Neither. It captures your regular keyboard and creates a virtual keyboard - at least on Linux.

Added later: This is what I get on my sway desktop in addition to the physical keyboard:

  Input device: kanata
    Type: Keyboard
    Identifier: 1:1:kanata
    Product ID: 1
    Vendor ID: 1
    Active Keyboard Layout: English (US)
    Libinput Send Events: enabled

And the mapping from the physical keyboard to the virtual keyboard is done by kanata running as a user service (without root privileges). You just need to give uinput access privilege to your user account.

As I understand, it's on the OS level

It's user-land remapping of the keyboard input. Even on Linux it's a deamon you can start/stop at any time, and if it's not running no processing is done.