Data Privacy
This document traces behavioral data through the GrayPass platform stage by stage: what the SDK reads, what never leaves the device, what a Brainprint template is, and how revocation and deletion work.
Contents and legal documents
The design rule
GrayPass minimizes what leaves the endpoint, scopes stored records to one customer environment, and separates evidence from the action a customer enforces. Privacy requirements shape the pipeline rather than sitting beside it.
This document explains, in plain language, exactly what data exists at each stage, where it lives, and what control you have over it. The Privacy Policy governs; this document adds product-level precision.
What the SDK reads
With consent, the SDK observes a small set of timing channels while a person uses an application:
- Pointer and touch dynamics: the velocity, curvature, and pause structure of movement, as timings and geometry, never screen contents.
- Keystroke dwell and flight: how long each key is held and the interval to the next. The keys themselves are never read; there is no code path that receives the character, only the clock.
- Scroll and focus rhythm: scroll cadence, visibility durations, tab-switch counts, and time to first action, never other tabs or applications.
These are derived timing and kinematic statistics. The SDK does not receive characters, page content, clipboard values, audio, video, or screen contents.
What never leaves the device
The raw timing stream is processed in the browser, in session. It is reduced to derived features on the device, and the raw series is discarded. The raw behavioral stream is not transmitted, not logged, and not recoverable after the session ends.
The Brainprint template
Derived features contribute to an encrypted Brainprint template scoped to one tenant and environment. The template supports continuity assessment with the enrolled subject. It does not establish legal identity, personhood, or device integrity.
- Subject identifiers use a keyed hash per tenant and environment. The same customer identifier produces unrelated subject identifiers elsewhere.
- The template is never returned in a subject export. The export states whether one exists.
- Customers can revoke or delete a subject. Revocation stops use and invalidates outstanding proofs; deletion removes the template and live subject state.
Stored versus never stored
Stored, encrypted at rest
- The Brainprint template and stored request material needed for an action-bound challenge.
- Assurance Profiles and decision traces: action key, resource and context digests, policy version, reason codes, and timing.
- Proof records and operational logs with peppered fingerprints instead of identifiers.
Never stored, by construction
- Raw behavioral streams.
- Typed content, of any kind, ever.
- Static biometric identifiers: no photographs, no face geometry, no fingerprints, no voiceprints.
- A universal behavioral identifier. Templates are tenant-scoped and cannot be matched across customers.
Revocation and deletion
Customers can revoke or delete a subject through the canonical API or console. Revocation immediately stops the Brainprint being used and revokes outstanding proofs.
Deletion removes the template, terminates live sessions, and clears subject metadata. Direct erasure requests sent to tools@graypass.org are handled with the customer controller where applicable. Customer environments and their data are deleted within thirty (30) days after termination.
Research data
Research donation is off by default at both the environment and subject level. It requires separate consent, uses pseudonymized encrypted artifacts held apart from production, and stops immediately when consent is withdrawn.
Sub-processors and hosting
Amazon Web Services provides hosting, database, key management, and transactional email. Twilio processes SMS step-up verification only when a customer enables it. No advertising or data-broker processor is used.