New startup ideas · B2B, security and compliance · Security and compliance
startup idea
Humanrail
A licensed personhood and KYC API any small merchant can turn on in an afternoon.
Humanrail is an API that answers two questions for small online businesses: is this a real, unique human, and does this customer clear the anti-money-laundering checks the merchant is legally on the hook for.
- Infrastructure and APIs
- Small business
- $100B+ market
- Collapses a cost 10x
- Global from day one
4/5
venture judge
2
similar startups, last 2 years (13 all-time)
83%
of 4 nearest real companies still alive
yes
3 matching federal grants and programs
Direction supported by government programs and grants
Test it before you build it
$1,000 · 3 weeks · 25 prospects
Prove in 3 weeks and for $1,000 that small merchants legally on the hook for KYC and AML will prepay $300 for a licence-carrying provider at $0.60 a check.
Riskiest assumption · A small-merchant founder doing a few thousand verifications a month will move money now to hand their KYC and AML obligation to a provider that carries the licence and the liability, instead of staying on Stripe Identity or Persona or continuing to ignore the obligation.
1Focus group: who and where
Founder or the single ops person at a 2-10 person US marketplace or fintech reseller doing 1,000-5,000 identity verifications a month, currently paying per-check to Persona or Stripe Identity or hand-reviewing signups, and personally exposed on AML because they touch seller payouts.
where to find 25 · The Everything Marketplaces community, where marketplace founders compare verification vendors (community); Y Combinator's public Startup Directory filtered to marketplace and fintech companies from the last four batches (list); Google Search ads on 'KYC API pricing' and 'identity verification API cost' plus Indie Hackers threads on verification vendors (channel).
2Sell first, build later
A founding pack of 5,000 verifications: injection-resistant liveness plus ID check plus AML screening in one call, ambiguous cases human-reviewed within 24 hours, with Humanrail as the registered provider carrying the obligated-entity duty; live for founding customers in Q1 2027.
the ask · $0.60 per check locked for 12 months ($0.95 list), sold as a 5,000-check founding pack reserved with a $300 deposit.
a real yes · A real yes is the $300 deposit cleared through checkout. Email signups, 'we would definitely switch', and requests for a free sandbox do not count.
3Small experiments
The first one attacks the riskiest assumption; each ends with a number that says whether to run the next.
1. Compliance burden calls
$300 · 10 days
Book 15 twenty-minute calls with founders sourced from Everything Marketplaces posts and cold email to the YC directory list. On each call get three numbers: current cost per check, size of the un-reviewed ambiguous-case backlog, and what they believe an AML exam of their platform would find; then ask whether a provider that carries the registrations and the liability changes their vendor choice.
keep going if · 9 of 15 pay more than $1.00 per check today or admit an un-reviewed backlog, AND say liability transfer, not price alone, would make them switch
2. Founding credit checkout
$150 · 7 days
Put up a one-page site with published pricing and no sales call: $0.60 per check with AML screening and 24-hour human review of ambiguous cases, Humanrail named as the registered provider. Behind the buy button sits a $300 refundable founding deposit reserving 5,000 checks; send the link to all 25 named prospects the day it is live.
keep going if · 6 of 25 named prospects pay the $300 deposit
3. Cold search traffic test
$550 · 10 days
Spend $550 on Google Search ads against 'KYC API pricing', 'identity verification API cost' and 'AML check API', pointing at the same priced page, aiming at roughly 400 visits from merchants you have never spoken to. This tests whether the self-serve, no-sales-call motion the card depends on works on strangers.
keep going if · At least 12 of roughly 400 cold visitors start checkout and at least 1 completes the $300 deposit
4Collect a deposit up front
Tesla took $1,000 refundable reservations for the Model 3 and $100 for the Cybertruck before building either: the deposit is the measurement, not the revenue.
