Questions, answered.

Not by default. VeilGuard is 100% offline out of the box: all detection runs locally in the extension or desktop app, and your prompts, pastes and attachments are never uploaded, logged remotely or shared. Nothing leaves without your approval, or until you've masked it.

Only four optional lookups, all off by default: the password breach check (the first few characters of a password hash, using k-anonymity), RDAP domain age and DNS-over-HTTPS checks (a domain name), and the community blocklist download. Each needs your explicit approval, and the prompt shows exactly what would be sent.

When you choose "Use placeholders", each sensitive value is swapped for a token such as [EMAIL_1] before the message is sent, so the AI only ever sees the token. The link between tokens and real values stays in that browser tab's memory. When the answer mentions a token, VeilGuard draws your real value over it on your screen, in its own protected layer that the website can't read. Closing the tab forgets the tokens.

The Windows app reads the text in an image with the OCR engine built into Windows, on your PC. The browser extension asks the Windows app on the same PC to do this, so images are never sent to a server. Without the Windows app, image checks are skipped and VeilGuard tells you so. On Android, VeilGuard Keyboard reads the text in a copied image or screenshot with on-phone text recognition before you paste it.

It's off until you turn it on. The Windows app shows a one-time QR code, VeilGuard Keyboard scans it, and both screens show the same 6-digit code to confirm. After that, text you copy goes directly between the phone and the PC over your local network, encrypted end to end, with no relay and nothing through our servers. Text only; items from password fields are never sent, and anything VeilGuard flags is held until you choose to send it. Unpair on either side at any time.

A local record of detections in which each entry carries the SHA-256 hash of the one before, so any edit or deletion breaks the chain. One click re-verifies it. You can export an evidence pack, CSV, JSON or a printable HTML/PDF report, all generated on your device, in both the extension and the Windows app.

Sending is paused and you see a categorized warning with a risk level. You can Mask & send (secrets are replaced with placeholders), Mask & edit, Edit the message yourself, or Send anyway. If an admin has enabled forced redaction, masking is required.

It masks what VeilGuard found, the same way as Mask & send, and puts the text back in the box with the cursor at the end, but sends nothing. Keep typing, and when you press Send again the message is checked again like any other. It's in the extension, the Windows app and VeilGuard Keyboard, and it's offered even when your company requires masking.

171 detectors in 11 packs: passwords and PINs, API keys and tokens, payment cards, bank and IBAN numbers, national ID and passport numbers from 29 countries, dates of birth, health identifiers, crypto keys and seed phrases, emails, phone numbers and your own company terms. Since rules 1.4.2 they also catch these the way people write them in chats: "my password is…", "my bank pin 4821", an SSN typed with dots or spaces, a card number typed digit by digit, or a key with hidden characters, in English, Spanish, French, German and Japanese. Every pattern is published. No detector catches everything, so treat a missed warning as possible.

Yes. From the warning, the toolbar popup, the tray menu or Settings, pause the send, paste and upload warnings on that site (or Windows app) for 15 minutes, 1 hour, 3 hours, until 6:00 tomorrow or until you restart. Security warnings such as phishing keep running unless you tick the box to pause them too. Your company can cap how long a pause lasts or turn pausing off, and forced redaction is never paused.

Yes, with Family protection (Settings, Family protection). Choose under 13, 13 to 15 or 16 to 17 and set a parent PIN. VeilGuard then checks AI prompts and web searches on the device before they are sent and stops topics such as sexual content, self-harm methods, weapons, drugs, gambling, gore and extremism, with stricter rules for younger children. Health, sex-education, safety and help-seeking questions still go through, and if a question is about self-harm VeilGuard shows crisis helplines (988 in the US, Childline 0800 1111 in the UK, findahelpline.com) instead of a plain block. Only the PIN can change or turn it off, and a parent can unlock it for a while. Nothing is sent anywhere and the history records only the topic and the time. It works in the browser extension, in desktop AI apps through the Windows app, and on VeilGuard Keyboard, and schools or companies can set the age for every device by policy. It is a helper, not a guarantee: keep using your device's own parental controls too.

Out of the box: ChatGPT, Claude, Copilot, Gemini, Grok, ElevenLabs, Cursor, Perplexity, Amazon and Google, plus searches typed into the URL bar. You can add any other site yourself. The Windows app covers Claude desktop, VS Code, Microsoft 365 Copilot, Word, Outlook, Teams, Cursor and ChatGPT desktop.

Green: VeilGuard is actively protecting that tab or app. Red: it isn't, for example because protection is paused or the surface isn't supported, so you know to be careful.

Optional detector sets for Finance & Accounting, Healthcare & MedTech, Contracts & Legal, and Web3 & Crypto: checksum-validated card, bank and routing numbers, NPI and NHS numbers, privilege markings, wallet-drainer signatures and more. They run locally like everything else. See compliance by industry for every pack.

Adversary-in-the-middle kits proxy a real sign-in page to steal your password and one-time code. VeilGuard warns and blocks when a password you use on your real sign-in domains is typed on any other site (it keeps only a local salted hash), flags MFA codes entered on look-alike pages, catches device-code lures, and detects Microsoft, Google and Okta sign-in pages on the wrong domain.

The extension is on the Chrome Web Store, Microsoft Edge Add-ons and Firefox Add-ons. The Windows app is in the Microsoft Store, and the Android keyboard's Google Play listing is in review. Every build is also published on GitHub.

Yes. Chrome shows that note, only when Enhanced Safe Browsing is on, for extensions from publishers that are new to the Chrome Web Store. Google marks a publisher as trusted after a period of following the store's developer policies, and the note then disappears on its own. VeilGuard passed Chrome Web Store review, runs its checks on your device and sends none of your text anywhere; see Security & privacy.

English, Spanish, French, German and Japanese.

A company console at veilguard.site/console. Your admin sets the rules once, and every browser and PC linked to your company ID gets them: locked settings, forced redaction, protected sites and apps, packs and custom rules. An override password lets someone change a setting when they need to, and the console shows counts of what was caught and the list of protected machines. Only counts are shared, never the text.

Yes. The Windows app reads admin policy from the registry and ships ADMX templates for Group Policy, including forced redaction.

Open the Deploy page in the team console. With Intune, Google Admin, Group Policy or Jamf, download the ready-made package: step-by-step guides, policy templates and settings files already filled in with your company ID, so the extension, the Windows app and the Android keyboard install and link themselves. Without device management, send the enrollment link or show its QR code: people install VeilGuard from the store page it offers and press Link this device, and each app asks them to confirm. Links are signed, expire after 7 days by default and can be revoked at any time. The console home shows a roll-out checklist that ticks itself as devices start reporting.

No tool can do that on its own. VeilGuard helps support your data-protection and privacy program by catching sensitive data before it leaves and keeping a local, tamper-evident record of what it caught. It isn't certified against any standard.