Security & data protection
Data protection is the product.
Everything else is built on it.
Client identifiers are sealed inside your own network, with a key only you hold, before any request reaches us or an AI model. Neither we nor the model provider can read them.
Why regulated firms hold back
Your clients trusted you with their data.
Not your AI vendor.
Generic AI assistants work by sending what your staff type to servers you do not control. For a firm that holds account numbers, identity documents and portfolios, that one step is where the regulatory, contractual and reputational risk sits.
Data protection
Minimise and pseudonymise
GDPR expects the least data necessary, protected by design — pseudonymisation is named as a safeguard.
Operational resilience
Control third-party ICT risk
DORA makes every ICT provider part of your risk register — including the AI behind it.
Client confidentiality
Keep the promise you made
Mandates and professional secrecy do not have an exception for a helpful chatbot.
The core of the platform
Client identifiers stay in your network.
Everything else, we run.
You install one component — the Cypria Gate — in your own environment. It seals client identifiers with a key only you hold before any request leaves, and restores them only for the person who asked.
Fails closed
No key or no valid configuration — no traffic. It never falls back to sending raw data.
Signed configuration
Settings arrive cryptographically signed; tampered or rolled-back bundles are rejected.
Metadata only
The Gate reports counts and timings — never message content.
Yours to inspect
Runs as a container in your cloud; your team can audit and operate it.
One request, end to end
Follow one request.
See exactly who reads what.
The same identifier always becomes the same alias, so an agent can reason across a whole conversation — and a whole client file — without ever seeing the number itself.
| Who | Reads real identifiers? |
|---|---|
| Your adviser Their own question and answer, in their browser. | ✓ Yes |
| Cypria Gate (your cloud) Seals and restores; stores nothing and logs no content. | ✓ In memory |
| CypriaAI Aliases and sealed tokens it has no key to open. | ✕ No |
| AI model provider Aliases such as [IBAN_7K2M9Q] only. | ✕ No |
| Anyone else Traffic stays encrypted, on your own web address. | ✕ No |
01 · In your network
Your adviser types
Prepare the annual review for the client with ID card 881234, account CY17 0020 0128 0000 0012 0052 7600, and email it to a.k@mail.cy.02 · Leaves your network
The Gate sends
Prepare the annual review for the client with ID card [CY_ID_4H7Q2M], account [IBAN_7K2M9Q], and email it to [EMAIL_9R3T1X].+ sealed tokens sv1.k3.Gx7… sv1.k3.p2M… sv1.k3.Ta9… — unreadable without your key
03 · CypriaAI + model
The agent sees
Aliases only. It plans the review, works through the steps and drafts the answer using [IBAN_7K2M9Q] wherever the account is meant.04 · Back in your network
Your adviser reads
Annual review drafted for account CY17 0020 0128 0000 0012 0052 7600 … values restored by the Gate, in memory, for this person only.
What we protect
We spot the details that identify your clients.
And lock them before they leave.
Account numbers, ID cards, passports, phone numbers and emails are recognised automatically and sealed. Each one is double-checked first — so a real IBAN is protected, while an ordinary number like an invoice total is left alone.
ID and tax numbers
National ID cards and tax numbers from 38 countries, including Cyprus and Greece.
Bank accounts and cards
IBANs and payment card numbers.
Phone numbers and emails
The ways your clients can be reached.
Passports
Passport numbers, including the machine-readable code line.
Your own formats
Add your client reference or portfolio codes, and we protect those too.
Coming next
Client names and home addresses.
See all 38 countries
Where your data lives
You choose where
everything lives.
Nothing that identifies your clients has to leave your control.
Your clients' details and your key
With you
Stay inside your own systems. They never leave.
Your documents
With you
Stay in your own cloud storage, in the country you choose.
The CypriaAI platform
In the EU
Runs in Frankfurt, Germany — and only ever sees sealed placeholders.
The AI models
Your choice
Pick a well-known provider for each task, or run models on your own servers.
Defence in depth
Eight checks on every request.
None of them optional.
Each control is enforced by the platform on every request — not written into a prompt and hoped for.
01
Scope
Requests outside the agent's job are refused before any work or spend.
02
Injection check
Attempts to override instructions are scored and blocked or escalated.
03
Sealing
Client identifiers sealed in your network with your key.
04
Isolation
Every look-up confined to your organisation's own records.
05
Permissions
The agent borrows the asker's access — never more.
06
Read-only
Data sources are queried read-only, limited to the tables you name.
07
Budget
Hard ceiling on steps and spend per request; it stops at the line.
08
Audit
Every action and change recorded — who, what, when, before and after.
Platform security
The basics, done properly.
Two-factor sign-in
Accounts protected with an authenticator app, and role-based permissions in the console.
Organisation isolation
Every look-up is confined to your organisation's own records, on every request.
Encrypted credentials
Model provider keys and storage connection details are encrypted per organisation.
Encrypted in transit
All traffic is encrypted, with mutual TLS between your Gate and our platform.
Full audit trail
Who did what, when — including the settings before and after every change.
Fails closed
If the Gate has no key or no valid configuration, nothing is sent at all.
On our roadmap — not built yet
Names and home addresses
Detected by a model that runs inside your Gate, alongside today's identifier checks.
Data returned by your systems
Sealing extended from what people type to what agents read back from connected systems and files.
Single sign-on
Sign in to the console with your existing identity provider.
Start with the work you choose