$300
per prospect, refundable
how · A refundable founding-credit reservation taken at self-serve checkout, because this card's entire thesis is published pricing with no sales call, so the deposit must move through the same motion the product will; the founder clicks buy and pays by card, nobody signs anything beyond the checkout terms. set up: Stripe Checkout ↗
what it reserves · 5,000 checks at $0.60 each locked for 12 months and a slot in the Q1 2027 founding cohort with direct access to the review team.
refund · Fully refundable any time before the first live check, and refunded automatically if the licensed rail is not live by March 31, 2027.
target · 6 deposits from 25 named prospects within 21 days
before taking money · Do not run a single real verification, store an ID document, or advertise AML coverage as operational before counsel confirms the registrations; until then collect only refundable reservations and route nothing regulated through the product.
Go: build it if
6 of 25 prospects pay the $300 deposit within 3 weeks and at least 1 cold-traffic stranger completes checkout: both the pain and the self-serve motion are real.
Kill: stop if
Fewer than 2 deposits from 25 prospects, or fewer than 5 of 15 calls show any current per-check spend: this buyer either does not feel the obligation or will not pay to move it, and the licence is not rentable to the long tail regardless of what regulators eventually allow.
5 Scripts to run itoutreach message, landing copy, deposit terms · click to open
outreach message
You're running a marketplace doing a few thousand signups a month, which means every new seller is a check you pay Persona or Stripe for and an AML obligation that still sits on you personally. I'm building Humanrail: one API at $0.60 a check where we hold the registrations and the liability, with ambiguous cases human-reviewed in 24 hours. Founding customers lock that price for a year with a $300 refundable deposit. Got 20 minutes this week for me to walk through your current check flow?
landing page
KYC and AML checks where we carry the licence, not you $0.60 per check with AML screening and 24-hour human review, reserved by a $300 refundable deposit for 5,000 founding checks Reserve your founding credits
deposit terms
$300 reserves 5,000 verification checks at $0.60 each, locked for 12 months, with first access when the licensed rail goes live in Q1 2027. It is fully refundable any time before your first live check, no questions asked. If we are not live by March 31, 2027, your refund is automatic.
Would you run this test?
One tap. The yes-share feeds the Demand pillar of this idea's score; nobody sees who answered.
Budgets are out-of-pocket estimates for a team of one to three, US market. Size the deposit to the deal, and check the terms before taking money in a regulated line.
Scorecard
One score that balances how trendy the idea is, the demand for it and its potential for 100x, with competition measured relative to every other idea in the catalog. Recent startup trends first, government priorities second.
100
Idea Score, 0-100 · raw 62.8 x 1.61
Warm
competition: more crowded than 32% of ideas · headwind x0.84
+1.5
government priorities, secondary (3 matching grants)
Trend
81
Is the wave forming now? 2025-26 entrants vs 2023-24, rounds since 2025, the sector's live-batch direction, the 2026 trend analyst.
- Entrants 2025-26 vs 2023-24 (similar companies)90
- Rounds announced 2025+ in the sector60
- Sector direction (live batch)100
- 2026 trend analyst75
Demand
78
Does anyone want it? YC's current RFS, companies already paid for something similar, the operator judge, founders' yes-rate in decks, readers who would run the test.
- YC asks for it (current RFS: idea / sector)60
- Someone already pays (similar companies, recent / all-time)100
- Operator judge: real pain75
100x potential
61
Can it return a fund? The venture judge (double weight), market-size and moat axes, neighbours still alive, the technologist judge.
- Venture judge75
- Market size axis100
- Moat axis80
- Neighbours still alive12
- Technologist judge25
Score = 100 x cbrt(Trend x Demand x 100x) x (1 - 0.5 x crowding) + government bonus (max 5), calibrated so the 95th-percentile idea scores 90 (order never changes). A geometric mean: a weak pillar cannot be papered over. Percentiles are among the 272 ideas in the catalog; the terms matched were licensed, personhood, kyc, merchant, answers, questions, online.
The idea in full
- What
- Humanrail is an API that answers two questions for small online businesses: is this a real, unique human, and does this customer clear the anti-money-laundering checks the merchant is legally on the hook for. Humanrail holds the certifications and registrations itself, acting as the regulated verification provider so the merchant does not need its own compliance function, and escalates the small fraction of ambiguous cases to a review team. Self-serve signup, published per-check pricing, no sales call.
