The category: keyboard-edge protection
Stop secrets before they hit mail, forms, or AI
Enterprise DLP scans after data leaves your keyboard. Veil sits at the edge — catching API keys, credentials, and PII
in Outlook, Gmail, and AI chat before they reach the pipeline. Encrypt locally, send as normal mail with
[redacted] or team tokens. Plaintext never required on Goldspire servers.
Why keyboard-edge beats downstream DLP
Before the pipeline
Purview, Nightfall, and Strac need your data in flight. Veil encrypts at the keyboard — secrets never reach mail servers or LLM APIs in plaintext.
Send as normal
[redacted] and [veil:vt_…] look like ordinary email. Recipients click to unlock in-thread — or use the hosted unlock page with no install.
Proof, not policy theater
Copilot shows what matched (e.g. sk-…x4K9) before you act. Weekly stats, SIEM metadata, and admin dashboards — without reading message content.
How Veil fits your day
Veil copilot catches secrets in compose, forms, and AI chat — quietly on signup pages.
One click replaces sensitive text with [redacted] or a team token inline.
Email and forms look ordinary. Recipients unlock in place with Veil or your hosted link.
Policy packs, SIEM export, and admin console — without reading message content.
Built for global teams
Veil is listed in the Chrome and Edge stores worldwide. Detection runs in your browser — copilot sees paste and typing locally, not on a regional server.
We validate country-specific formats where standards exist, and flag labeled or high-confidence patterns everywhere else. Policy packs map detections to GDPR, HIPAA, PCI DSS, and SOC 2 context before you send.
Financial
Credit cards (Luhn), IBANs with check digits, SWIFT/BIC, EU VAT (AT, DE, FR, GB, IE, NL), US EIN patterns, bank routing.
Healthcare & identity
Labeled MRNs, UK NHS (Mod-11), US SSN/ITIN, Irish PPS, UK NINO, Canadian SIN, Australian TFN/Medicare, Singapore NRIC, Indian Aadhaar, French INSEE, Dutch BSN, Brazilian CPF, Hong Kong HKID, NZ IRD, Nordic personnummer/CPR, Mexican CURP, Japanese My Number, Korean RRN, Belgian/Taiwan/SA IDs, passports, licences.
Secrets & contact
API keys (OpenAI, Anthropic, Stripe, AWS, GitHub, Slack, SendGrid, Supabase, Twilio, Shopify, and more), JWTs, PEM private keys, database connection strings, passwords, emails, phone numbers, internal ticket refs — across mail, forms, and AI chat surfaces.
Recipients without the extension
Personal and one-time messages include a hosted unlock page. Recipients open the link, enter the passphrase you shared separately, and read the secret in their browser — no install required.
Team tokens and in-thread unlock require the Veil extension for org members.
How teams get started
- Admin creates a team and receives a join code and admin sign-in key.
- Members install Veil and join with work email.
- Everyone secures secrets in mail and web apps; admins apply a policy pack and review metadata-only activity.
IT can deploy via Chrome or Edge policy. Team cloud is billed annually per seat — card required after the trial.
IT can deploy via Chrome or Edge policy. Team cloud is free during early access.
Security & privacy
- Encryption runs in the browser (AES-GCM + PBKDF2). Plaintext is not sent to Goldspire for secure or tokenize actions.
- Veil’s cloud API stores org membership, token ciphertext, and security event metadata — not passphrases or message content.
- Admins can forward events to a SIEM webhook; exports contain categories and counts, not matched text.