Others tell you where your sensitive data is. Veil detects it, redacts, tokenizes or masks it in motion — across documents, databases, streams, logs and LLM calls — checks the purpose it moves for, and hands you a signed receipt: what was removed, under which policy, and why it was allowed.
A pure, dependency-free detection & redaction core (regex + validators + a retrainable multilingual NER model) wrapped by every delivery mode you'll need — configured once in the console, enforced everywhere.
Redaction API, playground, and a file studio: PDF / images (OCR, 13 languages) / XLSX / CSV / text redacted in format, reviewed cell-by-cell, downloaded with a receipt.
Teachable document types (22 prebuilt packs), flows that extract, enrich, look up, consent-check and route documents from S3 / SFTP / IMAP / drives / SaaS / HTTP to Kafka, JDBC, webhooks and back.
DB-to-DB masking (format-preserving encryption, synthetic strategies), referential-integrity subsetting, discovery & classification, DSAR — and a re-identification risk gate on every export.
Kafka pipelines that redact every message (and check consent per message), S3 / MinIO bucket jobs, resumable on a durable job queue.
OTLP and Splunk HEC endpoints that scrub PII out of logs before they land in Datadog, Loki, Splunk… with forwarding profiles.
Point any OpenAI / Anthropic SDK at Veil: prompts redacted or vault-tokenized, answers detokenized per audience, tool calls and tool results inspected, prompt injection flagged, ingestion cleaned before embedding.
Generate native masking policies for Snowflake, Databricks, BigQuery, Redshift, SQL Server, Oracle and Postgres — the warehouse enforces, Veil governs.
Reversible, deterministic tokens with audited reveal levels (full / partial / synthetic) — the same value tokenizes the same way across tables, streams and LLM hops.
Policies, custom recognizers, purposes & consent, compliance evidence reports (HIPAA, GDPR, PCI, SOC 2…), tamper-evident audit chain, OIDC SSO, SCIM, orgs & teams.
DSPM tools find data. DLP suites block it. Consent platforms hold the signal but aren't in the data path. Veil sits in the path — and closes the loop.
Every flow, stream, job, gateway call and MCP tool call declares the purpose it runs for. Veil resolves the data subject mid-flight and asks the consent signal — Veil records, or Ketch / OneTrust / Transcend over HTTP — then allows, masks, tokenizes, reviews or drops. The decision rides in the payload.
A portable Ed25519-signed manifest per delivered artifact, record, job run or call: detections by type, policy & model version, transformation, input/output hashes, purpose, consent, residency — chained to the audit log and verifiable offline by anyone with the public key.
Self-hosted in your cloud. Every connection carries a region; flows and routes declare residency (warn or enforce); a network egress boundary refuses calls outside your allow-list before a byte leaves — all attested in the receipt.
k-anonymity / l-diversity over quasi-identifiers of what was actually written. Block and withdraw the export, or warn — not just "masked".
A model card from your own gold sets: precision / recall / F1 per type and per language, against contractual floors. Retrain, benchmark, promote or roll back.
Vault tokens travel across every hop; real values return only to the audience allowed; tool results are scanned for indirect prompt injection; documents are cleaned before they're embedded.
Policies, recognizers, purposes, connections, flows, routes, plans. React console or REST / SDKs (Java · Node · Python).
Spring Boot control plane: durable job queue, vault, receipts, consent, sovereignty, metering, audit chain. Postgres or H2.
The same engine as library, REST, gateway, Kafka pipeline, masking run, push-down policy — emitting metrics, audit and receipts.
| If you looked at… | They are great at | What they don't do | Veil |
|---|---|---|---|
| DSPM (Cyera, Varonis, BigID, Securiti) | Finding and labelling sensitive data across clouds | Moving or transforming it; proving what happened | Discovery feeds masking, push-down and reports — then moves data with receipts |
| AI firewalls / LLM DLP (Nightfall, Strac, Lakera…) | Prompt redaction, injection detection | Reversible tokens across hops, audience-scoped reveal, consent per call, receipts | Vault tokens + audience reveal + purpose/consent + receipt, prompt and MCP |
| Test-data management (Tonic, Delphix, K2view) | Masked, subsetted non-prod copies | Re-identification gating, provenance, streams/LLM surfaces | Masking + subsetting with re-id gate and receipts, same engine as everything else |
| Consent platforms (OneTrust, Ketch, Transcend) | Collecting and storing the consent signal | Being in the data path where processing happens | Consults their signal mid-flight (presets) and enforces it on every movement |
| IDP suites (ABBYY, Hyperscience, Rossum) | Document extraction at scale | Privacy-first routing, consent, receipts, self-hosting | Teachable types + packs, flows with redaction, lookups, consent, receipts |
Positioning based on public vendor material as of August 2026; capabilities change — ask us for the current comparison.
Veil