Question 1

What is Corpilus?

Accepted Answer

A protection layer between people, AI and your company systems. It has three modules: Privacy protects what leaves the company for AI, Shield protects what comes into your website, applications and agents, and Studio is an assistant over your own documents. Nothing is migrated — the systems you have stay as they are, and Corpilus slots in between them.

Question 2

Who is Corpilus for?

Accepted Answer

Companies where employees already type into ChatGPT, Claude or Gemini, that run a website with forms and login, or that are deploying AI over their own documents. You don't need an AI project — a website and people with a browser are enough.

Question 3

How does it start?

Accepted Answer

With a short consultation where we go through where data enters your company and where AI is used. Then we only measure for two weeks: nothing is blocked, operations run as before, and you see numbers from your own operation — how many bots, how much spam, what leaves for AI. We propose scope and price only from the measured numbers.

Question 4

Does Corpilus work in Slovak?

Accepted Answer

Yes. The interface is available in Slovak, and the patterns for sensitive data are written directly for Slovak and Czech — a birth number, company ID or IBAN is recognised without any set-up. Shield's attack patterns are also written in each language, not translated from English.

Question 5

What is corpsys.desk and how does it relate to Corpilus?

Accepted Answer

A product from the same family: a service desk with people's requests in one place, and 24/7 monitoring of your website, online store and operations. Its local AI models run on NVIDIA DGX Spark right in your office, so the data stays with you. It is connected to Corpilus Shield, which gives a higher level of data protection.

Question 6

What is Qronos and when will it be ready?

Accepted Answer

A layer in preparation for AI agents that act on their own: it continuously checks whether the agent is still acting within what you allowed it to do, and decides before a step with a consequence runs. It is in development — it isn't part of any package, it can't be deployed today, and we don't give a date. You can mark your interest in the quote request.

Question 7

What does this website store in my browser, and when does Google Analytics load?

Accepted Answer

Without consent, only the necessary things: your language, your cookie choice and the protection of the website against bots and spam. The light or dark theme and the User / IT expert view are remembered without consent only until you close the tab. Google Analytics loads only after you consent, and you can change your choice at any time with the “Cookie settings” button in the bottom left corner or in the footer.

Question 8

What is Corpilus Privacy and how does it differ from Studio?

Accepted Answer

Privacy protects what employees type into ChatGPT, Claude or Gemini: client data is swapped for placeholder values before the text leaves, and restored in the answer. Studio is the assistant over your own documents and includes Privacy. If you only want to protect what goes into AI, Privacy is enough.

Question 9

Does an employee have to change or learn anything?

Accepted Answer

No. They type into the same chat as before; the browser extension swaps the data before sending and restores it in the reply. No training and no new tool — the extension activates when you sign in to the workspace, and checks nothing while signed out.

Question 10

What does Privacy recognise?

Accepted Answer

Names, birth numbers and other national identifiers, company registration and tax IDs, IBANs and account numbers, emails, phone numbers, addresses, amounts and contract numbers. Birth numbers and company IDs are also verified by calculation, so an invoice number is not taken for a birth number. Custom patterns — project codes or client labels — you add yourself.

Question 11

Do my texts leave for Corpilus servers?

Accepted Answer

Pattern matching runs right in the browser: the full pattern set ships with the extension, so the text never leaves your device for it. Only three things call Corpilus — files you ask it to check, the warning about hidden instructions in pasted text, and the optional deep check for names; the result comes back immediately and nothing is stored. With your own server or an NVIDIA DGX Spark, even those checks stay with you.

Question 12

Where does Privacy work?

Accepted Answer

In the Chrome and Edge browsers with ChatGPT, Claude and Gemini; as an MCP server for Claude Desktop and Cursor, where the output of other tools is checked too; and through an API for applications that work with AI from their own code. If your application calls OpenAI or Anthropic directly, the check in front of the model is Shield's job.

Question 13

How does Privacy help with GDPR, including health data?

Accepted Answer

Replacing identifiers before sending is a technical measure for data minimisation and for security of processing. The result is pseudonymised, not anonymous — the data can be restored with the map, so legally it is still personal data. For health data we recommend block mode, which stops sending on a finding. This helps you meet the requirements; it is not a certification, and whether the processing as a whole complies is for the controller to assess.

Question 14

What if the extension misses something? What are the guarantees?

