What SMEs have been waiting for

On Monday we will show Pandora in public for the first time, at the Gründungsmesse Niederrhein, a founders' fair in Mönchengladbach [? official name of the fair]. Before that, I want to tell you how we got here. Not as a product description, but as the story behind it. It doesn't start with technology. It starts with conversations.

## The same sentence, over and over

Over the past months I have talked to a lot of business owners about AI. Every one of them had a different approach. Some were enthusiastic and already in the middle of it, others kept a deliberate distance. But in almost every conversation the same sentence came up at some point, just in different words: We can't simply send our data to the US.

That sentence is stuck in people's heads. And it leads many to steer well clear of AI in their business.

There is more to it than a vague unease. In Germany, and in Europe, we depend on solutions from the US, and increasingly from China, in many places. It is not just the technology that is ahead there, but the infrastructure and the products built on it. Exactly those products are what companies need and use today. And what suffers in the end is the protection of our data.

On top of that comes regulation. Next to the GDPR we now have the EU AI Act, with new obligations and plenty of open questions. I meet business owners who are simply overwhelmed by it. Some mainly see the benefits and just get going. Others prefer to wait, don't want to make a mistake, and hold back. Both are understandable. But those who wait take a different risk: falling behind their competitors.

## Ms Müller already has a subscription

And then there is something that gets surprisingly little attention: shadow AI.

Ms Müller in accounting may well have had a private ChatGPT subscription for a while. She uses it in the evening for personal things, and at some point at the office too. I understand that completely. Ms Müller has a colleague with similar tasks, both have to deliver results, and with AI she is noticeably faster. Employees know this. That is how private subscriptions end up inside companies.

Some companies notice and set rules. Some notice and don't. And some never notice at all.

The problem: the business owner is responsible but has no control. The AI Act requires him to govern how AI is used in his company. The GDPR requires safeguards whenever data is processed. The two interlock, and both land on him personally. If you don't know how your staff use AI, or you know but have no handle on it, you have no answer when it matters.

That is everyday reality in many companies: AI is already there, just without control, without diligence, without accountability and without transparency. Untangling that is hard if there is no system that takes these obligations off your hands.

## What about Copilot?

Of course there is an answer many already know: Microsoft Copilot. Microsoft is very good at building that chat window into everything, the desktop, Office, every web interface. You can define agents and build workflows, and the whole Microsoft world is being extended with AI step by step. It is a serious solution, and it has already arrived in many companies.

For sensitive businesses one issue remains: the US CLOUD Act. We recently had clients applying for a BaFin licence, the German financial supervisory authority. For them the Microsoft cloud is not even up for discussion, because they have to protect themselves against US authorities accessing their data.

And the foundation has become thinner. On 29 June 2026 the US Supreme Court ruled in "Trump v. Slaughter" that the President may remove members of the Federal Trade Commission at any time without cause. The FTC, however, is the central oversight body in the EU-US Data Privacy Framework, on which a large share of data transfers to the US rests. The adequacy decision still applies. But it stands on shaky ground, and legal challenges have already been announced. If the European Court of Justice strikes it down, as it did with Safe Harbor and Privacy Shield, Germany has a big problem. Precisely because we have become so used to relying on Microsoft.

So we see shadow AI. We see companies using AI at high risk without governing it. We see many attempts to build their own solutions with European providers, which often threaten to fail. And we see one dominant player with an enterprise solution that is not an option for some. That is why we set out to build Pandora.

## First the question, then the answer

Before we thought about features, we asked a simple question: where does the problem actually lie?

The answer came quickly. In a potentially insecure environment there is no transparency about who did what, when and how. And that problem is growing, because AI systems act more and more autonomously. They access data, operate systems and act on someone's behalf. This is exactly where the AI Act requires human oversight.

At the same time the web itself is changing. Already in 2024, according to the Imperva Bad Bot Report, more than half of all web traffic came from machines rather than humans: 51 percent. But the internet was built on rules that assume human users. Now there are machines that navigate it faster and more precisely than it was ever designed for. The existing barriers and detection mechanisms can't keep up.

Imagine we were Amazon. We would be receiving requests from countless autonomous systems all the time. We would have to handle the load and at the same time defend ourselves against systems that keep getting better at gaining an advantage. An arms race. And it happens because we don't know who is actually asking. A human? An assistant? An autonomous system? Even with humans, in the end it is just credentials. What happens when someone simply hands them to an agent?

## Identity, starting at the sender

So we approached the problem from the other side. Not ever more defences on the receiving end, but making sure at the sender that it is clear: this is an AI system, and specifically this one.

Technically the idea is not new. Labelling is a classic identification method. But it only works if the identity is sent along, and if the receiver can check whether it is genuine.

For that check we use DIDs, decentralised digital identifiers, an established method in the industry. Every agent gets such an identity and keeps it. Whenever it shows up somewhere, the identity comes along. It is verified via a distributed ledger, in other words a blockchain. Not Bitcoin, that would be far too slow, but a much faster one that is built for this kind of thing. Anyone can check there at any time whether the identity is valid and who it belongs to, without an intermediary and without a central authority. It is signed and traceable.

