Privacy-first AI infrastructure.

Desktop app · macOS, Windows coming

Text, files, and the agents that read them.

Velum masks what you paste, the documents and folders you drop on it, and the files a coding agent reads on your behalf. Detection runs on your machine, against the full model rather than a cut-down one. Available for macOS today, with Windows coming.

Download for macOS

v0.12.0 · 343 MB

Windows: notify me

Coming soon

Apple SiliconDeveloper ID signed and notarisedSeven days free, no account and no card

Velum for macOS, the Protection tabsynthetic
The Velum desktop app Protection tab. A tally of seven identifiers replaced across one text passage, broken down by type as censor bars. Beside it, a panel naming the loopback masking service, enumerating five outbound calls and none of them carrying document text, and offering the command lsof -i -P | grep -i velum to check.
The app counts what it protected, names the loopback service it ran against, lists every outbound call it makes, and then hands you the command to check the claim yourself. The counts come from a local usage log that holds operation names and timings, never document text, and is never sent anywhere.

What it masks.

01

Text

Paste it in, mask it, copy it out.

Anonymize and de-anonymize live in the same view, with a session mapping you can open and read a line at a time. Lift a bar to check one value without unmasking the rest.

02

Files and folders

Drop a document, or a whole directory.

PDF, DOCX, TXT, Markdown, CSV, TSV and RTF come back as a .masked.md beside the original. Scanned PDFs fall back to offline OCR. A folder run is anonymize only.

03

Permanent redaction

For when the bar has to be in the pixels.

PDF, PNG, JPEG and WebP can have the bar burned in rather than tokenized. That one does not come back. It needs the Maximum tier, the original is never touched, and re-encoding drops the EXIF along with it.

04

Audit

What is already on your disk.

The Audit tab reads back over assistant chat histories, shell history, dotfiles, clipboard managers, screenshots and documents, with adapters for Claude Code, Codex, opencode and Cursor. It finds what you pasted before you had this.

Three intensities. You trade speed for the last of the leak.

tierenginecostleak
Standardregex onlyinstantthe regex floor
Highdefaultregex plus on-device BERT liteabout 140 ms per documentabout 2%
Maximumregex plus GLiNER, or Privacy Filter on source filesabout 350 ms per documentabout 0%

Maximum needs a one-time model download of about 2.9 GB, which you start yourself. High is what the app ships on.

Seven country packs

Spain, the United States, the United Kingdom, France, Germany, Turkey and Italy. Email addresses, IBANs, card numbers, phone numbers, IPv4, IPv6 and MAC addresses, UUIDs, secrets and passport numbers are always on, in every locale, with no pack needed.

The full measurement, across nine languages and 1,800 labelled spans

The part that matters if you use coding agents.

A coding agent reads your repository, your shell history and whatever a web fetch hands back, then sends all of it to a model. Velum ships an MCP server and a set of Claude Code hooks inside the app bundle, so that traffic gets masked on the way past.

Hooks and tools

Claude Code

PostToolUse masks the result of Read, Bash, Grep, WebFetch, NotebookRead and any mcp__* call before the model sees it. PreToolUse puts the originals back before Write, Edit, MultiEdit and NotebookEdit touch the disk, including the old_string an edit matches on. Outbound arguments to WebFetch and mcp__* are masked too. None of that needs the model to cooperate.

Tools only

Codex, Claude Desktop, other MCP clients

velum_mask, velum_mask_file, velum_status and velum_forget are registered, and the model has to decide to call them. That makes this a capability rather than a guarantee, and it is worth saying so to anyone who asks.

Not a target

Cursor

Cursor is not an MCP or hook target. It appears in Velum only as a chat-history adapter in the Audit tab, which reads what is already on your disk.

No MCP client can protect a prompt you typed yourself. By the time any tool can run, your words have already reached the vendor. The hooks cover what the agent reads and writes, not what you type.

How it turns on

One toggle in Settings, under AI coding tools. It writes ~/.velum/mcp.json at mode 0600, and that file is the pairing record, the licence gate and the one place to revoke. A separate button copies the Claude Code plugin into ~/.claude/skills/velum.

There is no marketplace, no npx and no network in that path. The launcher sits inside the app bundle and the package is never published to npm. In the default local unmask mode there is no unmask tool registered at all, so an agent cannot ask for the originals back.

The agent path runs regex plus the Tier-1 model. Tier-2 never runs there.

What scoping it costs

filesizebeforeafter
policy.ts5 KB793 ms19 ms
server/index.ts26 KB4,552 ms195 ms
src-tauri/lib.rs93 KB15,036 ms189 ms

A scoped prefilter puts between 1.8 and 6.4% of a code file in front of the model instead of all of it. On the code gold set recall went from 87.9% to 95.5% and leak from 12.1% to 4.5%. Over loopback the round trip is 113 ms at p50 cold and 224 ms at p95, then 2 ms and 5 ms once it is cached.

Regex on its own is not a fallback for this. On the same sets it averages 45.4% recall and 37.0% leak, which is most of the personal data still on the wire. Inline budgets are 32 KB for data files and 512 KB for source and docs, and anything over is refused with a pointer to velum_mask_file rather than quietly truncated.

Five outbound requests, and none of them carry your text.

  1. 01An update check on launch, to downloads.velumprivacy.com.
  2. 02A one-time detection-model download, and only when you start it.
  3. 03A licence revocation list on launch. The request carries no licence, install or device identifier. The whole list comes down and is matched here.
  4. 04A single activation report, sent at the moment you enter a licence key. It contains the licence id and a one-way hash of this install's random id. No email, no key, no hardware identifier. It is never sent again.
  5. 05A single trial registration on first run, containing a one-way salted hash of this machine's platform UUID and nothing else. It is what stops the trial being restarted by deleting a file, and it is not sent at all once a purchased key is in place.

The masking path itself never needs the network. No document text, no file, no mapping and nothing derived from any of them leaves the machine. That is checked two ways in CI: a static scan that fails the build on fetch, XMLHttpRequest, WebSocket, sendBeacon or allowRemoteModels, and a test that monkey-patches fetch to throw and then runs a full masking pass anyway. The webview runs under default-src ‘self’, never holds the bearer token, and makes no network calls of its own.

The browser extension is the Velum surface with the literal zero-network property, and it still has it.

What you need to run it

Apple Silicon only. There is no Intel or universal build. The DMG is 336 MB and the installed app is 822 MB, because the detection model is in it. Signed with a Developer ID and notarised, so it opens without a Gatekeeper override.

What it costs

Seven days with no account and no card. After that a licence key, checked offline against an Ed25519 signature and held in the Keychain. Unmasking is never gated, so anything you have already masked stays readable if the licence lapses.

Windows · coming soon

Velum for Windows is on the way.

The same masking engine as the macOS app, running on your own machine. Leave your email and we will tell you the day it is available to download.

One email, on the day it is available. No newsletter, no drip sequence, and your address is not passed to anyone. Reply to it and we take you off the list. Your address masks itself as you type, which is Velum running in this page.

Request a demo

See it work on your own data.

Tell us what you are working with and we will walk you through it on your own data. Nothing leaves your hands.

Your details mask themselves as you go. That is Velum, running in this page. Press the eye to unmask. We still receive them in full.

We respect your privacy. Your details are only used to reach you.