«Llevamos ya varios años trabajando con Thrax y la verdad es que estamos súper contentos. Nos gestionan la web, el programa de facturación y todo el tema de SEO, y el cambio se nota mucho.La web la dejaron limpia, rápida y fácil de usar tanto para nosotros como para los clientes.
El programa de facturación lo tienen muy bien montado: es intuitivo, nos ahorra un montón de tiempo y no hemos tenido ni un solo problema con las facturas ni con Hacienda.
En SEO también están haciendo un gran trabajo; hemos empezado a subir posiciones y a recibir más visitas orgánicas sin tener que preocuparnos nosotros.
Lo mejor es que responden rápido, son claros y se nota que saben lo que hacen. No es solo que cumplan, es que se involucran y proponen mejoras.
Sin duda los recomendaríamos a cualquiera que busque un equipo serio y profesional.»
AI security
before the scare
Your team already uses ChatGPT, Copilot or Gemini, with permission or without it. And if you have a chatbot or an agent, someone will try to trick it. We check what data leaves the business, what can be done to your AI and what the law requires of you, and leave you a plan to close the gaps. In Granollers and remotely.
Four fronts, one report
You can start with one. The final report says what to fix first.
AI usage audit
Which AI tools your staff use, with which accounts, what data reaches them and on what terms. Including what is used without anyone having approved it.
Chatbot and agent pentesting
We attack your assistant the way an outsider would: prompt injection, data leakage, tool abuse and excessive permissions. Based on the OWASP Top 10 for large language model applications.
EU AI Act and GDPR
An inventory of the AI systems you use, which risk level each one falls into under the EU AI Act and what obligations apply to you, together with those of the GDPR.
Policy and training
Internal rules for using AI, clear and workable, and training so your staff know what never to put into a chat and how to spot a trick.
What usually turns up in a review
This isn’t science fiction: these are configuration slips and habits.
Data in personal accounts
Contracts, payslips or customer data pasted into a free account, outside any contract with the business and sometimes used to train the model.
Hidden instructions
An email, a web page or a PDF with hidden text telling your assistant to break its rules. This is prompt injection, the top risk on the OWASP list.
Excessive permissions
An agent with access to the whole mailbox, the invoicing or the shared drive when its task only needed one folder. If it’s tricked, the damage reaches as far as its permissions do.
Answers that commit you
A chatbot that promises a discount, makes up a condition or lets slip internal information. Whatever it says on your website, your business is saying.
Five steps, with written permission
We touch nothing without signed authorisation or outside what was agreed.
Scope
We agree what gets reviewed: your staff’s tools, a chatbot, an agent or all of it. And we put it in writing, signed.
Inventory
We list the AI tools in use, who uses them, with what data and under what contract.
Testing
We test the systems within scope, in the agreed environment and without affecting your customers.
Report
Each finding with its severity, how to reproduce it and how to fix it, in language that management understands, not just the technical team.
Fixes and retest
We help you close what we found and repeat the test to check it no longer works.
What we won’t do, and why
A security review is built on trust. These are our rules.
We don’t test without permission
We only attack systems that are yours or that you have the right to test, with written authorisation and within the signed scope. Never a third party’s.
Nor do we keep your data
What we see during the review is used only for the report and deleted when the job is closed, with a confidentiality agreement if you need one.
Nor hand out seals that don’t exist
We tell you what the rules require and how to comply, but we don’t issue official compliance certificates. If you need one, we tell you which one and who issues it.
Nor do we monitor your staff
The audit looks at tools, accounts and settings, not at what each person writes. The point is to close the door, not to find someone to blame.
AI security pricing
Indicative starting prices. The exact quote depends on the scope, and we give it to you signed before we start.
Your staff, prepared.
- Internal AI use policy
- Hands-on risk training
- In person or by video call
- Guide for new joiners
What leaves your business.
- Inventory of tools and accounts
- Review of data and contracts
- Classification under the AI Act
- Report with an action plan
Your chatbot, put to the test.
- Prompt injection and data leakage
- Permissions and tool use
- Report with reproducible tests
- Retest after fixes
// Reference prices, VAT not included · final quote depends on scope
What people usually ask
What is shadow AI?+
It’s the AI used in a business without anyone having decided to use it: personal ChatGPT accounts, browser extensions that summarise emails, meeting transcribers or mobile apps. There’s rarely any bad intent, just a wish to work faster. The problem is that the data leaves the business with no contract, no control over who sees it and, sometimes, to train the model. The audit brings it to light and proposes approved alternatives, because banning things without offering another option doesn’t work.What does the EU AI Act require of me?+
It depends on how you use AI. Regulation (EU) 2024/1689 classifies uses by risk level: some practices are banned, others are high-risk and have strict requirements, such as AI that screens candidates in a recruitment process, and most SME uses carry lighter obligations, such as telling people they are talking to an AI. It applies in phases and some deadlines are under review in the European Union, so we tell you what applies to you under the rules in force on the day of the audit, not from a generic summary.What is prompt injection?+
It’s the most common attack on a chatbot or an agent. It involves slipping instructions into the text it processes: a user’s message, an email, a web page or a document with hidden text. If the assistant isn’t properly protected, it obeys: it reveals its configuration, shows other customers’ data or uses its tools for something it shouldn’t. There’s no single fix. The risk is reduced by limiting permissions, separating what is an instruction from what is data, filtering inputs and outputs and checking it all with tests like ours.Do you test ChatGPT or Copilot?+
Not the platform itself: it belongs to the provider and we have no permission to attack it. What we do review is how your business has it set up: which accounts there are, what data reaches it, which connectors are switched on, such as email, SharePoint or Drive, and who can see what. Attack testing is done on what is yours: your chatbot, your agent or your integration.How long does an audit take?+
It depends on the number of people, tools and systems within scope. We set the timeframe in the quote, in writing, before we start, together with the report delivery date.Is my data safe during the audit?+
We work with the minimum access, read-only whenever possible, and sign a confidentiality agreement if you ask. What we see is used only for the report and deleted at the end. If doing the work means we process personal data of yours, we are data processors under the GDPR and we set that out in a signed contract.Do you work remotely?+
Yes. The audit, the testing and the training can be done remotely, so we work with businesses outside the Vallès, including in Andorra. Calls and training sessions are in Spanish or Catalan; in English we work with you in writing, by email or WhatsApp. If you’d rather we came, in the Vallès Oriental we come to your office.All things tech, one team
What our clients say
Our clients write them on Google and we show them here exactly as they are.
«Muy rapidos y professionales, lo recomiendo 100%»
«Cámaras de seguridad · Canovelles
Instalaron las cámaras del negocio de forma muy limpia y ahora podemos verlo todo desde el móvil. Muy profesionales y atentos durante todo el proceso.»
«Llevamos el ordenador con varios problemas y nos explicaron todo de forma clara. Diagnóstico rápido, presupuesto cerrado y trato excelente.»
«Gran servicio! Contacté por WhatsApp con ellos y pasando un par de fotos para entender la instalación que requería tenía un presupuesto aproximado y cita para el día siguiente. Trabajo limpio y rápido.»
See your AI
like an attacker.
Tell us which tools you use or which assistant you have, and we’ll tell you what we’d review, how long it takes and how much it costs, with no obligation.
644 836 122CALL US OR WHATSAPPLet’s talk about your AI security
Fill this in and we'll call you. Simple.