See where the data from your AI tools actually goes.
Behind every AI tool there is a model provider, and behind the provider further companies that process the data. Corpilus Shield keeps a record of this chain for the AI tools and providers you connect, shows how each link is known and lets you set rules over it — starting by only watching.
An accounting office with 40 people and one AI assistant.
The office uses an AI assistant for incoming invoices, connected as an MCP server. Its vendor declares what stands behind it; the office's own calls to the same model provider go through the Corpilus LLM proxy, so Corpilus also sees them.
A modelled example with fictitious names — not a client reference. The screens on this page are illustrations built for it, not screenshots.
- 01 · Company
Accounting office, 40 people
Uses the assistant for incoming invoices and its own chatbot.
- 02 · AI tool
Invoice assistant (MCP server)
When the server is checked, its vendor declares the provider, the sub-processors and the hosts behind it.
Vendor - 03 · Model provider
Provider A
Declared by the vendor and seen in calls through the LLM proxy. Where it processes data stays unknown until someone enters it.
VendorObserved - 04 · Sub-processor
Hosting B, Germany
Declared by the vendor together with its country. What stands behind it is not known, and Corpilus does not guess.
Vendor
| AI tool or provider | Link | Value | Processing place | How it is known |
|---|---|---|---|---|
| Invoice assistant | Model provider | provider-a | unknown | Vendor |
| Invoice assistant | Sub-processor | hosting-b | DE | Vendor |
| Invoice assistant | Host | files.invoice-assistant.example | unknown | Vendor |
| provider-a | Model | the model requested in the call | — | Observed |
| provider-a | Host | api.provider-a.example | unknown | Observed |
How each link is known
The AI tool's vendor declared it when its MCP server was checked. It is the vendor's statement, not something Corpilus verified.
Your administrator entered it, for example from the contract. For the place and the legal seat it wins over the vendor's statement and over Corpilus's reference data.
Corpilus saw it in traffic: the provider, the requested model and the host of a call that went through the LLM proxy.
Nobody has stated it and Corpilus has not seen it. It is shown as unknown, never guessed.
“EU only”: an unknown place is marked, not blocked.
The office sets that data may be processed only in the EU. Corpilus judges each link by what is known about it.
That is why “EU only” on its own blocks almost nothing at first: providers rarely publish a single place of processing, so most places stay unknown until someone enters them from the contract. The settings say so before you save.
One click: “we have this EU option”
Where Corpilus has verified an EU processing option on the provider's own pages, the page offers it with that source and the date it was checked. If the company uses the option or has a contract for it, one click records it.
The click records your own statement; Corpilus does not verify your contract or your settings. Some options also allow processing outside the EEA, for example in Switzerland or the United Kingdom — a rule that allows only the EEA then still counts that place as unsure: never as met, never as a reason to block. Where no verified option exists, the page says so and the place is entered by hand.
GDPR strict or DORA, with a preview before you save.
On the first visit a guide walks through what Corpilus has already seen, where each provider processes data and a choice of rule template. Before saving, it shows what the template would block if blocking were switched on. In the example the office also uses a translation plug-in whose vendor declares a sub-processor in the United States.
GDPR strict
Processing only in the EEA, and the provider's legal seat in the EEA too. An unknown place raises a notice instead of blocking.
DORA
Processing in the EEA or in a country with an EU adequacy decision; the legal seat is not judged. Japan, Canada and the United States are not included automatically. An unknown place raises a notice instead of blocking.
A template never switches blocking on. The mode stays Monitor and violations are only recorded until your administrator switches the AI supply chain to Enforce. Even then only a known violation is refused: a blocked provider or model, or a known country outside the allowed set.
A CSV or CycloneDX file for your GDPR and DORA registers.
The administrator downloads the whole chain. Every line says what the value is, where it is processed if that is known, and how it is known.
- rank_in_chain: 1 is the AI tool or provider itself, 2 a link behind it. When the vendor marks its list of sub-processors as ordered, that order gives the ranks 2, 3 and on; a plain list gives no rank. Your administrator can set the rank of any link.
- rank_note: rank_not_given means nobody gave a rank. The line then says 2, and Corpilus does not invent a deeper order.
- confidence: how the value is known. A value nobody knows stays unknown in the file too.
- Only names, hosts and countries are recorded and exported — never prompts, answers or tool arguments.
The export is a basis for the sub-processor register and for the DORA register of information. Whether the processing complies is for the controller to assess.
An AI agent starts behaving like an autonomous attack.
An agent with access to the office's tools through the MCP gateway reads the tool list again and again, retries after every refusal and then fires calls at machine speed. Shield names each situation and keeps a timeline of the campaign.
- Two different situations within an hour make a challenge, three make a block.
- The watch starts in watch-only mode: the timeline then shows what Shield would do, and the agent is not stopped. Holding calls and pausing the key happen only after the company switches the watch to enforce.
- The timeline keeps counts, situation names and tool names — never arguments, texts or the reason a decision was lifted. Older entries are deleted automatically, and the administrator can download the timeline as CSV for an investigation.
- Busy legitimate automation can look similar, so the sensitivity can be raised or lowered and trusted agents exempted. Calls through the LLM proxy are only recorded, never stopped by this watch.
An MCP server protected from the first day.
The office adds a tool server for its agents to the MCP proxy that Corpilus runs. While registering it, the administrator can also fill in the AI behind it: the provider, the model, the country and the sub-processors. Every one of these fields is optional.
- The data is saved as your administrator's own statement for that server, so the AI supply chain rules apply to it from the first call. In Enforce, a known violation means calls to that server are refused.
- Without this data the AI supply chain rules cannot block a proxy server — the page says so next to the server. Vendor and observed data never decide a proxy server.
- A field that is not valid stops the registration with an error that names it: no half-registered server, no partial data.
What this does and what it does not do.
Unknown never blocks
In any mode. A place nobody knows is marked as unverified and can raise a notice; it is never a reason to refuse a call.
Watching is the default
The AI supply chain starts in Monitor: violations are recorded, nothing is refused. Blocking starts only when your administrator switches it to Enforce, and a template never switches it.
Most provider data is unknown at first
Providers rarely publish one place of processing, so until someone enters data from the contract most places stay unknown and a jurisdiction rule has little to judge.
A record, not an audit of the provider
Corpilus records names, hosts and countries and checks your rules against them. It does not see what a provider does with the data, and a vendor's declaration is the vendor's statement.
Vendor changes can wait for approval
When a vendor changes what it declares, Shield records the change. With the approval setting on (it is off by default), the change waits on the page and the previous declaration stays in force until an administrator decides.
The export is not a legal assessment
It is a basis for your registers. Whether the processing complies is for the controller to assess.
Where a known violation is refused
Only in Enforce and only for a known violation. Every check is bounded in time and lets the call through when it cannot finish.
LLM proxy
Before the call is forwarded: this call's provider and requested model, plus what was declared for the provider. A refused call gets an error that names neither the rule nor the value.
MCP server check
Everything stored for the server is judged after the vendor's declaration in the same request. On a violation every offered tool is answered as blocked; the server comes back when the rule goes.
Hosted MCP proxy
Judged only by your administrator's own data for that server; vendor and observed data never decide it.
Egress check
Only when the request names the AI tool it belongs to. Without that, the chain is not read at all.
File formats
CSV with a fixed set of columns, or CycloneDX with one service per AI tool or provider. A partial export says so in the file name, and cells a spreadsheet could read as a formula are neutralised.
Show us which AI tools your company uses.
We go through the tools, the providers behind them and what your registers need, and propose where Corpilus records the chain and which rules make sense to start with.
The price is individual, by scope. How the scope is determined