When an employee actually uses this
Four tasks people most often bring to AI.
Summarizing a contract for a meeting
The whole contract goes into the chat, but the model gets only placeholders instead of the client's name, national ID number and amount. The summary comes back with the original data.
Drafting an email to a client
The employee pastes in the communication history. Names, addresses and contract numbers never reach the model, yet you can still tell who is who.
Analyzing a tender
Bids contain commercial terms and prices. The company adds its own patterns, for example contract codes or bidder labels, which a generic filter doesn't think of.
Transcribing and summarizing a meeting
A transcript full of names, numbers and amounts goes to the model cleaned. The minutes that come back already contain the real data.
Write a message. See exactly what the AI receives.
Corpilus hides sensitive details while still in your browser and puts them back into the answer. Try it on the sample or write your own text.
Reversible client-side redaction before the prompt is sent. Production engine: 9-language pattern corpus, an optional deep check that also looks for names, and block mode for regulated sectors. This demo uses a simplified pattern set (IBAN, company ID, birth number, e-mail, phone, amounts, names).
The demo runs entirely in your browser and sends nothing anywhere. Even so, please don't paste real sensitive data.
What Privacy recognizes
The employee types normally, what leaves is clean text
Illustrative interface preview
Corpilus caught the sensitive values and replaced them before sending.
- 01The employee changes nothingUses the same chat as before. No training, no new tool.
- 02Data is swapped for placeholdersThe model gets text with the same structure, so the reply is usable.
- 03A readable answer comes backThe swap back happens on your side; the mapping never leaves the company.
Employees use AI as before, through a protected channel — and the company can always show which data left and which didn't.
One toggle stops outgoing data entirely. Used during an audit or when an incident is suspected.
What happens to the data on the wayPseudonymisation, validation and DLP for AI channels
Five questions a lawyer and an IT administrator will both ask, answered without acronyms.Pattern recognition runs locally in the browser extension (Chrome, Edge; Manifest V3), with no network request. A deeper server-side check is optional and off by default.
A label instead of a name, not a blankPseudonymisation, not anonymisation (GDPR Art. 4(5))
A client's name becomes a label and comes back in the answer; the same name gets the same label everywhere, so the model still knows who is meant.
Reversible tokenisation: the same original string gets the same placeholder token within a text, the token → value map is built in the extension, and the answer is de-pseudonymised locally. Because the map can restore the data, the result is pseudonymised, not anonymous — legally it is still personal data.
An invoice number is not taken for a birth numberChecksum after a pattern match
Birth numbers and company IDs are checked by calculation; a string of digits that only looks like one stays unchanged.
Birth number: a valid month (including the offset used for women), a day that exists, and for the ten-digit form divisibility by eleven. IČO: a weighted mod 11 sum. Nine-digit birth numbers issued before 1954 have no check digit, and DIČ and VAT numbers have none at all; those are recognised only by shape and label, so false matches are possible there.
Warn, replace or hold backModes: warn, anonymize, redact and block
The extension can just report a finding, replace the data with labels, black it out, or stop the message. By default it replaces, so work can carry on.
A client-side policy with four modes; anonymize is the default. In block mode a prompt with a finding is not sent and only the cleaned version is offered; if the scan fails, sending stays blocked (fail closed). In the other modes a failed scan does not stop sending.
Only what the answer needs goes to the AIData minimisation, data protection by design, security of processing
To summarise a contract, the model doesn't need the client's name or account number. Recognised identifiers reach it only as labels.
Replacing identifiers before sending is a technical measure for the data-minimisation principle (Art. 5(1)(c)), for data protection by design and by default (Art. 25), and for security of processing, where Art. 32 names pseudonymisation explicitly. Whether the processing as a whole complies is for the controller to assess; the tool does not certify it.
When the AI calls toolsMCP: protection tools and an output filter
Claude Desktop or Cursor call the protection as a tool, and results from the other tools are checked before the assistant sees them.
The MCP server exposes tools for scanning, redacting and anonymising text. Output from the other tools passes through data protection: critical data is anonymised, and if that isn't possible the result is blocked; for high and medium risk the configured mode decides.