Accepted Answer

No recognition of personal data gives an absolute guarantee, so the check has several layers: patterns with a checksum where one exists, and an optional deep check that also looks for names. The default mode is anonymize, i.e. replacement with a placeholder; the stricter option is block, where sending stops on any finding. Before sending you see the whole adjusted text, so the final say is yours.

Question 15

What is Corpilus Shield and what does it protect against?

Accepted Answer

A layer that stands in front of forms, login, chat, APIs and an AI agent's tools, and decides before anything is carried out. It stops spam and fake enquiries generated by AI, recognises mass login attempts with stolen passwords, and catches text trying to hijack your assistant as well as the bot copying your catalogue.

Question 16

We have a WAF and reCAPTCHA. Why Shield as well?

Accepted Answer

They aren't competitors; each guards a different layer. A WAF works at the edge of the network and looks for known attack patterns in the envelope of a request; Shield reads its contents — what is in the text, the document or the tool call — and assesses behaviour too. Shield does not protect against link flooding and won't replace a certified WAF in a PCI audit; it is used alongside it.

Question 17

How does Shield protect an AI assistant and agents?

Accepted Answer

In front of the model it recognises text meant to make the assistant forget its rules or give away the company's set-up — by wording and by meaning — and checks the reply for leaked internal instructions, keys or personal data. An uploaded document with a hidden instruction is quarantined. When an agent calls tools, the MCP gateway checks the call before it runs: an instruction to delete a whole table does not execute.

Question 18

How does Shield handle scrapers and AI bots?

Accepted Answer

A bot that announces itself as a known AI crawler or comes from an address on public blocklists is recognised and flagged — the events show who it was and what it came for. At forms, APIs and routes protected by the SDK it is also stopped. An agent in an ordinary browser that doesn't introduce itself is not recognised this way.

Question 19

Will Shield block a real customer?

Accepted Answer

It doesn't have to block anything straight away. It starts in a mode that only watches and records; you switch on intervention one place at a time once the measurement shows where the problem is. Every event has a risk score and the dashboard shows what it came from — you can allow an address, mark an event as a false positive and retire a rule that misfires.

Question 20

Where is Shield's decision actually enforced?

Accepted Answer

The widget on the page only returns the decision. What binds is the verification on your server — through the SDK middleware for Node.js, Python and PHP, or by verifying the token; without it, anyone sending the request directly would skip the browser check. In front of the AI model sits a proxy, in front of the agent's tools the MCP gateway.

Question 21

Does Shield learn?

Accepted Answer

Yes, from your own traffic. It regularly goes through the events from your websites and applications and turns recurring attacks into new rules. An administrator sees which rules came about this way and can retire any of them.

Question 22

Can I see what Shield caught?

Accepted Answer

Yes. The event log shows the time, the channel, what happened, the reason for the decision in plain language and the full original request; events can be exported. Who changed a rule or a setting stays in the audit log, which cannot be overwritten or deleted.

Question 23

What is Corpilus Studio?

Accepted Answer

An assistant over your documents. You upload contracts, guides and spreadsheets, people ask in their own words, and they get the answer together with the document and page it drew on. When an answer isn't backed by the material, the assistant says so.

Question 24

What material can Studio work with?

Accepted Answer

PDF, Word, Excel, CSV, PowerPoint and web pages. On ingestion every document passes an antivirus scan and detection of hidden instructions aimed at the assistant; a document carrying such an instruction never makes it into the index, so it never shows up in answers.

Question 25

Can I ask questions about company data too?

Accepted Answer

Yes — how much was sold, or when the last order came in — in plain language, without writing queries. The data is only read; writes and schema changes don't get through. The result is a table or a summary drawn from the data, not a guess from the model.

Question 26

Which AI model does Studio use, and what does it see?

Accepted Answer

You choose the model: a public provider such as OpenAI, Anthropic or Google, or a model on your own server — in combination too, and separately for each step. A cloud model gets sensitive data only as placeholders; with a local model the data never leaves your infrastructure. With your own key to the model, we don't bill the tokens.

Question 27

Does Studio learn from how people react?

Accepted Answer

Yes. A correction or a satisfied reaction becomes an example for a similar question; the model's weights are not fine-tuned. Examples from legal, finance, HR or security wait for an administrator's approval, the rest are added on their own when confidence is high. Look through what has been added now and then — a praised wrong answer can be added too.

Question 28

Is Privacy included in Studio?

Accepted Answer

Yes. Protection for outgoing data is part of every Studio — Complete package, at no extra charge. Studio can also be made available over MCP.

