Privacy

Veil is in private alpha and invite-only. This page is the whole privacy story — what we hold, why, and how to make it go away. It is written in plain terms on purpose; if anything here is unclear, that's a bug.

What we hold

• Account: your email address and name, held in our identity service (Ory Kratos) on our own database.
• Secrets: only ever as ciphertext. Items are encrypted under a per-organization key, wrapped by a deployment key held outside the database. We cannot read your secrets, and a database dump cannot be read without the wrapping key.
• Activity: an append-only audit record — which principal used which item, when, at what scope. Audit rows never contain secret material.
• Operational: server logs and traces used to keep the service alive. No analytics trackers, no ad pixels, no third-party cookies on the vault surfaces.

What we never do

• We never see, log, or transmit your plaintext secrets. Agents you run receive credentials injected at the request path — they never see them either.
• We never sell, rent, or share your data with advertisers or data brokers.
• We never use your secrets or audit data to train models.

Who processes what

• Railway hosts the service and database (encrypted at rest).
• Cloudflare terminates TLS at the edge, runs our mail and backup workers, and holds encrypted offsite backup copies.
• 1Password escrows the deployment wrapping key, separately from any backup.
• Vortex processes billing — plan state, subscription, and usage counts per organization. Card details never transit Veil: payment happens on Vortex's hosted checkout and its payment processor, so we never see card data.

No other vendor touches your data. Identity is self-hosted Ory software running in our infrastructure — it is not a data processor. Vortex is our sister company under the same operator.

Retention & deletion

• Secrets and vault data are yours: an owner can delete the whole organization at any time, which purges all vault rows in one operation.
• You can delete your own account from inside the product — membership and your identity mapping are removed immediately.
• Audit records are retained on a fixed 90-day live window — exported hourly to offsite object storage before any roll — and survive organization deletion deliberately: they are the forensic record of who used what, and they contain no secrets.
• Encrypted backups roll off on a fixed retention schedule (14 days on-host, replicated offsite).

Alpha terms, plainly

• This is pre-release software. It is invite-only, provided as-is, and we publish no uptime SLA.
• Durability work (encrypted backups, offsite copies, restore drills) is real and tested — but do not make Veil your only copy of anything yet.
• If we have a security incident that affects you, we will tell you what happened, what was exposed, and what you need to do — quickly, in writing.
• Questions, deletion requests, or anything unclear: contact the owner who invited you, or the address in security.txt.