A protection layer that complements your firewall, antivirus and WAF.
It assesses content, behaviour and the action itself before anything is carried out.
Use AI to the full — without handing it your sensitive data.The check sits where the data flows: in the browser, in front of the model, at the form and in the MCP gateway in front of the agent's tools.
One layer sits underneath: it reads behaviour and signals, weighs what the text means, and only then decides what may be carried out.
Situations that keep happening
All it takes is a website, employees with a browser and one AI assistant. The six examples below are not once-a-year events.
Your agent asks for more than the task needed
The assistant is supposed to prepare an order summary. Instead of selecting from the table, it writes a statement that drops it — or reaches for a tool the task never called for.
The damage comes not from an attacker but from a step nobody asked for.
The MCP gateway sits in front of the tool, not behind it. Before a tool runs it compares the arguments against the tool's declared JSON schema and looks for tool — and obfuscating the attempt does not get it past. Queries into a connected database pass only as reads: a write does not get through even inside a nested query, and access to system schemas is blocked by default.
An uploaded PDF carries a sentence meant for the assistant
The document looks like an ordinary quotation. Between the lines sits an instruction aimed not at the reader but at the assistant that will read it later.
That instruction never reached the assistant's answers.
The file is written to quarantine first, under the hash of its content rather than the name the client gave it: the real file type from magic bytes, macros, JavaScript, files embedded in PDFs and scripts in SVG, then antivirus. The document's text is additionally assessed for indirect injection — by meaning, not by words. It stayed excluded from search, so it never reached an answer; an administrator finds it in quarantine and decides what happens next.
A visitor pulls at your chatbot's internal instructions
They do not ask outright. They come at it sideways, and when the assistant refuses, they reword the question and try again.
Rewording did not help. Meaning decides, not words.
Alongside the patterns for direct and indirect injection, special tokens, role markers and system-prompt extraction runs a semantic firewall: an embedding classifier measures similarity to a corpus of known attacks, including native phrasings in other languages. When Shield runs as a proxy in front of OpenAI and Anthropic, a blocked input never reaches the provider at all.
A colleague pastes a contract into ChatGPT
She wants a summary for the meeting, so she pastes the whole document into the browser window — client name, national ID number and amount included — in three seconds.
The client's data is now with a third party. No record, no consent.
A company has no way to control a browser chat — the text leaves straight from the window. So Privacy steps in right there: the extension matches the patterns inside the window and swaps the data before anything is sent. The audit log keeps a record of what left and what didn't.
Fifty fake enquiries arrive through the contact form
The sales rep has to go through them one by one, because a real customer could be among them; it costs an hour every day.
Paid sales time disappears into sorting spam.
Fake enquiries today are generated by AI, so they read as perfectly polite text and a keyword filter won't catch them. Shield decides before the enquiry is processed: the widget on the page watches how the form was filled in and whether the same text has already arrived twenty times — not which words appear in it. The binding decision is made only when the token is verified on the server, via the SDK or /verify.
Your competitor knows your prices before you do
A bot goes through your catalogue every night and looks like an ordinary visitor, so in your analytics it shows up as product interest.
The pricing model you invested in is now public.
To the server, these are ordinary requests to ordinary addresses. Shield works with what it can see on its side: whether the address is on public IP reputation lists, whether the user-agent matches a known AI crawler, and whether the rules you set apply. A match raises the risk and is written to the events — that is how it recognises and flags the bot.
One layer between people, AI and your systems
Nothing is migrated: the systems you have stay as they are, and Corpilus slots in between them.
Exactly where the check sits
Chrome and Edge, Manifest V3. It matches the patterns locally, with no network request; it activates on signing in to the workspace — signed out, it checks nothing.
Scan, redaction and anonymisation tools for Claude Desktop and Cursor. The output of the other tools passes through data protection.
One script with the site key. It only returns the decision; the binding step is the token verification on the server via the SDK or /verify.
Node.js, Python and PHP in front of forms, login and APIs, with no DNS change.
In the OpenAI or Anthropic SDK only the base URL changes and the application keeps using its own key. The calls that generate a reply are checked.
Before a tool runs, it validates the arguments against the tool's JSON schema and scans the name and arguments for tool misuse — and obfuscating the attempt does not get it past.
Individual checks per call: secrets scan, login assessment, lookalike domain, answer-grounding verification, audit verification and export.
For every surface it is set what happens when Shield is unavailable — stop the request or let it through. That is decided at deployment according to what the route protects, and the SDK middleware has a circuit breaker against a cascade of timeouts.
