From zero to redacting in ten minutes.

Sign up, get a key, open the console.

On a Veil instance with self-serve enabled, the signup form creates an organization on the FREE plan, makes you its admin and hands you an API key once — with a deep link that signs you into the console. Operators can require an invite code or switch signup off (VEIL_SIGNUP_ENABLED=false).

One compose file.

Postgres + veil-control + console (+ optional Keycloak, Prometheus/Grafana, demo stack). Provide an encryption key for secrets at rest and a bootstrap admin key. Set your region for sovereignty checks, and optionally SMTP for emails, Stripe for billing, OIDC for SSO.

VEIL_ENCRYPTION_KEY

encrypts credentials/secrets at rest (required for prod)

VEIL_BOOTSTRAP_ADMIN_KEY

first admin API key

VEIL_REGION

EU / US / … — residency checks compare to it

VEIL_CONSOLE_URL

where signup deep links point

VEIL_EGRESS_MODE

OFF / WARN / ENFORCE network boundary

VEIL_OCR_LANGUAGE

auto (13 Tesseract packs in the image)

git clone <your-veil-repo> veil && cd veil
export VEIL_ENCRYPTION_KEY=$(openssl rand -base64 32)
export VEIL_BOOTSTRAP_ADMIN_KEY=vk_$(openssl rand -hex 16)
export VEIL_REGION=EU
docker compose up -d                 # control plane :8090, console :4000, site :8081
docker compose --profile demo up -d  # + RetailCo demo app, Redpanda, MinIO, demo DB
open http://localhost:4000           # sign in with VEIL_BOOTSTRAP_ADMIN_KEY

Redact, with a receipt.

Every policy is an endpoint. Ask for ?receipt=true and the response carries a portable, signed receipt you can store next to the output. Batch, file, and same-format endpoints follow the same pattern; Swagger lives at /swagger-ui.html.

curl -X POST "http://localhost:8090/api/policies/1/redact?receipt=true&purpose=customer_support" \
  -H "X-Veil-Api-Key: $VEIL_KEY" -H "Content-Type: application/json" \
  -d '{"text":"Call Priya Sharma at +44 7700 900123 about order A-7781"}'

Change one line in your app.

Create a route in the console (upstream provider connection, policy, prompt handling, purpose, audiences, receipts) and point your SDK at it. Agents use /ai/{route}/mcp; ingestion pipelines /ai/{route}/v1/ingest.

import anthropic
client = anthropic.Anthropic(base_url="https://veil.example/ai/support-bot", api_key="vgw_…")
# optional headers: X-Veil-Subject (consent), X-Veil-Audience (reveal scope)

Verify anywhere.

GET /api/provenance/keys and POST /api/provenance/verify are public on every instance. Receipts are issued for flow results, text and file redactions, masking/subset/S3 jobs, stream runs, gateway calls and ingest batches; the console shows them next to each result. Try the verifier →

curl -X POST https://veil.example/api/provenance/verify \
  -H 'Content-Type: application/json' -d @receipt.json
{ "valid": true, "checks": ["signature:ok","manifestHash:ok","issuedHere:yes"] }