. Re-identification attempts. Do not try to reverse a subject identifier, a template, or an assurance digest to a person outside your own system.

What the product does to enforce this

• Subject identifiers are per-environment keyed hashes (HMAC with a deployment pepper), so they are not portable.
• There is no API that returns a raw embedding, a similarity score, a ranking, or an aggregate across subjects for analytics purposes.
• There is no productivity, attention, or engagement metric anywhere in the API or the console.
• Research donation of evidence requires an environment flag and a per-subject consent record; a request without both is rejected with error.context_invalid.
• Deletion is real: templates, sessions, and subject metadata are removed and outstanding proofs are revoked.

Reporting

If you believe GrayPass is being used in a prohibited way, including by us, write to tools@graypass.org. We will investigate and publish material findings that affect customers.

Generated from the API contract in contracts/ and the source in docs/. The build fails if this page disagrees with the running API.