What a security review asks.
What the console holds and what it cannot, the three deployment postures, and the answers your reviewer will want in writing.
What the console holds, and what it cannot
Detection runs on the device, so there is nothing to forward. Managed deployments renew a licence lease; that request carries the tenant, a salted subject hash, a salted device hash, the product version and the policy hash. The schema is printed in the console and in the app's own Protection tab, and offline deployments make no request at all.
| class | what it is | in the console |
|---|---|---|
| Seats and devices | A hashed subject, a hashed device id, the platform, the app version, the policy hash, the last renewal. | Held |
| Aggregate counts | How many identifiers were protected, of which types, on which surfaces, per day. No subject attached unless you turn that on. | Held when you enable reporting |
| Anything from the work itself | Document text, filenames, prompts, sites visited, mapping values, per-item records. | Never received |
If you need a record of what an individual masked, Velum is the wrong product and we will say so on the call. Devices can write their own detection records to a collector you run, where that data stays yours.
Three postures. The masking path is offline in all of them.
Offline
No callbacks, at all
An organisation key and a signed policy arrive through your MDM. Devices verify both locally and never contact anything. Seat counts come from your own device inventory, and we ship the Jamf and Intune queries that produce them.
Air-gapped estates, public sector, anyone whose review forbids vendor traffic.
Managed
The default
Devices renew a short licence lease, 30 days by default and yours to shorten. Removing a person ends their access at the next renewal, which is the revocation window you quote in a security questionnaire. Masking itself still makes no network call.
Most organisations, and the only posture where the console can tell you a seat went idle.
Self-hosted
Your network, your logs
The lease service runs as a container inside your perimeter, holding a delegated key scoped to your organisation. Endpoints renew against your own hostname, and you can read the request logs yourself rather than take our word for the schema.
Banking, defence, and anywhere the answer to "what leaves" has to be verifiable by you.