Welcome to our office.
We build free, open-source AI tools for everyday office work, provide cybersecurity and data protection consultancy to keep you compliant, and run hands-on trainings that boost productivity and performance.
ROOM
AI answers from our own pages. Not legal advice. Privacy
We
- build free, open-source AI tools for everyday office work.
- provide cybersecurity and data protection consultancy to keep you compliant.
- run hands-on trainings that boost productivity and performance.
Where to next?
I need an AI tool
Free and open source: audit a computer, check an AI use case, ask about documents, make marketing content.
I need a training
Hands-on, with AI: cybersecurity, project management, digital marketing, GDPR.
I need consultancy
Quoted per service: GDPR audit, AI Act, NIS2, DORA, CRA, ISO 27001.
Free, open source, and they stay on your device.
Arx Security check for your computerLIVE
Arx checks the security settings of a Mac, Windows or Linux computer, such as disk encryption, firewall, software updates and passwords, against what ISO 27001, GDPR and the EU AI Act expect. You get a short report in plain language, and most problems can be fixed with one click. It runs on the computer itself: nothing is uploaded.
Good for: Small teams who want to know if their laptops are secure before an audit or a client asks.
Caveat EU AI Act risk checkEXPERIMENT
Describe how you use, or plan to use, AI, for example a chatbot that screens job applications. Caveat tells you which EU AI Act risk level it probably falls into (prohibited, high, limited or minimal) and what that means for you. Two AI models answer side by side, so you can see where they agree, and a 14-lesson course explains the rules. It is an experiment, not legal advice.
Good for: Anyone using AI at work who wants a first idea of what the AI Act asks of them.
Nox Private AI assistantLIVE
Ask Nox questions, get help writing, or open a document such as a contract or report and ask about it. In offline mode the AI runs on your own device, so confidential files never leave it.
Good for: People who want AI help with documents they cannot share with an online service.
Ora Marketing content studioNEW
Ora helps you plan your marketing week by week and then makes the content: short videos, product photos, posters and ready-to-post ads, created with open AI models on your own computer. It can also post them for you. No subscription, and nothing is sent to an AI service.
Good for: Small businesses without a design team that need regular social media content.
Most downloaded · last 30 days
1Arx · Modelendpoint-auditor-0.5b753 2Ora · Datasetora-releases367 3Arx · Datasetendpoint-auditor-releases352 All on Hugging Face →Hands-on trainings, with AI and n8n.
OPENDigital Learning Hub · 12–14 Jan 2027
Digital Marketing for Beginners using AI and n8n
From brand identity to a full campaign plan, with AI for content and n8n to organise the work.
ON REQUESTLifelong Learning · on request
Data protection law and the GDPR explained through real court cases, for teams that book a session.
ON REQUESTLifelong Learning · on request
Digital Marketing for Beginners using AI and Automation
Digital marketing with AI tools and simple automation, for organisations that book a session.
Digital Learning Hub · 7–11 Dec 2026
Project Management for Beginners using AI and n8n (SOLD OUT)
Automate project follow-up with AI and n8n: status reports, risk alerts and team updates.
Digital Learning Hub · 14–17 Dec 2026
Cybersecurity for Beginners using agentic AI and n8n (SOLD OUT)
Build an AI agent that checks events against ISO 27001 guidance and keeps the risk register up to date.
Order any one. Quoted per service.
A legally sound starting point: we review your key legal documents (terms, privacy and refund policies, T&Cs) and tell you exactly what to change.
- Terms of Use and Privacy Policy review
- Refund Policy and General Terms & Conditions review
- Consolidated GDPR observations and prioritised actions
- Feedback document, findings presentation and follow-up meetings
Based on: GDPR Articles 6, 13/14, 15–22 and 28
Scope: Four documents of up to 15 pages each, for one legal entity. Larger organisations get a tailored estimate.
Level: Foundational · quoted
A complete, CNPD-aligned record of how your organisation processes personal data.
- Purposes and legal basis for each processing activity
- Data, data-subject and recipient categories
- Retention periods, security measures and international transfers
- Sub-processor list and procedures for keeping the RoPA up to date
Based on: GDPR Article 30, with Articles 5, 6 and 28
Scope: Up to 15 processing activities, for one legal entity. Larger organisations get a tailored estimate.
Level: Foundational · quoted
A full picture of where you comply and where you don’t, with a roadmap to close the gaps.
- Article-by-article mapping and control effectiveness review
- Gaps rated Critical, High, Medium or Low
- Prioritised remediation plan with owners and timelines
- Presentation of findings and stakeholder support
Based on: All GDPR Articles (1–99) and CNPD expectations
Scope: One legal entity and site, up to 15 processing activities. Larger organisations get a tailored estimate.
Level: Comprehensive · quoted
Find out whether a DPIA is required and, if so, carry out a proportionate one that the CNPD would recognise.
