Run your entire DPO practice from one secure workspace.
Clients. DSARs. ROPAs. DPIAs. Breaches. Evidence. Veld brings the work together while keeping your clients’ data unreadable to Veld.
Free on one device, no account needed · Nothing to install · Built in the UK
Everything you manage as a data protection professional, organised around the work that actually matters.
An illustration. The organisations and records shown are fictional.
Keep every controller, contact and engagement in one place.
Track requests, deadlines, searches, exemptions and responses.
Maintain records of processing without spreadsheet sprawl.
Assess risk, document decisions and retain the evidence.
Keep the 72-hour clock visible from the moment you’re aware.
Create a defensible record of what happened, when it happened and why.
Veld is designed so that your client data remains unreadable to Veld. Your encryption key stays with you.
The default, and the free plan. Nothing is transmitted at all — the portal is served with
connect-src 'none', so the browser itself refuses to let it open a connection.
On this setting Veld is not a processor of your clients’ data, because Veld receives
none of it.
Veld stores the sealed workspace so any device can open it, and holds ciphertext with no key that opens it — the key is derived from your password by PBKDF2 and never leaves your machine. On this setting Veld is a processor, under an Article 28 contract.
Explore the security architecture →
The security page also sets out what this design does not protect against. Lose the password and the recovery key and nobody can help — including Veld.
Veld doesn’t replace professional judgement. It helps you record it.
Cited, not generated. You choose the searches, the outcome and the exemptions. Veld assembles the letter around those decisions and quotes the provision in full — Article 15(4), Schedule 2 Part 3 paragraph 16, not “an exemption applies”.
Veld exports a documented, versioned file with a SHA-256 of every record in it. Anything that reads JSON or a spreadsheet can read your registers — no API key, no connector to trust, nothing of yours held by us.
The file is the integration. One documented format, versioned separately from anything inside Veld, carrying a digest the recipient can recompute. A compliance platform, an auditor and the practitioner who takes over from you all read the same thing.
Vanta also has a connector you run yourself, so the push happens on your machine under your own credential — which is why connecting it adds no sub-processor to your Article 28 arrangements. Requests and breaches travel as counts and dates; nothing identifying a data subject ever leaves in an assurance export.
Veld is built for people who manage data protection professionally. It handles the structure, deadlines, records and evidence so you can focus on the decisions that actually require your expertise.
Start free. No credit card. No trial expiry.
Prices exclude VAT. Monthly rolling, cancel whenever — the workspace keeps working on your
own machine either way. Compare the plans in full →
Veld was not commissioned, funded or road-mapped. It grew out of a single data protection practice that needed a tool no vendor was selling — one place for the controllers, the statutory clocks, the registers and the evidence that were otherwise spread across a dozen files.
That is still the test every feature has to pass: not would this look good in a demo, but would this have survived a Tuesday when a request landed while you were on site with someone else.
The free portal opens in your browser, creates the workspace on your machine and starts working — no account, nothing for us to provision. Evaluate it on your own book before you speak to anyone, including us. Add syncing later if you want it on more than one device.
Prefer to talk first, or want onboarding and a licence for a working practice? Leave your details and Kay will reply — a practitioner, not a sales team.
Run your data protection practice privately, from one workspace.