Veil — Trust & provenance

Verify a receipt

Paste a receipt. No login needed.

Receipts are Ed25519 signatures over a canonical JSON manifest: subject hashes, detections by type, actions, policy & model version, purpose, consent decision, residency verdict, audit-chain head. GET /api/provenance/keys publishes the keys; SDK verifiers (Node, Python, Java) check offline.

{
  "spec": "veil:receipt/v1",
  "kind": "FLOW_RESULT",
  "subject": { "docRef": "sftp://…/payslip-0423.pdf",
               "inputSha256": "b166…", "outputSha256": "5e5c…" },
  "detectionsByType": { "PERSON": 2, "IBAN": 1, "DATE_OF_BIRTH": 1 },
  "actions": [ { "type": "REDACT_APPLIED", "policyId": 3, "method": "pdf-boxes" } ],
  "engine": { "modelName": "veil-pii", "modelVersion": "v2" },
  "purpose": "hr_administration",
  "consent": { "decision": "ALLOW", "source": "veil:consent/web-form" },
  "extra": { "sovereignty": { "residency": "EU", "ok": true } },
  "audit": { "auditHeadHash": "9f31…" },
  "issuer": "veil@acme", "keyId": "vk_d7ee…", "verify": "https://veil.acme/api/provenance/verify"
}

Security posture

Built for teams who have to answer for data.

Self-hosted, your keys

Docker / JVM in your cloud or on-prem. Secrets and credentials encrypted at rest with your VEIL_ENCRYPTION_KEY; nothing phones home.

Tamper-evident audit

Every redaction event is hash-chained; verification replays the chain and reports breaks. Receipts embed the chain head.

Identity

OIDC SSO (Keycloak, Okta, Entra), SCIM 2.0 provisioning, API keys with ADMIN / OPERATOR / AUDITOR roles, org / team / member grants.

Sovereignty

Instance region + regions on every connection and datasource; residency per flow and gateway route (warn or enforce → 451); network egress allow/deny globs enforced before a byte leaves.

Purpose limitation

Purposes with legal basis; consent checked mid-flight from Veil records or your CMP; decisions in payloads, receipts and monthly reports — including what ran with no declared purpose.

Minimal exposure

Vault tokens instead of plaintext across hops; audience-scoped reveal; re-identification gates on exports; prompt-injection detection on prompts and tool results.

Compliance evidence

Monthly reports per framework — HIPAA Safe Harbor, GDPR, PCI DSS, SOC 2 and more — assembled from operational records, printable to PDF.

Measured accuracy

Model card per org: P/R/F1 per type and language from your gold sets, contractual floors, observed FP/FN. Open models close the gap on detection; the measurement is what you can sign.

Operational safety

Durable job queue with retries, checkpoints and idempotency keys; connection health probes with owner/admin alerts; rate limits on gateway routes.

Proof you can hand to an auditor — or a customer.