How Velum detects personal data without a cloud

Personal data detection is normally a cloud service. You post your text to an API, it returns labelled entities, and you hope the provider's retention policy matches what you told your clients. That model is the thing we are trying to avoid, so everything below runs on the machine in front of you.

Three levels, and the trade each one makes

Velum ships three detection intensities. They are not marketing tiers; they are genuinely different machinery, and the app lets you switch between them because the right answer depends on the document.

Pattern rules only. Regular expressions with checksum validation, no model at all. This catches structured identifiers: emails, phone numbers, card numbers, IBANs, national ID numbers. Where a format carries a check digit, we validate it rather than just matching the shape, which is the difference between finding a Spanish NIF and finding any nine characters that look like one. Instant, deterministic, and auditable in the sense that you can read the rule and see why it fired.

Regex plus on-device AI. This is the default. It adds a quantised BERT NER model that ships inside the app, so it works the moment you install it with no download and no network. The bundled model is around 173MB on disk, which is most of why the macOS download is as large as it is. This level catches what patterns cannot: names, addresses, organisations, and the ambiguous cases in mixed-language text.

Maximum. A GLiNER model, roughly 1.1GB, which is not bundled. You download it from Settings when you want it. It is the strongest protection we offer and it is slower on long documents, which is the honest trade rather than a hidden one.

The number we can stand behind

At the default level, we measure roughly 2% residual leak on Spanish and Catalan text. That is the figure the app itself shows you when you hover the intensity setting, and it is why Maximum exists.

Two percent is not zero. We publish it because a privacy tool that implies zero is either lying or has not measured. If you are working with a document where a single missed identifier is unacceptable, use Maximum, and read the masked output before you send it.

We are not publishing latency benchmarks yet. We could quote a number from one machine on one document and it would tell you nothing useful about yours. What we can say is that the pattern layer is effectively instantaneous, the default level is fast enough that people leave it on, and Maximum is noticeably slower on long files.

Why the model runs here and not there

Because the model runs on your device, it never sees anyone else's data, and yours never joins a training set. There is no fine-tuning on your domain, no cross-contamination between organisations, and no provider retention window to reason about. The privacy property comes from the architecture, not from a policy document that can be revised.

It also means the tool works on a plane, in a secure facility, and on a network you do not trust.

What this cannot do

Detection quality varies by language, by document type, and by how unusual the data is. Names that look like ordinary words, identifiers in formats we do not have a pack for, and text extracted badly from a scanned PDF are all harder. Velum reduces exposure substantially. It is not a guarantee, and anyone selling you one is describing a product that does not exist.

See the detection levels for yourself: download Velum, or read the licensing terms.