Question 1

What is Corpilus?

Accepted Answer

A protection layer between people, AI and your company systems. It has two modules: Privacy protects what leaves the company for AI, and Shield protects what comes into your website, applications and agents. Nothing is migrated — the systems you have stay as they are, and Corpilus slots in between them.

Question 2

Who is Corpilus for?

Accepted Answer

Companies where employees already type into ChatGPT, Claude or Gemini, that run a website with forms and login, or that are deploying AI over their own documents. You don't need an AI project — a website and people with a browser are enough.

Question 3

How does it start?

Accepted Answer

With a short consultation where we go through where data enters your company and where AI is used. If there is nothing to go on, we can also agree on a period in which we only measure: nothing is blocked, operations run as before, and you see numbers from your own operation. Measuring is an option, not a condition — we propose scope and price from what you want to protect.

Question 4

Does Corpilus work in Slovak?

Accepted Answer

Yes. The interface is available in Slovak, and the patterns for sensitive data are written directly for Slovak and Czech — a birth number, company ID or IBAN is recognised without any set-up. Shield's attack patterns are also written in each language, not translated from English.

Question 5

What is corpsys.desk and how does it relate to Corpilus?

Accepted Answer

A product from the same family: a service desk with people's requests in one place, and 24/7 monitoring of your website, online store and operations. Its local AI models can run on NVIDIA DGX Spark right in your office; whether any part of the flow still talks to the outside depends on the particular deployment, and we settle that when we design it. Corpilus protection can be connected to it — that is not a higher level of protection, nor a different package.

Question 6

What is Qronos and when will it be ready?

Accepted Answer

A layer in preparation for AI agents that act on their own: it continuously checks whether the agent is still acting within what you allowed it to do, and decides before a step with a consequence runs. It is in development — it isn't part of any package, it can't be deployed today, and we don't give a date. You can mark your interest in the quote request.

Question 7

What does this website store in my browser, and when does Google Analytics load?

Accepted Answer

Without consent, only the necessary things: your language, your cookie choice and the protection of the website against bots and spam. The light or dark theme and the User / IT expert view are remembered without consent only until you close the tab. Google Analytics loads only after you consent, and you can change your choice at any time with the “Cookie settings” button in the bottom left corner or in the footer.

Question 8

What does protecting data in AI use mean?

Accepted Answer

It protects what employees type into ChatGPT, Claude or Gemini: client data is swapped for placeholder values before the text leaves, and restored in the answer. If you only want to protect what goes into AI, this one area is enough.

Question 9

Does an employee have to change or learn anything?

Accepted Answer

No. They type into the same chat as before; the browser extension swaps the data before sending and restores it in the reply. No training and no new tool — the extension activates when you sign in to the workspace, and checks nothing while signed out.

Question 10

What does the data protection recognise?

Accepted Answer

Names, birth numbers and other national identifiers, company registration and tax IDs, IBANs and account numbers, emails, phone numbers, addresses, amounts and contract numbers. Birth numbers and company IDs are also verified by calculation, so an invoice number is not taken for a birth number. Custom patterns — project codes or client labels — you add yourself.

Question 11

Do my texts leave for Corpilus servers?

Accepted Answer

Pattern matching runs right in the browser: the full pattern set ships with the extension, so the text never leaves your device for it. Only three things call Corpilus — files you ask it to check, the warning about hidden instructions in pasted text, and the optional deep check for names; the result comes back immediately and nothing is stored. With your own server or an NVIDIA DGX Spark, even those checks stay with you.

Question 12

Where does the data protection work?

Accepted Answer

In the Chrome and Edge browsers with ChatGPT, Claude and Gemini; as an MCP server for Claude Desktop and Cursor, where the output of other tools is checked too; and through an API for applications that work with AI from their own code. If your application calls OpenAI or Anthropic directly, the check in front of the model belongs to the protection of your own AI.

Question 13

How does the data protection help with the GDPR, including health data?

Accepted Answer

Replacing identifiers before sending is a technical measure for data minimisation and for security of processing. The result is pseudonymised, not anonymous — the data can be restored with the map, so legally it is still personal data. For health data we recommend block mode, which stops sending on a finding. This helps you meet the requirements; it is not a certification, and whether the processing as a whole complies is for the controller to assess.

Question 14

What if the extension misses something? What are the guarantees?

Accepted Answer

No recognition of personal data gives an absolute guarantee, so the check has several layers: patterns with a checksum where one exists, and an optional deep check that also looks for names. The default mode is anonymize, i.e. replacement with a placeholder; the stricter option is block, where sending stops on any finding. Before sending you see the whole adjusted text, so the final say is yours.

Question 15

What is Corpilus Shield and what does it protect against?

Accepted Answer

A layer that stands in front of forms, login, chat, APIs and an AI agent's tools, and decides before anything is carried out. It stops spam and fake enquiries generated by AI, recognises mass login attempts with stolen passwords, and catches text trying to hijack your assistant as well as the bot copying your catalogue.

Question 16

We have a WAF and reCAPTCHA. Why Shield as well?

Accepted Answer

They aren't competitors; each guards a different layer. A WAF works at the edge of the network and looks for known attack patterns in the envelope of a request; Shield reads its contents — what is in the text, the document or the tool call — and assesses behaviour too. Shield does not protect against link flooding and won't replace a certified WAF in a PCI audit; it is used alongside it.

Question 17

How does Shield protect an AI assistant and agents?

Accepted Answer

In front of the model it recognises text meant to make the assistant forget its rules or give away the company's set-up — by wording and by meaning — and checks the reply for leaked internal instructions, keys or personal data. An uploaded document with a hidden instruction is quarantined. When an agent calls tools, the MCP gateway checks the call before it runs: an instruction to delete a whole table does not execute.

