A gate on the way from the company to external artificial intelligence (AI) models, installed on the customer’s premises or hosted by CAI in the European Union. It keeps sensitive data from reaching the external AI without blocking the team’s work.
What the user writes
Rewrite this more politely: Ioana Marinescu, of Str. Lalelelor 7, owes RON 18,400, to be paid into account RO49 AAAA 1B31 0075 9384 0000 by 30 November.
What the external model receives
Rewrite this more politely: person, of address, owes amount, to be paid into account IBAN by 30 November.
What the user reads
Dear Ioana Marinescu, we would be grateful if you could pay RON 18,400 into account RO49 AAAA 1B31 0075 9384 0000 by 30 November. We will continue to write to you at Str. Lalelelor 7.
An example with made-up data; amounts are in RON (Romanian lei), and IBAN is the international bank account number. The stand-ins are drawn here as data-class labels.
Employees have been pasting work documents into public chatbots for a few years now, and data protection authorities have started to see the consequences.
Eindhoven shows the second half of the problem: once the files had gone, the municipality could no longer establish how much had gone. A ban on its own is not enough either, as the survey above shows. JANUS-Edge starts from the other side: the AI gets used, and every request is decided on and logged before it goes out to the external model.
JANUS-Edge sits between users or applications and the external AI models, on the company’s own server or, in the hosted form, at CAI in the European Union (EU). Every request goes through the same gate.
For each data class, the policy says what happens at the gate, and there none of these four settings lets a sensitive value leave as it is. In the browser, on sites outside the list, the policy can also ask only for a warning to the user instead of a block.
Notifications go to the company’s SIEM (security information and event management system), by webhook or by email, and carry no sensitive data. Data types come in sector packs: banking, healthcare, public sector, legal, human resources, IT secrets. The system can propose new types from the company’s own traffic, and they go live only after observation and approval.
Installation starts in observation mode. Requests already leave with stand-ins, and the report shows what the target policy would have stopped. Observation has a deadline, so that it does not become the permanent state.
The full reasoning for the forms installed on the customer’s premises, with the studies it rests on and their limits, is in the article “Let AI work on your company’s data without ever seeing it”.
No single control point sees all the traffic going to AI. JANUS-Edge has three, run from the same policy; the gate and the browser use the same data classes.
Internal applications, scripts, overnight jobs and coding tools with a configurable endpoint send their requests through the gate, with no other change to the code. Everything described above works here, putting values back included.
swaps, checks, puts backAn extension and an endpoint agent see pastes, uploads and submissions on AI pages, in the Chrome and Microsoft Edge browsers the company manages. On listed sites, pasted text and text written in the extension’s input box leave with stand-ins, and real values appear only in the extension’s panel, never in the provider’s page.
warns, blocks, swapsThrough the web gateway the company already has, personal accounts with AI providers are stopped wherever the provider offers a way to do it; otherwise the whole domain is blocked, the company account included. The providers’ desktop apps are handled here; on company phones, AI apps are blocked.
the company account passes, the rest does notThe same signed release runs in four forms. What differs between them is where each component sits.
| Component | VM on premises | Appliance | Hybrid | SaaS in the EU |
|---|---|---|---|---|
| Detection of sensitive data | on premises | on premises | on premises | at CAI, in the EU |
| Real values and their link to the stand-ins | on premises | on premises | on premises | at CAI, in the EU; with BYOK, under the customer’s key |
| The log | on premises, anchored on another of the customer’s machines | on premises, anchored outside the box | on premises; the console receives only signed log fingerprints, with no content | at CAI, kept separate per customer, verifiable by the customer |
| The wrapping key | on premises | on premises | on premises | can be the customer’s own (BYOK), which the customer can revoke |
| The console | on premises | on premises | at CAI, with no data: counters and log fingerprints | at CAI |
With VM, appliance and hybrid, real values do not leave the company network, not even to CAI Technology. With SaaS, real values pass through JANUS hosted by CAI in the EU and do not reach the AI provider; the wrapping key can be the customer’s own (BYOK), and the customer can revoke it. In hybrid, the hosted console cannot switch on or relax a policy without the signatures of the customer’s approvers.