What each of them does
Privacy protects what leaves the company. Shield protects what comes into it. Studio is the reason you deploy AI at all.
Privacy
Works with the ChatGPT, Claude and Gemini you already use. You don't change your AI provider — you add a filter in front of it.
- Recognises names, national ID numbers, addresses, IBANs, amounts and contract numbers
- Swaps them for placeholder values before sending and restores them in the reply
- Custom patterns for project codes or client names
The Chrome and Edge extension (Manifest V3) matches the patterns locally, with no network request; the mapping stays with you and the model never sees it. For Claude Desktop and Cursor it runs as an MCP server with scan, redaction and anonymisation tools, and the output of the other tools passes through data protection. Signed out of the workspace, the extension checks nothing.
Shield
Sits in front of forms, login, chat and agent tools, and decides before anything is carried out.
- Stops spam and fake enquiries generated by AI
- Recognises mass login attempts with stolen passwords
- Catches text trying to hijack your AI assistant, and the bot copying your catalogue
A widget on the page and SDK middleware for Node.js, Python and PHP in front of forms, login and APIs, with no DNS change; an LLM proxy in front of the OpenAI and Anthropic models; an MCP gateway in front of the agent's tools. Each surface has its own mode — monitor or enforce. Scrapers are recognised and flagged; where they are also stopped is described on the Shield page. Detections are classified by OWASP Top 10 and OWASP LLM Top 10.
Studio | corpsys.desk
Upload contracts, manuals and spreadsheets, and people ask about them in plain language, without digging through folders.
- Sources in PDF, Word, Excel and from the web
- The answer always links back to the source — it can be checked
- Questions to company data without queries, read-only
- Local models on NVIDIA DGX Spark or a dedicated server
A cloud model gets sensitive data only as placeholders; with a local model the data never leaves your infrastructure. The model is chosen at every step — a public provider (OpenAI, Anthropic, Google) or your own server, in combination too. Database questions run only as read queries (SELECT/WITH).
Attack patterns are written directly in more than ten languages, including Slovak and Czech, not translated from English.
It runs where your company needs it
From an EU cloud to a server in your own building — the same protection, a different degree of control.
EU cloudEU cloud
Start without installing anything. We run it for you in data centres inside the European Union.
Shield runs on infrastructure in the EU. In its events, IP addresses are stored only as a hash and events are deleted after 30 days; for the personal data you process through Corpilus, we are the processor.
Dedicated serverDedicated server
Your own instance for your company alone — separate data, separate capacity.
The instance can also run on a server on your premises. The Privacy extension can be pointed at your server, so file checks, the paste warning and the deep check stay inside your infrastructure.
NVIDIA DGX SparkNVIDIA DGX Spark
An AI server on your premises; with a fully local installation, data never leaves the building.
A deployment option for any of the products. Models run locally: no data to an external provider and no fees for its tokens. You point the Privacy extension at your Spark's address and the server-side checks stay with you as well.
Local modelsLocal models
The highest level of both security and efficiency: no data to an external provider and no fees for its tokens. Cloud models can be added only where you allow it.
The model is chosen at every step: a step involving personal data can stay local even when the cloud is allowed. A cloud model gets sensitive data only as placeholders. With your own key to the model, we don't bill the tokens.
corpsys.desk — service desk and 24/7 monitoring
- Service desk
People's requests in one place.
- 24/7 monitoring
Website, online store and operations.
- Local AI models on NVIDIA DGX Spark
Right in your office — the data stays with you.
- Connected to Corpilus Shield
A higher level of data protection.
There are people behind the product you can reach by name
A company doesn't buy a security layer from an anonymous vendor.
A support team works with them on deployment, operations and support.
Let's start with measurement. You'll see what's happening today.
First, numbers from your own operation: how many bots, how much spam, what leaves for AI. What we turn on is your call after that.
- 01Consultation, 45 minutesWhere data enters your company and where AI is used.
- 02Measurement, two weeksWe only measure. Nothing is blocked, operations run as before.
Technical detailThe widget and the extension need no change to your application's code; SDK integration means adding middleware for Node.js, Python or PHP. Watching runs in monitor mode: events are recorded, nothing is stopped.
- 03A proposal built for youScope, timeline and price from the measured numbers — including whether you need a WAF.
- AI has opened a new path into the company, and your existing tools don't watch it
- Corpilus doesn't swap out your existing security; it adds checks on content, behaviour and action
- The decision rests on measurement from your own operation, not on market averages