These are the questions that come up on almost every first call, with the answers I give on the call.
How long does this take?
A pilot on your own data runs two weeks. If the process is unclear or several departments disagree about how it actually works, consulting comes first: one to three weeks, ending in a written plan. Full rollout depends on how many systems have to be touched — that number comes out of the pilot, not out of a brochure.
What do I need from you?
Three things, always. Your documents in the state they are in today — structuring them is part of the work, not a prerequisite. One person who can answer "what is the actual rule here?" when the documents contradict each other. And a group of people who will actually use it for two weeks.
The rest depends on the case. Say it is an HR assistant in a company of about 200: a pilot group of 10 to 20 employees is enough for the real questions to show up. If the job is reading incoming CVs instead, what I need is 30 to 50 real CVs from your pipeline — anonymised is fine — plus the fields your ATS expects. For contract review it is 20 to 50 typical contracts from your archive and a note of the positions you consider normal. The numbers are about coverage rather than volume: enough material for the awkward cases to appear.
Who owns the result?
You do: the prompts, the configuration, the indexes built from your documents and the conversation logs. If we part ways, you get the lot and can keep running it. Nothing in what I build depends on my staying involved.
What happens when the agent gets something wrong?
First, what "wrong" means here. The agent does not make answers up: it answers from what it found in your documents and in the employee's own record, and it names the section it used. If your policies do not contradict each other, it does not get the rule wrong. Mistakes live where the documents disagree with themselves or where the answer is simply not in them.
So three things are built in from the start. Every answer names the policy section it came from, so an employee can check it in a second. Questions outside its scope get handed to a human instead of guessed at. And every change to prompts or data is run against a fixed set of questions with known-good answers — 30 questions across 13 categories for the HR assistant — so a fix for one case cannot quietly break another. When the documents turn out to contradict each other, that is a finding worth having: we write down the rule, and the contradiction stops biting your people too.
Where does your data go?
Managed: to a European data centre of one of the big clouds — Azure or AWS — and to the model provider's API, Anthropic or OpenAI, under a data processing agreement. Your data is not used to train models. Self-hosted: nowhere — the model runs on your hardware and answers never leave your network. The self-hosted page goes through the trade-offs.
Do your people have to learn a new tool?
No. The agent goes where they already are: a web chat on your intranet, a Telegram bot open only to staff, or an API call from the system they use all day. Asking it something looks like writing a message to a colleague.
Can we start with one process?
That is the only way I start. One process, one pilot group, two weeks, real numbers. Everything else is a decision you make afterwards with data in hand.
What does it cost to run?
Running cost is priced per unit of work, and it is small: roughly €0.10 per HR dialog or €0.06 per outreach lead on the managed option, cents where a person costs euros. Self-hosted turns that into hardware once and electricity after. Implementation is quoted per project once I have seen the process — I do not have a price list, because the same agent on a tidy process and on a tangled one are different amounts of work.
You already pay for ChatGPT. Why add an agent?
Because a subscription knows nothing about your company, and nobody pastes forty pages of policy into a chat window before asking a question. The comparison page covers where a subscription is enough and where it stops being enough.
Will it work in Ukrainian and Polish?
Yes. Agents answer in the language of the question — English, Ukrainian, Polish — and they cope with how people actually write: slang, typos, half-finished sentences.
What if someone tries to trick it?
Assume someone will, and not always from outside — the likelier case is a curious employee trying to see what a colleague earns. The defence is layered, because no single check catches everything.
- Whatever a person writes is wrapped and handed to the model as data, under instructions saying that nothing inside those tags may be followed as a command.
- Before the agent sees a message, a pre-filter looks for what an attack leaves behind whatever language it is written in: fake system markers, invisible and right-to-left characters, words built from two alphabets at once, base64 blobs, and closeness to a library of known attack phrasings, measured by a multilingual embedding model.
- A separate scanner model then reads the whole message and answers in one word. A triggered pre-filter blocks nothing by itself — it switches the scanner to a stricter prompt, and the decision stays with the model.
- A session that keeps trying is closed after the second attempt, and the attempt is logged with its text so you can see what was tried.
- For the sales agent the same scan runs on incoming email, so a stranger's reply cannot reprogram it.
Those numbers come from a fixed test set — a golden set. It holds 47 attack attempts written by hand, from a blunt "ignore your instructions" to an injection buried inside an otherwise normal HR question, plus 60 ordinary questions that have to pass through untouched. The whole set is re-run after every change to the prompts or the filter, so a rule tightened one week that starts refusing real questions the next shows up in the run instead of in front of your people. On the demo chat the current result is 47 of 47 attacks stopped and 60 of 60 ordinary questions answered.
Could it show one employee another employee's data?
It has nothing to show. The employee card comes to the agent from your own system, for the person already logged in there — the agent never asks for it and cannot ask for anybody else's. It has no connectors: no database credentials, no HR-system API, no access to a file share. What it can read is what your system passed it for this one conversation, plus the company documents everyone is allowed to read anyway.
There is no memory between sessions either. A new conversation starts empty, so nothing carries over from one person's chat into another's, and "tell me what the previous user asked" has nothing to retrieve.
What if you want to stop?
You keep the artifacts and switch it off. There is no proprietary format to escape from: the agent is a set of files, a database and a model — all of which you already have a copy of.
Longer answers, on their own pages
- Self-hosted — what changes when the model runs on your hardware, what it costs and what you give up.
- Agent or a ChatGPT subscription — where a subscription is genuinely enough and where it stops being enough.
- The two-week pilot — week by week, what I need and what you hold at the end.
- Scenarios — the same work priced per unit, with people and with an agent.
- The six agents — what each one does and what it needs before it goes live.
Anything not answered here is a better conversation than a paragraph. Book a call.