Updates arrive as signed packages, install without internet access too, and roll back to the previous version on their own if verification fails. Detection models are pinned to a fixed revision.
JANUS-Edge uses what the company already has: the SIEM, via syslog or CEF (Common Event Format); the identity provider, via OIDC (OpenID Connect, federated sign-in); an HSM (hardware security module) or a key vault; the web gateway; browser policies pushed through MDM (mobile device management) or Windows Group Policy.
We do not publish a single global coverage percentage. Detection can miss a value, so coverage is measured per data class: on a Romanian evaluation set and, during the pilot, on the customer’s own traffic. For each channel we say what the product does and what stays outside it.
| Channel | What JANUS-Edge does |
|---|---|
| Applications and scripts that call a model through an API (application programming interface) | swaps, checks the answer, puts values back |
| Models on the company’s own premises | the same policy and the same log; the route for texts that cannot be masked |
| Coding tools with a configurable endpoint | go through the gate, like applications; tool arguments, such as file edits, keep the stand-ins |
| AI pages in the managed browser, on listed sites | swaps on paste and in the extension’s input box; text typed straight into the page is checked on submit and blocked if the policy says so; real values only in the extension’s panel |
| Other sites, in the managed browser | what is pasted or uploaded gets a verdict: it passes if it holds no sensitive data; otherwise the user is warned or the transfer is blocked, as the policy says |
| Browsers other than managed Chrome and Microsoft Edge | not covered |
| The providers’ desktop apps | company account only, and blocking |
| Third-party AI apps on company phones | blocking only |
| Text typed straight into the provider’s page | the page sees it before it is sent; the extension’s input box is the alternative |
| Voice and real-time conversations | not covered |
| Personal phones on mobile data | not covered; the company can limit it by managing its work apps, outside the product |
| The AI assistant built into the office suite, on company data in the cloud | not covered: the model reads the files without going through the gate |
| Connectors that run in the provider’s cloud | not covered |
| Photographs of the screen | not covered |
One limit is not about channels: masked is not the same as anonymous. Even where masking works well, the context left in clear can help re-identify a person, and we measure re-identification with an attacker.
For companies that want to use AI on documents holding customer, patient or employee data and to be able to show what left: banks and insurers, healthcare, law firms and notaries, public administration, human resources, software companies with their own code and keys.
Inside the company, three roles use it. The CISO (chief information security officer) sees the policy, the log and the alerts in the systems already in place, and the DPO (data protection officer) gets reports without sensitive content. For the IT team, the gate installs without users changing the way they work.
The first delivery is for teams with internal AI applications or models on their own premises, because there the gate goes in by changing only the address requests are sent to. That is the traffic a browser extension does not see: internal applications, scripts, overnight jobs. Text pasted into public chatbots, as in the cases above, can be seen and blocked by the managed browser at the fourth step on the roadmap; swapping on the web comes at the fifth step, and swapping inside files at the sixth.
Adoption in Romania is only starting, and across the EU data protection is one of the reasons companies give for holding back. The gate answers that reason directly, because it lets AI be used on real data.
The AI Act (Regulation (EU) 2024/1689) applies in stages from 2 February 2025, with 2 August 2026 as the general date of application, and Regulation (EU) 2026/1744 moved the rules for high-risk AI systems to 2 December 2027 and 2 August 2028.[9] [10] The NIS2 Directive (the second Network and Information Security Directive) required Member States to apply their national measures from 18 October 2024; Romania transposed it through Government Emergency Ordinance 155/2024 (OUG 155/2024), approved by Law 124/2025.[11] [12]
There is a technical reason as well. Open-weight models, the kind that can run on a company’s own premises, have come close to the best closed models: on the Arena leaderboard the gap was 3.4% in March 2026, after 15.2% in May 2023 and 0.5% in August 2024.[13] The smallest model to score above 60% on MMLU (Massive Multitask Language Understanding, a knowledge test across many subjects) went down from 540 billion to 3.8 billion parameters between 2022 and 2024.[14] That is why the route to the model on your own premises can carry everyday work.
