What it does
- Captures AI usage. It watches the AI apps your organisation uses, in the browser and in desktop and CLI apps, and turns each interaction into a trace your agents review.
- Inspects only AI apps. Velatir looks only at traffic from the AI apps on its supported list. Everything else on the device is left completely untouched, so other software behaves exactly as before.
- Updates itself. The agent keeps itself current automatically, with no update service to manage.
Managed capabilities
The installer is the same across an organisation’s devices; Velatir applies the organisation’s capability configuration after installation. The agent can manage device identity and health, browser coverage, local AI-app detection, directory identity, updates, and (where enabled) network capture independently. A missing or unavailable configuration fails safe: the device does not enable network capture or invent a capability setting. Browser policy is ownership-aware. Organisations can have Velatir manage supported browser installation, write only the identity values while their own MDM manages installation, or leave browser policy entirely to their MDM. The agent removes only policy it owns.Network capture safety
Network capture is off by default and remains dormant until the organisation enables it and the device’s safety checks pass. The agent performs the privileged machine changes; the host cannot bypass that boundary. If preflight or health checks fail, or a remote kill switch is engaged, capture is torn down and the device returns to the connectivity-first state. The device reports its versions, capture state, health, update outcome, and directory identity in its heartbeat. This lets Velatir stage updates, halt an unhealthy rollout, and diagnose a device without requiring a reinstall.Inspecting encrypted traffic
AI traffic is encrypted, so to read it Velatir presents a certificate the device trusts. It generates a unique certificate authority per device, sets it up only when capture is enabled, and removes it when capture is turned off or the app is uninstalled. Nothing shared is distributed, and a device that never enables capture holds no certificate at all. Organisations that prefer to use their own certificate authority can bring their own.On macOS
The first time it runs, macOS asks the user to approve Velatir’s network extension once. On managed Macs you can pre-approve this so there is no prompt; see Enterprise deployment.Next steps
Permissions
What Velatir asks for on each platform, and why.
VPN compatibility
How Velatir works alongside corporate VPNs.
Download and install
Install on Windows or macOS.
Troubleshooting
Diagnose capture, certificate, and update issues.