Kryphos Request a demo

Your team keeps the AI. The data stays home.

Kryphos is a Chrome extension for banks, NBFCs and fintechs. It removes customer data from prompts before they reach ChatGPT, Claude or Gemini, and puts it back in the reply.

Request a demo See how it works
Where detection runs
In the browser, on the employee’s device
What it detects
34 rules plus our own model
Indian ID types
9, several checksum-verified
What IT installs
One Chrome extension. No proxy.

One prompt, three views

Example values. Not real customer data.

On the employee’s device

1 What the employee types

Summarise this complaint from Rohit Sharma, account 50100234567812, PAN ABCPS1234K, about a failed EMI of ₹38,000.

Kryphos scans this on the device.

Leaves the device

2 What ChatGPT receives

Summarise this complaint from [PERSON_1], account [ACCOUNT_1], PAN [PAN_1], about a failed EMI of ₹38,000.

Placeholders only. The real values never leave the browser.

Back on the device

3 What your employee sees

Rohit Sharma’s EMI of ₹38,000 from account 50100234567812 failed. The customer asks why, and whether a bounce charge applies. Next step: confirm the reason and share the new debit date.

Real values put back into the AI’s reply.

3 values found on this device: 1 name, 1 account number, 1 PAN. Sent as placeholders. Restored in the reply.

AI is already in your bank. The question is what it sees.

  1. Employees paste customer data into AI tools every day.

    A complaint to summarise. A loan note to tidy up. A statement to reconcile. It saves time, so it happens.

  2. Once a prompt is sent, the data has left the company.

    There is no recall button. You no longer decide where it is stored or for how long.

  3. Banning AI moves the habit to personal phones.

    The work still gets done. It just happens where you have no visibility at all.

DPDP Act: the Rules were notified in November 2025. Full compliance is due 13 May 2027, and penalties can reach ₹250 crore.

Four steps. None of them need the employee.

  1. 01

    Detect

    Before a message is sent, Kryphos finds sensitive data on the employee’s own device: Aadhaar, PAN, account and card numbers, GSTIN, IFSC, UPI IDs, customer names.

    Found2345 6789 0123

  2. 02

    Replace

    Each value is swapped for a placeholder that names its type, so the AI can still follow the request.

    Becomes[AADHAAR_1]

  3. 03

    Send

    The AI tool only ever receives placeholders. It reads the request and answers it as usual.

    Sent[AADHAAR_1]

  4. 04

    Restore

    When the reply comes back, Kryphos puts the real values in. The employee sees a normal, complete answer.

    Shown2345 6789 0123

Designed around Indian data, and around how people actually work.

On the device, not on our servers. Detection runs entirely in the browser, on the employee’s machine. Customer text is not sent to Kryphos.

Built for Indian IDs. Nine Indian ID types: Aadhaar, PAN, GSTIN, IFSC, UPI ID, CIN, TAN, voter ID and UTR. Alongside account numbers, card numbers and customer names. 34 detection rules in all, plus our own AI model.

Checksum-verified. Several IDs are checked against their official checksums: Verhoeff for Aadhaar, Luhn for cards. A number that only looks like an ID is not flagged as one. That means fewer false alarms.

Restore, not block. The employee gets a complete answer with the real values back in place. The exception is secrets: passwords, PINs, OTPs and API keys are blocked outright.

Nothing for employees to learn. No pop-ups. No new tool. People keep using ChatGPT, Claude and Gemini the way they already do.

An audit trail for the DPDP Act. The admin dashboard records categories and counts, never the values themselves. A record you can show when asked.

For security and compliance teams

Roll it out once. Set policy in one place.

IT deploys Kryphos company-wide through Chrome’s standard management settings. No proxy, no new hardware, no network change.

Company-wide settings
One policy for every browser in the organisation.
Audit trail
Categories and counts, not the data. Useful as evidence under the DPDP Act.
Secrets blocked
Passwords, PINs, OTPs and API keys never get sent.
Example Bank Ltd Sample data
Detections this week, by category. Sample data.
CategoryEvents this weekRelative volumeAction
Customer names1,284Replaced
Account numbers963Replaced
Aadhaar412Replaced
PAN277Replaced
UPI IDs96Replaced
Card numbers41Replaced
Passwords / OTPs9Blocked
Counts only. No values are stored.

The founders.

  • Aarav Agarwal

    Thapar Institute of Engineering & Technology

  • Manan Jain

    Delhi Technological University

  • Ashmit Choudhary

    IIIT Delhi

Running a pilot? We’re working with a small number of early teams.

We have a working prototype and are setting up early pilots with banks, NBFCs and fintechs. If you want to see it working, write to us.

Email us