Privacy claims are cheap. A redaction app that quietly sent documents to a server for “processing” would look exactly like one that didn’t, right up until it mattered. So instead of taking Veil’s word for it, I went through its source code and looked for every place it can reach the internet.
Veil is built in two halves: a main process that can talk to the operating system and the network, and a window that draws the documents. I searched both for network requests, outside addresses and code that loads anything from elsewhere.
What I found
| Connection | When | What's sent |
|---|---|---|
| OpenAI, Anthropic or OpenRouter | Only when you use the assistant with your own account or key | Your question and the document's redacted text |
| OpenAI sign-in | Only if you choose "Sign in with ChatGPT" | The standard sign-in exchange, no document content |
| Model lists | When the assistant's model picker opens | Your key, to list available models |
| Detection, text recognition, search | Always | Nothing. They load from files inside the app. |
| Analytics, crash reports, update checks | Never | None found in the code |
A development-only check for a local test server on the same computer is left out; it doesn't leave the machine.
That’s the whole list. The redaction model, text recognition and the meaning-based search all ship inside the app and load from its own files. I found no analytics, no crash reporting and no update check. If you never open the assistant, Veil has no reason to touch the network at all.
The assistant is the one door, and it’s well guarded
When you do use the assistant, the document has to go somewhere: that’s how cloud AI works. What matters is what goes through. By default Veil runs its detector first and sends the text with placeholders like [PERSON_1] in place of names and identifiers. Anything found once is hidden everywhere else it appears, and text under boxes you drew by hand is hidden too.
Two details stood out. First, if detection fails for any reason, Veil replaces the text with [REDACTED] rather than sending it unredacted. It fails closed, which is the right call and easy to get wrong. Second, values you type into forms and your saved profiles are never sent, even when you’ve allowed the full text. The model is only told whether a field is filled.
The requests are made by the main process, and your API keys and ChatGPT tokens are kept in an encrypted store, out of reach of the document window.
Caveats worth knowing
I read the source, not the app you download. That’s strong evidence but not proof that a given build matches it. A network monitor like Little Snitch or Wireshark is the way to check a build yourself, and it’s worth doing for any privacy tool.
The full-text switch is real. If you allow the full text for a document, the unredacted text goes to your AI provider. It resets when you close the document, but it’s there.
Placeholders hide names, not context. “[PERSON_1] was treated for a rare condition in a town of 300 people” can still identify someone. That’s true of any redaction, but it matters more when you send the result to a third party.
Licensing will add a connection. Veil’s website describes accounts and licenses. The code I read doesn’t include a license check yet, and when it’s added it will need the network. I’d hope it sends nothing about your documents. I’d also like to see Veil publish a plain list of every connection, like the table above, and keep it current.
Verdict
On the evidence of its source code, Veil’s central claim holds up: your documents stay on your computer unless you deliberately use the AI assistant, and even then the assistant sees redacted text by default and fails safe when detection breaks. That’s rarer than it should be.