Velum vs Microsoft Presidio: a framework and a product are different answers

If you search for PII de-identification you will meet Microsoft Presidio quickly, and you should. It is the most established open-source project in this space: an MIT-licensed Python SDK that detects and anonymises personal data in text and images, maintained since 2018, with detection built from NER models, regex, checksums and pluggable custom recognisers. People sometimes ask how Velum compares to it. The honest answer is that they are different kinds of thing, and the comparison is worth walking through because it clarifies what you actually need.

What Presidio is

Presidio is a toolkit for engineers. You install it with pip, wire it into your own code or deploy it as a container, choose and tune the recognisers, and decide what happens to each entity type: mask it, hash it, replace it, encrypt it. It scales from a script to a PySpark job. If your organisation is building a data pipeline that must scrub millions of records, or a product that needs de-identification inside it, Presidio is a serious and proven foundation, and its price is zero.

That flexibility is the point, and it is also the cost. Presidio does nothing until someone builds with it. There is no app, no extension, no interface for the person who just needs to paste a contract into a chatbot safely. The person operating it is a developer by definition.

What Velum is

Velum is a finished product for the person doing the pasting. The browser extension and desktop app are the interface: paste or open text, see the personal data masked, send it to whatever AI you use, and get the reply back with the real details restored. Nobody writes code, deploys a container, or tunes a recogniser. Detection ships with country packs for Spain, the US, UK, France, Germany, Turkey and Italy, and the measured accuracy per language is published on the benchmarks page.

Both run locally. Presidio because you self-host it inside your own infrastructure, Velum because on-device is the design: the extension does its whole round trip with no network access at all.

The reversibility difference

One technical distinction matters beyond audience. Restoring masked data in the model's reply is central to how Velum works: both masking modes, tokenized and pseudonymized, are built to be undone locally, because a reply about ⟦PERSON_1⟧ is only useful once ⟦PERSON_1⟧ becomes the client again.

Presidio treats reversal as one option among several. Its anonymizer's default operators, replace, mask, redact, are one-way; reversal exists through its encrypt operator, where a DeanonymizerEngine can decrypt entities if you kept the key. That is a reasonable design for pipelines, where destruction is often the goal. It means reversible round-trip chat use is something you build on Presidio rather than something it does.

Which one you actually need

Choose Presidio when you have an engineering team, a pipeline or product to build de-identification into, and the time to select models and tune recognisers for your data. It is free, open, and battle-tested, and for that job we would recommend it too.

Choose Velum when the people handling sensitive text are lawyers, accountants, clinicians, researchers or anyone else whose job is not maintaining a Python service, and what they need is to use ChatGPT or Claude on real work today without the identifying details leaving the machine.

There is no version of this article where one tool wins both jobs. If you are still unsure which side you are on, the test is one question: who will operate it? If the answer is "a developer", look at Presidio. If the answer is "me, this afternoon", the extension is free to try and needs no account.