Question 29

Where does Corpilus run?

Accepted Answer

Depending on how much control you need: in an EU cloud that we run for you; on a dedicated server for your company alone, on your premises too; or on NVIDIA DGX Spark, an AI server right at your site. The protection is the same in every case — what differs is where the data is.

Question 30

What do local models mean?

Accepted Answer

The AI model runs at your site, so no data goes to an external provider and you don't pay for its tokens. The model is chosen at every step: a step involving personal data can stay local even when the cloud is allowed, and a cloud model gets sensitive data only as placeholders.

Question 31

Do we have to install anything?

Accepted Answer

Not in the cloud — people work in the cloud app in their browser. Privacy is an extension for Chrome and Edge; Shield is one script on the website and a middleware on the server, added by your developer or ours. For macOS there is also a desktop agent; more platforms are on the way.

Question 32

Does deployment interfere with our systems?

Accepted Answer

No. Nothing is migrated: the systems you have stay as they are, and Corpilus slots in between them. It starts with measurement, during which nothing is blocked, and the SDK middleware is added without a DNS change.

Question 33

Why are there no prices on the website?

Accepted Answer

We do the installation together with you, and a published number would be based on an average company, not yours. We first measure what is really happening at your company, and send you scope and a price built on your numbers once we have the results. Requesting a quote doesn't commit you to anything.

Question 34

What packages are there?

Accepted Answer

Four: Privacy by number of people, Shield by number of domains, Studio — Complete by volume of documents and questions, and Dedicated server / NVIDIA DGX Spark by deployment scope. Within a package everything is available — scope differs, not features. They aren't volume tiers of one feature set; each protects something different.

Question 35

What is paid outside the package?

Accepted Answer

Cloud storage by volume and tokens from our AI models by actual usage; an estimate is part of the quote. If you have your own model key, you don't pay us for tokens. You can watch consumption on the usage counter in the dashboard.

Question 36

Can I try Corpilus for free?

Accepted Answer

We don't offer a public trial or a free plan, and there is no sign-up on the website. For a suitable project we prepare a demo or a time-boxed pilot tailored to you; it starts with a quote request.

Question 37

What happens after I send a quote request?

Accepted Answer

In the form you choose the packages, the number of people and domains, where it should run, and optionally a phone number and a message. The request is stored with us and we get back to you at the email you gave — it is not a registration and nothing starts. If it's urgent, write directly to info@crebiso.com.

Question 38

Can I change the package or scope later?

Accepted Answer

Yes, by agreement — we reflect the change in the contract. Size Shield's event volume with headroom for peaks: once it is exceeded, events are still recorded, but protected forms may turn visitors away until the volume is raised. You can watch consumption as you go, so you can ask for a higher volume in time.

Question 39

Will Corpilus or anyone else see my data?

Accepted Answer

With Privacy, sensitive data is swapped inside your browser before sending, so the AI provider never receives it; the mapping stays with you and the original text is not stored anywhere. In Studio, a cloud model gets sensitive data only as placeholders, and with a local model the data never leaves your infrastructure. Studio conversations are stored in your own workspace; when data protection finds something in a message, the audit records the risk level and a fingerprint, not the text.

Question 40

Is the replacement of data anonymisation or pseudonymisation?

Accepted Answer

The extension replaces names and numbers with placeholder labels and restores them in the answer; the same name gets the same label everywhere, so the model still knows who is meant. Because the data can be restored with the map, legally this is pseudonymisation — but the map stays in your browser and the model never sees it.

Question 41

What is the kill switch?

Accepted Answer

One toggle that stops outgoing data entirely — for example during an audit or when an incident is suspected. In Studio it turns off learning from conversations as well.

Question 42

Where is the data stored, and for how long?

Accepted Answer

In the cloud deployment, Corpilus runs on infrastructure in the EU. In Shield events, IP addresses are stored only as a hash, and events are deleted after 30 days. With a dedicated server or an NVIDIA DGX Spark, the data is with you.

Question 43

Does Corpilus help with GDPR compliance? Is it certified?

Accepted Answer

It helps you meet the requirements; it does not certify them. Replacing identifiers before sending is a technical measure for data minimisation and security of processing, and Shield's detections are classified by OWASP Top 10 and OWASP LLM Top 10. Whether the processing as a whole complies is for the controller to assess; Shield does not replace a penetration test or a formal security audit.

Frequently Asked Questions

Expert Support

Data Privacy First

Always Improving