Alter, a YC S25 Startup, Launches Access Control for AI Agents With SOC 2 Still "In Progress"

Alter, a Y Combinator Summer 2025 company that sells access control for AI agents, launched on Hacker News on Oct. 21 and had 68 points and 45 comments when checked on Oct. 23, according to the Hacker News index. The product is available to book as a walkthrough. No pricing is published and no funding has been announced.

The startup's homepage and its Launch YC post disagree on one point worth a reader's attention. The post lists "Pass SOC 2, HIPAA, and GDPR audits" among its compliance controls. The homepage says SOC 2 is "in progress."

What Alter sells

Alter is privileged access management for agents. An agent makes one SDK call, and Alter stores the credential, refreshes the token, checks policy and writes the log. Users grant access through a Connect widget over OAuth, and Alter injects credentials into proxied requests so the agent never holds them.

The homepage lists 140 integrations, plus LangChain, MCP and AWS support. Policy is default-deny and fails closed if it cannot be evaluated. Sensitive calls wait for a named human approver, and revoking an agent's key or grant takes effect immediately. The Launch YC post adds parameter-level role and attribute rules, with the example of blocking dangerous commands during a change freeze, and says agent-to-agent (A2A) support is "coming soon."

The post is written by Srikar Dandamuraju, who is listed as author; the second founder appears only as Kevan, with no surname or title in the post. Neither source names a customer or a case study.

The compliance gap

The post calls Alter "the safest way to run AI agents in production" and says compliance controls run automatically. That is marketing copy, and the post itself does not claim a certificate. The homepage is more careful: SOC 2 is in progress, and the post describes controls that help a customer through an audit, not Alter's own attestation.

For a product whose pitch is that it sits between an agent and a company's credentials, the distinction decides who can buy it. A security team in a regulated business typically asks for the vendor's own SOC 2 report before it routes production tokens through a proxy. A report that is still being prepared is a reason to wait, not a reason to rule it out.

Who else is selling this

Agent identity is a funded category. NewCore emerged on June 15 with a $66 million seed at a $300 million post-money valuation, led by Cyberstarts with Index Ventures and Evolution Equity Partners, per TechCrunch. Zohar Alon is co-founder and chief executive. Oasis Security raised a $120 million Series B on March 19, led by Craft Ventures, bringing its total to $195 million, Globes reported. Globes also cites market sources putting the valuation near $700 million, which the company has not confirmed.

Company	Round	Amount	Date
Oasis Security	Series B, led by Craft Ventures	$120M	Mar. 19, 2026
NewCore	Seed, led by Cyberstarts	$66M	Jun. 15, 2026
Alter	Not announced	Not disclosed	Launch HN Oct. 21, 2026

Alter's difference, on its own telling, is the per-user angle in its Launch HN title: access control for multi-user agents, where one agent acts for many people. That is a narrower claim than "identity for every agent," and the Hacker News thread tested it, with one commenter asking whether data from one user's session could reach the next user of a shared agent.

For that kind of risk the same wiring matters in open-source agent runtimes too; see our coverage of Omnara's insecure defaults and NVIDIA's OpenShell sandbox.

What to watch

YC's S25 batch had its Demo Day more than a year ago, so a seed announcement is overdue by the usual rhythm, though neither the homepage nor the launch post mentions one. The first checkable item is the SOC 2 report: when the homepage drops "in progress" for an auditor's name and report type, the compliance gap closes.