Question 18

How does Shield handle scrapers and AI bots?

Accepted Answer

A bot that announces itself as a known AI crawler or comes from an address on public blocklists is recognised and flagged — the events show who it was and what it came for. At forms, APIs and routes protected by the SDK it is also stopped. An agent in an ordinary browser that doesn't introduce itself is not recognised this way.

Question 19

Will Shield block a real customer?

Accepted Answer

It doesn't have to block anything straight away. It starts in a mode that only watches and records; you switch on intervention one place at a time once the measurement shows where the problem is. Every event has a risk score and the dashboard shows what it came from — you can allow an address, mark an event as a false positive and retire a rule that misfires.

Question 20

Where is Shield's decision actually enforced?

Accepted Answer

The widget on the page only returns the decision. What binds is the verification on your server — through the SDK middleware for Node.js, Python and PHP, or by verifying the token; without it, anyone sending the request directly would skip the browser check. In front of the AI model sits a proxy, in front of the agent's tools the MCP gateway.

Question 21

Does Shield learn?

Accepted Answer

Yes, from your own traffic. It regularly goes through the events from your websites and applications and turns recurring attacks into new rules. An administrator sees which rules came about this way and can retire any of them.

Question 22

Can I see what Shield caught?

Accepted Answer

Yes. The event log shows the time, the channel, what happened, the reason for the decision in plain language and the full original request; events can be exported. Who changed a rule or a setting stays in the audit log, which cannot be overwritten or deleted.

Question 23

Where does Corpilus run?

Accepted Answer

Depending on how much control you need: in an EU cloud that we run for you; on a dedicated server for your company alone, on your premises too; or on NVIDIA DGX Spark, an AI server right at your site. The protection is the same in every case — what differs is where the data is.

Question 24

What do local models mean?

Accepted Answer

The AI model runs at your site, so no data goes to an external provider and you don't pay for its tokens. The model is chosen at every step: a step involving personal data can stay local even when the cloud is allowed, and a cloud model gets sensitive data only as placeholders.

Question 25

Do we have to install anything?

Accepted Answer

Not in the cloud — people work in the cloud app in their browser. Privacy is an extension for Chrome and Edge; Shield is one script on the website and a middleware on the server, added by your developer or ours. For macOS there is also a desktop agent; more platforms are on the way.

Question 26

Does deployment interfere with our systems?

Accepted Answer

No. Nothing is migrated: the systems you have stay as they are, and Corpilus slots in between them. It starts with measurement, during which nothing is blocked, and the SDK middleware is added without a DNS change.

Question 27

Why are there no prices on the website?

Accepted Answer

We do the installation together with you, and a published number would be based on an average company, not yours. We first measure what is really happening at your company, and send you scope and a price built on your numbers once we have the results. Requesting a quote doesn't commit you to anything.

Question 28

What is the offer?

Accepted Answer

One Corpilus protection. We agree what you need to protect — data in AI tools, websites and applications, or your own AI — and set the scope from that. Integration over SDK or API and a dedicated server are ways of using the same protection, not separate packages.

Question 29

What is charged separately?

Accepted Answer

Cloud storage by volume and tokens from our AI models by actual usage; an estimate is part of the quote. If you have your own model key, you don't pay us for tokens. The quote says what is included and what is charged separately.

Question 30

Can I try Corpilus for free?

Accepted Answer

We don't offer a public trial or a free plan, and there is no sign-up on the website. For a suitable project we prepare a demo or a time-boxed pilot tailored to you; it starts with a quote request.

Question 31

What happens after I send a quote request?

Accepted Answer

In the form you choose what you want to solve and describe your situation briefly; the website address, technical details and an approximate scope are optional. The request is stored with us and we get back to you at the email you gave — it is not a registration and nothing starts. If it's urgent, write directly to info@crebiso.com.

Question 32

Can I change the scope later?

Accepted Answer

Yes, by agreement — we reflect the change in the contract. Size the event volume with headroom for peaks: once it is exceeded, events are still recorded, but protected forms may turn visitors away until the volume is raised. You can watch consumption as you go, so you can ask for a higher volume in time.

Question 33

Will Corpilus or anyone else see my data?

Accepted Answer

With Privacy, sensitive data is swapped inside your browser before sending, so the AI provider never receives it; the mapping stays with you and the original text is not stored anywhere. When data protection finds something in a message, the audit records the risk level and a fingerprint, not the text.

Question 34

Is the replacement of data anonymisation or pseudonymisation?

Accepted Answer

The extension replaces names and numbers with placeholder labels and restores them in the answer; the same name gets the same label everywhere, so the model still knows who is meant. Because the data can be restored with the map, legally this is pseudonymisation — but the map stays in your browser and the model never sees it.

Question 35

What is the kill switch?

Accepted Answer

One toggle that stops outgoing data entirely — for example during an audit or when an incident is suspected.

Question 36

Where is the data stored, and for how long?

Accepted Answer

In the cloud deployment, Corpilus runs on infrastructure in the EU. In Shield events, IP addresses are stored only as a hash, and events are deleted after 30 days. With a dedicated server or an NVIDIA DGX Spark, the data is with you.

Question 37

Does Corpilus help with GDPR compliance? Is it certified?

Accepted Answer

It helps you meet the requirements; it does not certify them. Replacing identifiers before sending is a technical measure for data minimisation and security of processing, and Shield's detections are classified by OWASP Top 10 and OWASP LLM Top 10. Whether the processing as a whole complies is for the controller to assess; Shield does not replace a penetration test or a formal security audit.

Frequently Asked Questions

Expert Support

Data Privacy First

Always Improving