In July 2025, Gartner forecast worldwide information security spending at 213 billion US dollars (USD) in 2025 and USD 240 billion in 2026.[15] In August 2026, it put the market for securing AI at almost USD 4.8 billion in 2027, 68.7% above 2026, and at almost USD 7.7 billion in 2028. In 2027, the fastest growth is in AI usage control (+73%, USD 749 million) and AI gateways (+70.9%, USD 429 million).[16] The JANUS-Edge gate belongs with AI gateways, and the managed browser and accounts with AI usage control.
Public list prices on the large cloud software marketplaces and the cloud providers’ pricing pages, read on 10 November 2026, show how the category is sold. Some listings point explicitly to negotiated private offers, so the figures are reference points only.
| Category | List price | How it is sold |
|---|---|---|
| Dedicated tools for controlling the use of generative AI | USD 36–180 per user per year (36: a plan for a single AI assistant; 180: at least 1,000 users); most between 60 and 163[17] | per user; some with a minimum number of users |
| DLP (data loss prevention) platforms with an AI component | USD 275 and 352 per user per year, in two listings[18] | per user |
| SSE (security service edge) suites, delivered from the cloud for web and applications | USD 315–624 per user per year, by edition[19] | in blocks of users |
| Detecting and swapping sensitive data, at volume | USD 0.10–1 per 1,000 text units of up to 1,000 characters each[20] | pay as you go |
| AI security modules with an annual fee, gateways for large language models included | USD 10,000–50,000 a year (at USD 10,000 the listing points to a negotiated price); full platforms, USD 100,000–325,000[21] | annual commitment |
For a market defined differently, AI governance as a whole, Forrester expected in November 2024 software spending of USD 15.8 billion in 2030; the figure is not comparable with the Gartner figures above.[22]
We sell in four forms: VM on premises, appliance, hybrid and SaaS in the EU. It starts with a pilot on a single channel, on the customer’s real traffic. At the end of the pilot, the customer keeps the log of the run and the coverage measured on its own data classes.
Taken one by one, the pieces are not new. An intermediary that masks before the model and puts values back in the answer is available today in free projects and in paid products. Routing to a local model exists in open projects and in peer-reviewed work. Large data loss prevention products already carry a data type for the Romanian personal numeric code.
From what we checked, without claiming an exhaustive search, we did not find the combination we are building put together anywhere else:
We ship from the inside out. The order is fixed, and we set the calendar dates together with the first customers.
JANUS-Edge is made by CAI Technology (CAI TECHNOLOGY S.R.L., a Romanian limited liability company), a technology company based in Bucharest. It belongs to the JANUS product family, described at synapse-eu.eu, alongside JANUS Core, Data and Med.
We also make CAI-Healer, an autonomous agentic platform for testing, verifying and repairing software products, in which every repair is independently verified and signed.
We are looking for investors for the next stages of JANUS-Edge. If you invest in data security, in AI infrastructure for Europe or in Romanian software with a market in the EU, we would welcome a conversation. We will walk you through the code, the roadmap and its stages, and what we measure before we claim anything. On the contact page, under “Application of interest”, choose “JANUS — sovereign synthetic data”, the JANUS family, and start your message with “JANUS-Edge, investors”.
Only in the extension’s own windows, such as the side panel, never in the provider’s page. The page’s scripts read and resend whatever is in it, so the extension never puts real values back into it.
For each data class, the policy sets how far a value keeps the same stand-in: a single request, a conversation or, only with separate approval, all of the customer’s conversations. The default is the conversation, so the same stand-in does not tie different conversations about one person together. Context left in clear can still help link them, and we measure that with an attacker.
We do not rewrite their traffic, because their private protocols change without notice. For desktop apps the product allows only the company account and blocks the rest, through the web gateway the company already has. On company phones, AI apps are blocked.
Types come in sector packs (banking, healthcare, public sector, legal, human resources, IT secrets) and cover, for example, personal names, addresses, personal numeric codes, company tax codes, IBANs, card numbers and access keys. The system can propose new types from the company’s own traffic, and they go live only after observation and approval.
It can, and the literature shows it. That is why the loss is measured during the pilot, on each customer’s own tasks, and texts that cannot be masked without losing their meaning go to the model on your own premises.
All links were opened on 10 November 2026.