You are billed for documents redacted. Nothing else.
A document is one source file that Veil processes. Emails are unpacked, so every attachment is extracted and counted as its own document. Pages, entities, seats on the lower plans and re-runs after a flag is resolved are not billed separately.
Pay as you go
For the team that answers a handful of requests a year.
EUR2.00
per document, no subscription
Metered monthly, billed in arrears
- Documents per case
- Up to 200
- Active cases
- 2
- Retention window
- Up to 30 days
- Seats
- 3
- The full detection stack, no reduced tier
- Independent verification on every document
- Bundle, manifest and quality report
- Spot checks on by default
Team
For a privacy function with a steady request load.
EUR600
per month, 500 documents included
1.20 per document beyond the included volume
- Documents per case
- Up to 1,000
- Active cases
- 10
- Retention window
- Up to 60 days
- Seats
- 10
- Everything in pay as you go
- REST API and typed client
- Case webhooks, HMAC signed
- Per-organisation spot check policy
- Priority email support
Business
For high volume, or for a case that arrives without warning.
EUR1,800
per month, 2,000 documents included
0.75 per document beyond the included volume
- Documents per case
- Unlimited
- Active cases
- Unlimited
- Retention window
- Up to 90 days
- Seats
- Unlimited
- Everything in Team
- Priority processing queue
- Additional jurisdiction packs
- Bring your own model provider
A 300 document access request costs 600 on pay as you go, and the pipeline finishes it in under an hour. On Team the same case is inside the included volume.
Enterprise
Annual document commitment at a volume rate, with the controls a security review asks for.
Talk to us- SAML single sign-on
- Dual control on bundle release and on marking an entity as the subject
- Negotiated retention and residency
- Data processing agreement and sub-processor pack
- Named support contact
Prices are in EUR, excluding VAT. Metered documents are counted per calendar month and billed in arrears. Retention windows are the maximum a plan permits; you can always choose a shorter one.
The things a privacy team asks first.
What exactly does Veil redact?
Personal data belonging to anyone other than the data subject. Names, contact details, national identifiers, bank details, dates of birth and the identifying context around them. The data subject's own personal data is deliberately kept, because that is what the access request entitles them to.
How can the output be trusted?
Two independent mechanisms. Every output PDF is generated from scratch, containing only text the pipeline chose to emit, so there is nothing hidden underneath it. Then a verifier that shares no code with the redaction pipeline re-extracts the text from that PDF and asserts that no redacted surface form appears. If it finds one, the document is withheld and the case is blocked.
What does a person actually have to do?
Declare who the subject is, upload the documents, and work through the entity registry. That registry has one row per person found in the case, typically twenty to sixty rows, with flags sorted to the top. There is no span by span review.
What happens when the system is unsure?
It redacts and raises a flag. Uncertainty always resolves toward redaction, never toward disclosure, and that is enforced in the transition functions rather than left to the interface. Turning a flagged entity into the data subject requires either a match against the anchors you declared, or an explicit attestation that is written to the audit log. This is why the product publishes no accuracy percentage: the part a percentage would describe as missed is not disclosed, it is covered and queued.
Which file formats are supported?
EML and MSG email with recursive attachment extraction, native and scanned PDF, DOCX, XLSX, TXT, and ZIP archives. Scanned pages go through OCR. Every attachment inside an email becomes its own document in the case, with its parent recorded.
Where is the data processed and stored?
Entirely in the European Union. Database and object storage in Frankfurt, processing workers in Frankfurt and Amsterdam, web functions pinned to Frankfurt, and model inference at a European provider with identifiers stripped before any request leaves the platform.
How long do you keep the documents?
As long as your retention window, which you set and your plan caps. When a case purges, the objects, the extractions and the entity mentions are deleted and the case encryption key is destroyed, which makes the remaining copies unrecoverable. What survives is a tombstone holding the case reference, the dates, the counts and the quality summary, with no personal data in it.
Does the original document get modified?
No. Originals are read only from the moment they are uploaded. Veil produces new files alongside them and never writes back.
Can I integrate this with something else?
Yes. The dashboard is built on the same public API you get: cases, subject anchors, documents, processing, entity decisions, release, bundle and quality report, plus HMAC signed webhooks carrying no personal data in the payload.
Is there anything Veil will not do?
Purely indirect identification, where someone is recognisable from circumstance rather than from an identifier, is flagged rather than resolved. Badly degraded scans and handwriting are flagged rather than guessed at. Original page imagery is not reproduced in the output. In every one of those cases the material is redacted first and shown to you second, so the boundary of what the automation can do is a queue on your screen, not a risk in your bundle.
Your next access request does not have to eat a week.
Open a case, declare the subject, drop the documents in. Veil does the rest and shows you its working.