What stays in the browser and what leaves
The full pattern set ships with the extension, the text never leaves the device for it, and the check works with no network.
Files you ask it to check, the warning about hidden instructions in pasted text, and the optional deep check that also looks for names. The result comes back immediately; nothing is stored or shared with a third party.
Point the extension at your server's address and even these three checks stay inside your infrastructure.
Patterns for sk, cs, de, en, es, fr, it, pl and sr cover national identifiers, IBANs, payment cards, phone numbers, emails, postal codes and medical data. Names are found by the optional deep check.
A failed scan stops sending only in block mode; in the other modes the text goes through. Chrome updates extensions silently: an open AI tab keeps running the old code until you reload it — the extension detects this and offers to reload the tabs.
Attacks on your website, logins and the AI itself are Shield's job.
What Shield doesThree ways, depending on where you use AI
Browser extensionBrowser extension
Protection works right in the window where the employee types: in ChatGPT, Claude and Gemini.
An extension for Chrome and Edge (Manifest V3). Pattern matching runs locally, with no network request; it activates on sign-in to the workspace and checks nothing while signed out.
When the AI calls tools, or your application calls the AIMCP and API
Claude Desktop or Cursor can call the protection too, and so can applications that work with AI from their own code.
The MCP server exposes tools for scanning, redacting and anonymising text to Claude Desktop and Cursor; company applications call the same checks through the API.
Between your application and the AIProxy in front of the model
If your application sends requests to OpenAI or Anthropic, Corpilus can sit in between — described with Shield.
The proxy belongs to Shield; its setup and outage behaviour are described there.
Details with ShieldPrivacy, answered
What is Corpilus Privacy and how does it differ from Studio?
Privacy protects what employees type into ChatGPT, Claude or Gemini: client data is swapped for placeholder values before the text leaves, and restored in the answer. Studio is the assistant over your own documents and includes Privacy. If you only want to protect what goes into AI, Privacy is enough.
Do my texts leave for Corpilus servers?
Pattern matching runs right in the browser: the full pattern set ships with the extension, so the text never leaves your device for it. Only three things call Corpilus — files you ask it to check, the warning about hidden instructions in pasted text, and the optional deep check for names; the result comes back immediately and nothing is stored. With your own server or an NVIDIA DGX Spark, even those checks stay with you.
How does Privacy help with GDPR, including health data?
Replacing identifiers before sending is a technical measure for data minimisation and for security of processing. The result is pseudonymised, not anonymous — the data can be restored with the map, so legally it is still personal data. For health data we recommend block mode, which stops sending on a finding. This helps you meet the requirements; it is not a certification, and whether the processing as a whole complies is for the controller to assess.
What if the extension misses something? What are the guarantees?
No recognition of personal data gives an absolute guarantee, so the check has several layers: patterns with a checksum where one exists, and an optional deep check that also looks for names. The default mode is anonymize, i.e. replacement with a placeholder; the stricter option is block, where sending stops on any finding. Before sending you see the whole adjusted text, so the final say is yours.
What it looks like in practice
Sample scenarioNot references to specific clients, but typical situations.
An office where twelve people are already using AI
- — People pay for ChatGPT themselves and use it on client materials
- — An internal policy bans AI — in practice nobody follows it
- — In an audit, the company would not be able to show where client data went
- People work with AI openly, not in secret
- Client names, case numbers and amounts never leave
- In an audit, there is a record for every case
The biggest change isn't technical. The company stops pretending AI isn't used, and starts managing it.
Privacy protects the channel that runs through it. A photographed screen or an unprotected device is something no server-side layer stops — so alongside the technology you also need device protection and a clear agreement inside the company.
Let's start with measurement. You'll see what's happening in your company today.
First you see numbers from your own operation: how many bots, how much spam and what leaves for AI. What we turn on is your call after that.
Technical detailThe widget and the extension need no change to your application's code; SDK integration means adding middleware for Node.js, Python or PHP. Watching runs in monitor mode: events are recorded, nothing is stopped.