- Why now
- The YC Fall 2026 Requests for Startups list both Proving You're Human and AI-Native Compliance Infrastructure for this cluster, and Didit (yc W26) and Incandor (yc X26) are building identity, fraud and behavioural infrastructure right now. Scorce died in 2022 selling exactly this as unlicensed API tooling for compliance and digital onboarding, which is the part that has changed: the certification regimes small merchants can rent now exist.
- Wedge: first customer and entry point
- Solo and small-team marketplaces and fintech resellers doing a few thousand verifications a month, entering with injection-resistant liveness at a flat per-check price they can read off the pricing page.
- Path to 100x
- Global identity verification, onboarding and AML compliance spend sits above $100B and is priced today around human review and enterprise contracts that exclude small merchants entirely; on-device liveness plus agentic case review takes the fully loaded cost per verified human down about tenfold and opens the long tail. Certifications take years and audits to obtain, so the first credible self-serve licensed provider becomes the default rail that every small merchant and every platform reselling to them plugs into.
- Ceiling
- Per-check prices collapse toward commodity as model costs fall, leaving a high-volume, thin-margin utility rather than a $1B outcome.
- Closest real companies, as the generator saw them
- Didit sells identity and fraud infrastructure and Incandor sells behavioural anti-fraud signals, both as technology; Humanrail differs by carrying the licence and the regulatory liability itself, which is what a small merchant cannot build. Regbase automates corporate compliance filings rather than end-user verification. Scorce shows the unlicensed version of this does not survive.
- Main risk
- Regulators refuse to let a small merchant outsource its own obligated-entity duties, and the licence stops being rentable.
Five judges
Each judge scores every idea in the catalog with a named rubric; the venture judge decides whether a card is shown at all (4-5 is venture-grade).
Venture investor
4/5
Holding the licence itself on a $100B+ AML and identity spend is rentable defensibility, though per-check price collapse threatens margin.
Bootstrapper
2/5
Carrying the licence and obligated-entity liability yourself means years of audits, and per-check prices commoditise anyway.
Operator
4/5
AML checks are a legal obligation small merchants already pay per verification for, and self-serve pricing needs no workflow change to adopt.
Technologist
2/5
Liveness models are commodity and the durable asset is a rented licence, which is a regulatory position rather than a technical one.
Risk
5/5
Holding the certifications and regulatory liability itself is the moat, spread across self-serve long-tail merchants with no key customer or platform dependency.
trends
4/5
Hits two named Fall 2026 RFS themes, Proving You're Human and AI-Native Compliance Infrastructure, with a licensed rail the agent era newly demands.
Similar startups in the directory
Companies whose pitch matches most of the idea's terms (licensed, personhood, kyc, merchant, answers, questions, online): 13 all-time, 2 from the last two years. Same matching as Idea Check.
AI Infrastructure for insurance brokerages.
Secure frontier AI for government & adjacent knowledge work
Offers insurance to customers in a convenient & transparent way
Async personalized and actionable health education by real doctors
A competitive community of the brightest students in the world
Convert more verified users. Instantly & accurately validate user IDs.
Developer of an online middleware software designed to integrate and aggregate data from social platforms all in one place. The company's software gathers all the data from a range of social and business platforms together within a single access point and makes it simple to view and access marketing data in real time, enabling marketers and businesses to make informed decisions in an efficient manner.
Whale is an online question and answer (Q&A) community that connects users with influencers, experts, and celebrities.
From signup to citizenship, only SimpleCitizen guides applicants…
Online enterprise training in data science and analytics.…
Kickstarter for local businesses
Online polls.
The generator's reference companies
Real companies the model named as closest when it wrote the card, with their fate. A check mark is a company the radar could verify in its directory.
Public money in this direction
US federal grants, SBIR/STTR awards and open opportunities from the radar's public-money feed, matched to the idea's terms; the sector totals give the context.