If you want the details: we published our paper on this, the Elpis Protocol, on Zenodo in March (DOI 10.5281/zenodo.18895024), written together with AI systems, by the way. We made it openly available on purpose, because we believe this question concerns the whole industry, and because we hope others will join us.

We built Pandora on exactly this principle. The idea didn't exist on day one, it grew over time as we worked through the problem. Today, though, every customer who uses Pandora gets this identity layer from day one: all of their agents are registered on the ledger and carry their own identity. That means we know at every step which agent acted, and we can tie permissions and rules to it. For a business owner who has to keep traceable records and comply with the law, that is exactly what matters. In Pandora, people are uniquely identified through their accounts, agents through their verifiable identity, and both move by the same rules. For us, an agent is an entity very similar to a user. By the way, I am convinced that one day people will carry such a digital identity too. With the European digital identity wallet it is coming for us as citizens anyway. Then both sides meet at the same point.

That is how collaboration between people and AI became possible, with a level of transparency that, as far as we know, no other system offers today. Born out of the uncertainty we felt in the German market.

## How it actually started

The original idea for Pandora actually came from somewhere else entirely. Big providers like Anthropic and OpenAI offer command-line tools alongside the chat window in the browser. Those tools have existed for a long time, but ordinary users never found them appealing. For developers, on the other hand, they were the tool of choice early on.

We got into them early as well, and we stuck with them. We quickly saw their limits and looked for ways to scale: start several of these agents on one system, let them work side by side and talk to each other. That was the moment Pandora was born.

We built everything else around that principle. Every agent gets its own isolated environment with its own files, its own profile and its own memory. Our first use case was software development. We used Pandora to build Pandora's own interface. That sounds crazy, but it got us moving very fast. Out of it grew our own development process, a whole ecosystem and the web interface we use to steer our agents today.

## A universal co-worker

We deliberately did not go with low-code toolkits like n8n, Make or Zapier. Integration is where we come from. I have been in IT for more than 25 years, as a consultant, on the client side, as managing director of an IT service company, and most recently with K-BITE and now EFINITI as a managed service provider for SMEs here in Mönchengladbach, partnering with Microsoft, Sophos, Lenovo and Synology, among others. We have been connecting systems for many years: SAP with logistics providers, CRM with sales and much more. At their core, those tools are middleware that calls a language model at some point in the chain. But a mapping remains a mapping. In many places AI is simply used in the wrong spot there. To be honest, in our projects we often find that AI isn't the right tool at all.

Pandora doesn't aim to build interfaces. Pandora is more like a universal co-worker. Everything in IT is code in the end. An agent that ranks among the best programmers can therefore open up almost any system. An example from our own day-to-day work: we use Odoo as our ERP. In early 2025 there was no suitable MCP server for our Odoo yet, in other words no connector for AI assistants. We gave an agent in Pandora the API documentation and access. A few days later we had a working connector, and other agents could take over tasks in Odoo that previously only people could do.

## What the founder at our stand gets out of it

Which brings me to the founder who walks up to our stand on Monday. She has an idea, maybe two co-founders, and worries other than compliance: organisation, liability, cash flow, who does what. Quite rightly so. But she is subject to the same laws as every other business owner, and that catches up with you eventually. If you build your processes on tools that aren't sound from the start, you will have a problem later.

With Pandora she has that box ticked from the beginning, because compliance and governance are built into the foundation rather than bolted on afterwards. And she gets teams of universal digital co-workers who work alongside her and her people. She decides what those tasks are. She isn't squeezed into predefined workflows.

To be honest, for some people exactly that freedom is a hurdle at first. Not everyone knows right away where to start. We don't have many ready-made use cases yet. We want to change that, together with our customers. Every use case we build together can be captured and made available to others.

Seen that way, Pandora is a safe sandbox for the whole company. An isolated playground where you can try out AI and discover use cases, because a lot is already settled from the start. Safeguards protect against mistakes, protect the business owner and enable him to use AI the way lawmakers expect today.

That is what SMEs have been waiting for.

## We are looking for people to build this with us

I don't want to gloss over anything. What our customers get works. But Pandora isn't polished yet. There are areas of the interface with room to grow, because that is where we are currently building out our own ideas. Sometimes things don't run as smoothly as you would like, a link leads nowhere, or a section only shows sample data as a preview of what is coming. Our development team is small, and many ideas aren't fully built yet. That is why we are now looking for companies that can live with that, believe in the idea and will stick with us for a while with some patience. Paying customers, to be frank, because we want to grow the team, and data centre capacity isn't cheap. Partners who want to resell Pandora are welcome too.

What we offer in return: the best terms Pandora will ever have. Especially at the start, we pass on our purchase prices without a mark-up and only charge a small fee for support. On top of that, access to all our IT services as a managed service provider, also on special terms. And we are happy about anyone who simply wants to try it out, even with a small setup and just a few users. Anyone who has really used Pandora will feel the difference.

On 12 October we will be at the Gründungsmesse Niederrhein in Mönchengladbach [? name of the fair]. Come by, have a look, and talk to me. If you can't make it: pandora.efiniti.de or pandora@efiniti.de.

---

This article was created in conversation with my AI agent Polyphides. He interviewed me and shaped the text from my answers. His DID `did:xrpl:7nnmlzx6#096bf25a` is listed as co-author in the metadata.