Skip to main content

​
Overview

The most common questions we hear about Velatir for Desktop, grouped by topic. If your question is not here, Troubleshooting covers diagnosis, and your account team can help with anything operational.

​
What it is and what it does

Yes. Velatir for Desktop covers AI usage in web apps as well as in desktop and CLI apps, from one install and one ingest key. There is no separate product to deploy.
No. Velatir only inspects traffic from a curated list of supported AI applications. Everything else on the device is passed through untouched.
Coverage includes GitHub Copilot (VS Code, JetBrains Rider, IntelliJ IDEA, Visual Studio, Xcode, Neovim, GitHub Copilot CLI), Microsoft Copilot in Word, Excel, PowerPoint, Outlook, and Teams, the standalone Microsoft Copilot desktop app, Claude Code (CLI and VS Code), Claude Desktop, Claude for Word, and ChatGPT for Word. See the supported applications list for the current set. If you need coverage for an application that is not yet supported, request it through your account team.

​
Installation and updates

An MSI for Windows and a PKG for macOS. Linux support is in development. See Download and install.
Yes. Microsoft Intune, Jamf Pro, and any MDM that deploys an MSI or PKG work out of the box. See Enterprise deployment.
The agent checks every four hours and updates itself automatically, with no update service to manage. You can apply one immediately with velatir update --apply.
Yes. Tenant-specific update channels are available for organisations that need to coordinate updates with their own change-management process. Contact support to enable this for your tenant.
Use Add/Remove Programs on Windows (or msiexec /x), and sudo velatir-uninstall on macOS. See Download and install.Two things that route around it. On macOS with Firefox, the browser extension may remain listed after uninstall (it is inactive) and needs removing by hand. And if the uninstall is interrupted, your MDM cannot remove the app, or items remain afterwards, run the cleanup script in Uninstall cleanup — devices on a version older than the current installer can leave artefacts a standard uninstall does not clear.

​
Permissions and privacy

Administrator rights at install time on both platforms, and a one-time system extension approval on macOS. The full list with rationale is in Permissions.
Velatir does not monitor your clipboard, screen, microphone, or files. It does not request Full Disk Access on macOS, and it does not capture screenshots or keystrokes. Its inputs are the connections of supported AI applications, with one exception: if your organisation turns on Redaction, the browser extension reads the text you paste into a supported AI tool so it can be analysed and redacted on the device before it is sent. That content is processed locally and is never sent to Velatir.
Only when your organisation enables it. With Redaction on, the text you paste into a supported AI tool is passed to an on-device component that strips sensitive content. The analysis runs entirely on the device — the pasted content is never sent to Velatir — and you see the redacted result before anything reaches the AI tool.
For each captured interaction, a trace containing the prompt, the response, the model, token counts, and process context. After review, a generalized description is always kept; whether the raw content is stored is your data privacy setting. See Data privacy.
Velatir needs to reach api.velatir.com to submit traces. If the device is offline it buffers them and sends once connectivity returns; your AI applications keep working as normal in the meantime.

​
Networking

Yes, including split-tunnel and full-tunnel VPNs. Velatir adjusts on its own when a VPN connects or disconnects, so no restart is needed. See VPN compatibility.
Velatir recovers on its own within seconds, and never leaves the device without internet access.

​
Certificates

Yes. Provide a PFX bundle and Velatir uses it instead of its own certificate. This is the recommended path if you already operate an internal CA. See Bring your own certificate.
Runtimes that keep their own trust store (Node.js, Python requests, JVM) need an explicit pointer to the Velatir certificate. See Troubleshooting.
Pinned applications are detected and passed through unmodified; they cannot be inspected without the application cooperating. If a pinned application matters to your compliance workflow, contact your account team.

​
Operations

Run velatir status --json as a Microsoft Intune Remediation, a Jamf Pro extension attribute, or any similar device-state collector. The output includes the agent’s status, version, capture state, and last trace timestamp.
Redeploy the install command with the new key, or run velatir set-api-key --key vltr_... on the device. The new key takes effect immediately.
Nothing visible besides a tray icon. Supported AI applications work exactly as before, and users are not prompted during normal use. Behaviour changes only when an agent in Enforcer mode acts — for example blocking or escalating an interaction, or, when Redaction is enabled, showing a redacted version of pasted content for the user to review.

​
Next steps

Download and install

Set Velatir up on Windows or macOS.

Enterprise deployment

Roll out across your organisation.

Troubleshooting

Diagnose the issues most commonly seen in production.

How it works

How Velatir for Desktop works.