3
grants and programs matching the idea
81
startup-relevant grants in Security and compliance
$41M
awarded in the sector, tracked
16
opportunities open now in the sector
- Commercializing iDEP, an interactive and reproducible tool for analyzing RNA-Seq dataawardhigh relevance
NIH / NHGRI · STTR phase I · $395K · posted 2025-09-04
- III: Optimizing Neural Sparse Representations for Efficient Text Document Retrievalawardmedium relevance
National Science Foundation · Info Integration & Informatics · $750K · posted 2026-07-24
- Collaborative Research: III: Small: Towards Well-Rounded Graph Retrieval for Retrieval-Augmented Generationawardmedium relevance
National Science Foundation · Info Integration & Informatics · $200K · posted 2026-07-17
Market signal
What the radar sees in Security and compliance: new companies by cohort year, the forming YC batch, and outcomes since the February snapshot.
Security and compliance · 43 → 45 → 83 → 75 → 34 new companies 2022 → 2026 · 94% aliveYC F26 live: 1 in this cluster, 2% of the batch (was 3% in S26)Since February, of 171 YC companies here: 0 acquired, 2 shut down, 25 rewrote their pitch
Design attributes
The card is one cell of a designed set: every axis below was chosen before the text was written, and the text had to realize it.
- Buyer
- Small business
- Business model
- Infrastructure and APIs
- Path to 100x
- Collapses a cost 10x
- Market size
- $100B+ market
- Capital intensity
- Capital-medium (ops, field teams)
- Speed to revenue
- Revenue in 1-3 years
- Technical depth
- Deep tech: ML, hardware, bio
- Go-to-market
- Self-serve
- Moat
- License or regulatory moat
- Geography
- Global from day one
- Regulation
- Heavily regulated
- Vibe
- Hot space
Listed under
An idea sits in its own sector and in any sector its text clearly touches.
More ideas like this
B2B, security and compliance · Security and compliance
Claimyard
Marketplace turning scam, fraud and privacy losses into funded, aggregated consumer claims.
A consumer uploads what happened, screenshots of a romance scam, an unauthorized P2P transfer, a data misuse notice, and a no-code intake agent classifies the claim, pulls the paper trail from the bank or platform, and posts it to a marketplace of licensed attorneys, arbitration filers and litigation funders who bid to take it on contingency.
B2B, security and compliance · Security and compliance
Sentinet
Shared-defense agent for small firms: one member's confirmed fraud warns the whole network.
Sentinet connects in an afternoon to an SMB's mailbox, accounting system and bank feed, and runs an agent that screens invoices, vendor bank-detail changes and unusual logins.
B2B, security and compliance · Security and compliance
Vouchline
One AI agent answers your security questionnaires and reviews the ones you send.
Vouchline is an agent that sits on both sides of the vendor security review: for a small supplier it reads the buyer's questionnaire, pulls evidence from Drive, ticketing and cloud consoles, and returns a completed response in a day; for the buyer it reads incoming responses and flags the answers that contradict prior filings.
B2B, security and compliance · Security and compliance
Attestral
Agents that prove and verify vendor security continuously, replacing the questionnaire.
Attestral deploys agents inside an enterprise's stack that collect live control evidence and answer any customer's security review automatically; on the buying side, its agents interrogate a vendor's agents and check every claim against machine-readable evidence rather than prose.
B2B, security and compliance · Security and compliance
Codewarden
Continuous security for the AI-written software small businesses now run on.
Codewarden is a self-serve subscription platform that continuously scans, exploits and patches the AI-generated applications small businesses now build and deploy without security staff.
B2B, security and compliance · Security and compliance
Ironvane
Autonomous security operations agents that managed service providers resell and extend.
Ironvane gives managed service providers a runtime where security agents triage alerts, patch endpoints, revoke credentials and close tickets across their whole book of small business clients, with the provider approving actions rather than performing them.
Fictional company written 2026-08-23 from MarkosWeb data; the companies, grants and numbers around it are real and tracked. Treat the idea as a research prompt, not a plan.