Privacy Policy
VeilGuard browser extension & Windows desktop app · Last updated
In short: VeilGuard is 100% offline by default. It inspects what you're about to send on your own device, and nothing leaves without your approval or redaction. It doesn't collect, store off-device, or transmit your prompts, pastes, files or browsing activity.
What VeilGuard processes
To protect you, VeilGuard reads text you type or paste, files you attach, and the pages and links you visit in protected browser tabs and supported desktop apps. All of this analysis runs locally in the extension or desktop app. That includes detection of personal data, API keys, passwords, crypto keys and seed phrases, web threats, the optional industry protection packs (finance, healthcare, legal and Web3), and sign-in and MFA phishing checks.
What we collect
Nothing. VeilGuard has no accounts, no analytics, no telemetry and no remote logging. SecureIT does not receive any of your data.
What stays on your device
- Your settings and the list of sites you choose to protect.
- Scan history and counts, so you can review what was caught.
- The tamper-evident evidence log (a SHA-256 hash chain) and the operational log.
- Threat visibility data, plus any CSV, JSON, evidence-pack or HTML/PDF report exports. These are generated locally and saved only where you choose.
- For the password-reuse alarm, a salted hash of the passwords you use on your real sign-in domains. The passwords themselves are never stored.
- Downloaded blocklists used for local matching, if you've turned that lookup on.
Uninstalling the extension or app removes this data.
Optional network lookups
Four protections can use a small amount of information from the internet. All four are off by default. Each one needs your explicit approval before it runs, and the approval prompt shows exactly what would be sent. You can switch any of them off again in settings. None of them sends the content you type, paste or attach.
- Password breach check — uses k-anonymity: only the first few characters of a hash of the password are sent; the password itself never leaves your device.
- Domain age (WHOIS/RDAP) — sends the domain name being checked.
- DNS verification (DNS-over-HTTPS) — sends the domain name being resolved.
- Community blocklist download — downloads lists of known-bad domains; matching happens locally.
These requests go directly from your device to the respective public service and are subject to that service's own privacy practices.
Regulated environments
The industry protection packs and the local evidence log are designed to help support data-protection and privacy programs, for example in finance, healthcare and legal teams. VeilGuard does not by itself make an organisation compliant with any law, regulation or standard, and it is not certified against one.
Admin-managed installations
If your organisation manages the Windows app through registry policy or ADMX templates, an administrator may configure behaviour such as forced redaction. These policies are applied locally; VeilGuard does not send your data to your administrator or to SecureIT.
Permissions
The browser extension requests permission to read and modify pages so it can inspect composers, links and page behaviour, and to access the clipboard so it can guard against pastejacking. These permissions are used only for local protection.
Changes & contact
If this policy changes, the updated version will be published on this page and in the GitHub repository. Questions or concerns? Open an issue.