VEIL documentation
VEIL packages runnable software so the clean source tree is not the artifact you distribute. It raises the cost of casual copying and direct AI analysis; it does not promise that software is impossible to reverse engineer.
Choose a tier
| Tier | Purpose | Runtime lock |
|---|---|---|
| Trial | Three-hour compatibility test | Portable, Deploy-bound, or Secure-bound |
| Share | Portable demos and handoff | Matching package and runner |
| Deploy | Server deployment | Selected domain and separate Ed25519 key checked locally after delivery |
| Secure | Higher-assurance server deployment | Deploy checks plus local machine fingerprint; optional container identity |
Deployment key
The private deployment key is separate from the sealed package and runner. Install it at ~/.veil/deployment_ed25519.pem, or set VEIL_DEPLOYMENT_KEY_FILE. On Linux and macOS the runner enforces mode 0600. Keep the key outside repositories, project folders, and public web roots.
Offline runtime binding
Payment and delivery are verified by VEIL before the package is delivered. After delivery, Share runs portably; Deploy checks its selected domain and separate Ed25519 key locally; Secure adds the machine fingerprint and optional container identity. New delivered packages do not need VEIL to remain online.
Compatibility
VEIL supports Python projects and common command-line entry types including Node.js, Ruby, shell, Perl, PHP, R, and Lua when their interpreters and dependencies exist on the recipient machine. The generated package includes an entry-point decision and preserves standard input, output, arguments, and exit status. Test your exact project with the free trial before payment.
Security boundary
The runtime performs integrity, debugger, tracing, dump, entitlement, domain, key, hardware, and expiry checks where supported. Kernel-level, hypervisor-level, patched-runtime, hardware, and sufficiently privileged observation remain outside the guarantee. VEIL complements normal access control, patching, secrets management, and server isolation; it does not replace them.
Release 2026.07
Runtime authorization protocol v2 remains available for historical packages. New delivered Deploy and Secure packages use their sealed local binding policy after delivery, so they do not depend on a continuing VEIL service.