01
Text
Paste it in, mask it, copy it out.
Anonymize and de-anonymize live in the same view, with a session mapping you can open and read a line at a time. Lift a bar to check one value without unmasking the rest.
← Velum for desktop
How it works, in detail.
The detection tiers and what each one leaks, what the agent hooks cover and what they cannot, and every outbound request the app makes.
What it masks.
02
Files and folders
Drop a document, or a whole directory.
PDF, DOCX, TXT, Markdown, CSV, TSV and RTF come back as a .masked.md beside the original. Scanned PDFs fall back to offline OCR. A folder run is anonymize only.
03
Permanent redaction
For when the bar has to be in the pixels.
PDF, PNG, JPEG and WebP can have the bar burned in rather than tokenized. That one does not come back. It needs the Maximum tier, the original is never touched, and re-encoding drops the EXIF along with it.
04
Audit
What is already on your disk.
The Audit tab reads back over assistant chat histories, shell history, dotfiles, clipboard managers, screenshots and documents, with adapters for Claude Code, Codex, opencode and Cursor. It finds what you pasted before you had this.
Three intensities. You trade speed for the last of the leak.
| tier | engine | cost | leak |
|---|---|---|---|
| Standard | regex only | instant | the regex floor |
| Highdefault | regex plus on-device BERT lite | about 140 ms per document | about 2% |
| Maximum | regex plus GLiNER, or Privacy Filter on source files | about 350 ms per document | about 0% |
Maximum needs a one-time model download of about 2.9 GB, which you start yourself. High is what the app ships on.
Seven country packs
Spain, the United States, the United Kingdom, France, Germany, Turkey and Italy. Email addresses, IBANs, card numbers, phone numbers, IPv4, IPv6 and MAC addresses, UUIDs, secrets and passport numbers are always on, in every locale, with no pack needed.
The full measurement, across nine languages and 1,800 labelled spansThe part that matters if you use coding agents.
A coding agent reads your repository, your shell history and whatever a web fetch hands back, then sends all of it to a model. Velum ships an MCP server and a set of Claude Code hooks inside the app bundle, so that traffic gets masked on the way past.
Hooks and tools
Claude Code
PostToolUse masks the result of Read, Bash, Grep, WebFetch, NotebookRead and any mcp__* call before the model sees it. PreToolUse puts the originals back before Write, Edit, MultiEdit and NotebookEdit touch the disk, including the old_string an edit matches on. Outbound arguments to WebFetch and mcp__* are masked too. None of that needs the model to cooperate.
Tools only
Codex, Claude Desktop, other MCP clients
velum_mask, velum_mask_file, velum_status and velum_forget are registered, and the model has to decide to call them. That makes this a capability rather than a guarantee, and it is worth saying so to anyone who asks.
Not a target
Cursor
Cursor is not an MCP or hook target. It appears in Velum only as a chat-history adapter in the Audit tab, which reads what is already on your disk.
No MCP client can protect a prompt you typed yourself. By the time any tool can run, your words have already reached the vendor. The hooks cover what the agent reads and writes, not what you type.
How it turns on
One toggle in Settings, under AI coding tools. It writes ~/.velum/mcp.json at mode 0600, and that file is the pairing record, the licence gate and the one place to revoke. A separate button copies the Claude Code plugin into ~/.claude/skills/velum.
There is no marketplace, no npx and no network in that path. The launcher sits inside the app bundle and the package is never published to npm. In the default local unmask mode there is no unmask tool registered at all, so an agent cannot ask for the originals back.
The agent path runs regex plus the Tier-1 model. Tier-2 never runs there.
What scoping it costs
A scoped prefilter puts between 1.8 and 6.4% of a code file in front of the model instead of all of it. On the code gold set that moves recall from 87.9% to 95.5% and leak from 12.1% to 4.5%, and it turns a 15-second file into a fifth of a second.
The measurements
| file | size | before | after |
|---|---|---|---|
| policy.ts | 5 KB | 793 ms | 19 ms |
| server/index.ts | 26 KB | 4,552 ms | 195 ms |
| src-tauri/lib.rs | 93 KB | 15,036 ms | 189 ms |
Over loopback the round trip is 113 ms at p50 cold and 224 ms at p95, then 2 ms and 5 ms once it is cached. Regex on its own is not a fallback for this: on the same sets it averages 45.4% recall and 37.0% leak, which is most of the personal data still on the wire. Inline budgets are 32 KB for data files and 512 KB for source and docs, and anything over is refused with a pointer to velum_mask_file rather than quietly truncated.
Five outbound requests, and none of them carry your text.
- 01An update check on launch, to downloads.velumprivacy.com.
- 02A one-time detection-model download, and only when you start it.
- 03A licence revocation list on launch. The request carries no licence, install or device identifier. The whole list comes down and is matched here.
- 04A single activation report, sent at the moment you enter a licence key. It contains the licence id and a one-way hash of this install's random id. No email, no key, no hardware identifier. It is never sent again.
- 05A single trial registration on first run, containing a one-way salted hash of this machine's platform UUID and nothing else. It is what stops the trial being restarted by deleting a file, and it is not sent at all once a purchased key is in place.
The masking path itself never needs the network. No document text, no file, no mapping and nothing derived from any of them leaves the machine. That is checked two ways in CI: a static scan that fails the build on fetch, XMLHttpRequest, WebSocket, sendBeacon or allowRemoteModels, and a test that monkey-patches fetch to throw and then runs a full masking pass anyway. The webview runs under default-src ‘self’, never holds the bearer token, and makes no network calls of its own.
The browser extension is the Velum surface with the literal zero-network property, and it still has it.
What you need to run it
Apple Silicon only. There is no Intel or universal build. The DMG is 336 MB and the installed app is 822 MB, because the detection model is in it. Signed with a Developer ID and notarised, so it opens without a Gatekeeper override.
What it costs
Seven days with no account and no card. After that a licence key, checked offline against an Ed25519 signature and held in the Keychain. Unmasking is never gated, so anything you have already masked stays readable if the licence lapses.
One licence covers one machine. Rolling it out to a team adds a console for seats, one signed policy and deployment through your MDM, and is in pilot.
Linux · available now
Running it on Linux.
One x86-64 AppImage, 383 MB, on any distribution. It updates itself the way the macOS app does, and it needs no package manager and no root.
chmod +x Velum_*.AppImageThe download arrives without the execute bit, as every AppImage does.
./Velum_*.AppImageThat is the whole install. Nothing is written outside your home directory.
If nothing happens when you run it
Ubuntu 22.04 and later do not ship FUSE 2, which an AppImage needs to mount itself. Install it, or skip mounting entirely:
sudo apt install libfuse2t64./Velum_*.AppImage --appimage-extract-and-runBuilt on Ubuntu 24.04, so it needs glibc 2.39 or newer: Ubuntu 24.04, Debian 13, Fedora 40 and current Arch all qualify, and Ubuntu 22.04 and Debian 12 do not. The tray needs a status bar that supports AppIndicator, and the licence and trial are kept in your system keyring, so a desktop running no keyring daemon will ask for a licence key instead of starting the trial.
Windows · coming soon
Windows is on the way.
The same masking engine as the macOS and Linux apps, running on your own machine. Leave an address and we will tell you the day it is available to download.
Request a demo
See it work on your own data.
Tell us what you work with and we will walk you through it on a call, on your own files. Nothing leaves your machine while we do.
Your address is used to reply to you, and for nothing else.