VeilThe engine that redacts your data is open source.
It's the part of Veil that sees your text: it hides your private details before they reach the AI, and puts them back in the replies. Anyone can read its code, so you don't have to take our word for what it does.
It only redacts
The engine can't go online, open your files or keep a log. It only works on the text you send.
Check it's the same engine
Veil shows which engine version it uses, with a fingerprint you can compare with the public one.
The limits are written down
A public document says what the engine protects against and what it doesn't.
What is open source, and what isn't
Privacy software should be clear about this too.
Open source, Apache-2.0
- veil-engine
- Redacts your data, and puts it back in the replies.
- veil-vault
- Remembers what was redacted, encrypted on your computer.
- veil-chrome
- The browser extension. Passes what you type on claude.ai and chatgpt.com only to the Veil app on your computer.
Not open source
- The Veil app
- Settings, the local address your tools use, the connections to each AI provider, and how it reads each chat site's requests.
- Name detection
- The optional model that finds names of people, companies and places.
Check the version you run
Open General in Veil
The Open source card lists the engine, the vault and the browser extension, with their versions.
Copy the fingerprint
Click Copy next to a version. The fingerprint identifies the exact package Veil was built with.
Compare it
The same version on crates.io, where the engine is published, has the same fingerprint.
Use it in your own software
The same engine Veil uses, as a Rust library. Stable placeholders per conversation, restored streamed replies, and JSON request bodies.
cargo add veil-engine // Placeholders are numbered per conversation.
let engine = Engine::builder().build()?;
let scope = ScopeId::new("chat-42");
let r = engine.redact_text(&scope, text)?;
// "Email [EMAIL_1] about card [CARD_1]"
let back = engine.restore_text(&scope, reply);
Questions
- Is all of Veil open source?
- No. The engine that redacts your data, the vault that remembers what was redacted, and the Chrome extension are. The Veil app and name detection are not.
- How do I check the Chrome extension?
- Its build is reproducible: the same source always gives the same files. In a copy of veil-chrome at your version, pnpm verify compares the extension Chrome installed from the Web Store, or a release zip, with the source, file by file. Each release on GitHub also lists its zip's SHA-256.
- Can I use the engine in my own product?
- Yes. The Apache-2.0 licence allows that, commercial use included.
- I found a security problem. Who do I tell?
- Report it privately, as SECURITY.md in the repository describes. Please don't open a public issue.