- Necessity and proportionality assessment
- Risk identification and severity scoring
- Technical and organisational measures, privacy by design and by default
- Formal DPIA report, board presentation and prior-consultation guidance
Based on: GDPR Articles 25 and 35
Scope: One processing operation (or a set of similar ones). Larger organisations get a tailored estimate.
Level: Advanced · quoted
Know which AI systems you use, how the AI Act classifies them, and what you must do about it.
- Inventory of AI systems you build, use or buy, and your role for each
- Risk classification and prohibited-practice screening
- Gap analysis: AI literacy, high-risk duties, deployer and transparency obligations
- AI governance framework: policy, AI register, human oversight, vendor checklist
Based on: Regulation (EU) 2024/1689, with GDPR Articles 22 and 35
Scope: Up to 5 AI systems. Larger organisations get a tailored estimate.
Level: Advanced · quoted
Assess your organisation against ISO/IEC 27001 and put in place an information security management system ready for certification.
- ISMS scope and context, and a gap audit against all 93 Annex A controls
- Risk assessment, risk treatment plan and Statement of Applicability
- Information security policy and topic-specific policies
- Implementation support, internal audit preparation and a certification-readiness report
Based on: ISO/IEC 27001:2022 clauses 4–10 and Annex A, ISO/IEC 27002 and 27005
Scope: Up to 50 employees, one site and one ISMS scope. Larger organisations get a tailored estimate.
Level: Comprehensive · quoted
Find out which cyber regulations apply to you and get a clear roadmap to meet them.
- Applicability: essential or important entity, financial entity, products with digital elements
- Gap analysis for the regime that applies
- Incident reporting workflow (24 h / 72 h / 1 month) and supply-chain requirements
- Prioritised readiness roadmap with budget estimates
Based on: NIS2 Directive and Luxembourg law, DORA, Cyber Resilience Act
Scope: One regulatory regime (NIS2, DORA or CRA). Larger organisations get a tailored estimate.
Level: Advanced · quoted
A structured risk assessment with a recognised method, ending in a prioritised and costed treatment plan.
- Business context, security objectives and asset identification
- Threats, vulnerabilities, likelihood and impact, with a risk register and heat map
- Treatment plan with priority, owner and budget per measure
- Plain-language report and presentation for management
Based on: MONARC, EBIOS Risk Manager, ISO 31000 and ISO/IEC 27005
Scope: One site, up to 30 assets. Larger organisations get a tailored estimate.
Level: Advanced · quoted
Find the technical weaknesses in your SaaS or AI system before attackers do, with clear fixes.
- Cloud and server configuration audit against CIS Benchmarks
- Source-code review, dependency and secrets scanning
- Web, API and AI-specific testing (prompt injection, data leakage)
- Findings by severity, corrective measures and one retest of critical issues
Based on: OWASP Top 10, OWASP ASVS, OWASP Top 10 for LLM Applications, CIS Benchmarks
Scope: One SaaS application or AI system. Testing only with your written authorisation. Larger organisations get a tailored estimate.
Level: Comprehensive · quoted
Awards, news and answers.
On the trophy shelf
What's new
Questions we often get
It depends on your sector and size. NIS2 mainly covers medium and large organisations (50 or more employees, or over €10 million turnover) in sectors such as energy, transport, health, digital infrastructure, ICT services and manufacturing, and some smaller ones whatever their size. Our NIS2, DORA and Cyber Resilience Act readiness service starts with exactly this check.
Yes, in part. Since February 2025 every organisation that uses AI must make sure its staff have enough AI literacy, and some uses are banned outright. Using AI in high-risk areas such as recruitment, credit decisions or education brings stricter duties. Caveat, our free tool, gives a first, experimental indication for a use case; our EU AI Act assessment covers up to five AI systems.
Certification is done by an accredited certification body, which must be independent of whoever prepared you. We take you up to that point: a gap audit against the 93 Annex A controls, the Statement of Applicability, policies and an information security management system ready for the certification audit.
Each service is quoted for your organisation, because the work depends on your size and scope. Every service has a standard scope, for example up to 15 processing activities for a GDPR audit, and larger organisations get a tailored estimate. Send the contact form and we reply with a scoped quote, usually within three working days.
Arx runs on your own computer and nothing leaves it. Caveat runs its classifier in your browser. Both are open source on Hugging Face, so anyone can check what they do.
We only test with your written authorisation, and we agree the scope, dates and rules before we start. One retest after your fixes is included.
Yes. GDPR for Beginners and Digital Marketing with AI are available as team sessions through lifelong-learning.lu, and we also put together custom trainings. Ask through the contact form.
Grab a coffee. Tell us what you need.
One service, a package, or a training for your team. The first conversation is free. We reply with a scoped quote, usually within three working days.
Request a quote
Tell us who you are and what you need: a service, a package or a training for your team. A consultant reads every message and replies with a scoped quote, usually within three working days. You will get a copy of your message by email.