Your team keeps the AI. The data stays home.
Kryphos is a Chrome extension for banks, NBFCs and fintechs. It removes customer data from prompts before they reach ChatGPT, Claude or Gemini, and puts it back in the reply.
- Where detection runs
- In the browser, on the employee’s device
- What it detects
- 34 rules plus our own model
- Indian ID types
- 9, several checksum-verified
- What IT installs
- One Chrome extension. No proxy.
On the employee’s device
1 What the employee types
Summarise this complaint from Rohit Sharma, account 50100234567812, PAN ABCPS1234K, about a failed EMI of ₹38,000.
Kryphos scans this on the device.
Leaves the device
2 What ChatGPT receives
Summarise this complaint from [PERSON_1], account [ACCOUNT_1], PAN [PAN_1], about a failed EMI of ₹38,000.
Placeholders only. The real values never leave the browser.
Back on the device
3 What your employee sees
Rohit Sharma’s EMI of ₹38,000 from account 50100234567812 failed. The customer asks why, and whether a bounce charge applies. Next step: confirm the reason and share the new debit date.
Real values put back into the AI’s reply.
3 values found on this device: 1 name, 1 account number, 1 PAN. Sent as placeholders. Restored in the reply.
AI is already in your bank. The question is what it sees.
-
Employees paste customer data into AI tools every day.
A complaint to summarise. A loan note to tidy up. A statement to reconcile. It saves time, so it happens.
-
Once a prompt is sent, the data has left the company.
There is no recall button. You no longer decide where it is stored or for how long.
-
Banning AI moves the habit to personal phones.
The work still gets done. It just happens where you have no visibility at all.
DPDP Act: the Rules were notified in November 2025. Full compliance is due 13 May 2027, and penalties can reach ₹250 crore.
Four steps. None of them need the employee.
-
01
Detect
Before a message is sent, Kryphos finds sensitive data on the employee’s own device: Aadhaar, PAN, account and card numbers, GSTIN, IFSC, UPI IDs, customer names.
Found2345 6789 0123
-
02
Replace
Each value is swapped for a placeholder that names its type, so the AI can still follow the request.
Becomes
[AADHAAR_1] -
03
Send
The AI tool only ever receives placeholders. It reads the request and answers it as usual.
Sent
[AADHAAR_1] -
04
Restore
When the reply comes back, Kryphos puts the real values in. The employee sees a normal, complete answer.
Shown2345 6789 0123
Designed around Indian data, and around how people actually work.
On the device, not on our servers. Detection runs entirely in the browser, on the employee’s machine. Customer text is not sent to Kryphos.
Built for Indian IDs. Nine Indian ID types: Aadhaar, PAN, GSTIN, IFSC, UPI ID, CIN, TAN, voter ID and UTR. Alongside account numbers, card numbers and customer names. 34 detection rules in all, plus our own AI model.
Checksum-verified. Several IDs are checked against their official checksums: Verhoeff for Aadhaar, Luhn for cards. A number that only looks like an ID is not flagged as one. That means fewer false alarms.
Restore, not block. The employee gets a complete answer with the real values back in place. The exception is secrets: passwords, PINs, OTPs and API keys are blocked outright.
Nothing for employees to learn. No pop-ups. No new tool. People keep using ChatGPT, Claude and Gemini the way they already do.
An audit trail for the DPDP Act. The admin dashboard records categories and counts, never the values themselves. A record you can show when asked.
For security and compliance teams
Roll it out once. Set policy in one place.
IT deploys Kryphos company-wide through Chrome’s standard management settings. No proxy, no new hardware, no network change.
- Company-wide settings
- One policy for every browser in the organisation.
- Audit trail
- Categories and counts, not the data. Useful as evidence under the DPDP Act.
- Secrets blocked
- Passwords, PINs, OTPs and API keys never get sent.
| Category | Events this week | Relative volume | Action |
|---|---|---|---|
| Customer names | 1,284 | Replaced | |
| Account numbers | 963 | Replaced | |
| Aadhaar | 412 | Replaced | |
| PAN | 277 | Replaced | |
| UPI IDs | 96 | Replaced | |
| Card numbers | 41 | Replaced | |
| Passwords / OTPs | 9 | Blocked |
The founders.
Aarav Agarwal
Thapar Institute of Engineering & Technology
Manan Jain
Delhi Technological University
Ashmit Choudhary
IIIT Delhi
Running a pilot? We’re working with a small number of early teams.
We have a working prototype and are setting up early pilots with banks, NBFCs and fintechs. If you want to see it working, write to us.
Email us