One platform, six product surfaces, fewer blind spots

Why CanaryVaults keeps modules distinct while still sharing auth, routing, and alerting across the full platform.

CanaryVaults is not one product. It is six products that share infrastructure. Email canary identities, RAG leak detection, prompt injection defense, AI honeypots, tamper-evident audit trails, and agent heartbeat monitoring. Each product solves a distinct problem, but they all share authentication, alerting, billing, and the trust surface.

This architecture exists because AI security is not one problem. It is a surface area. Different attack vectors require different detection methods, different evidence types, and different response workflows. Trying to solve all of them with one tool creates a product that is mediocre at everything.

Instead, each CanaryVaults product is designed to be excellent at exactly one thing. CanaryShield blocks prompt injection. CanaryRAG detects document leaks. CanaryHoneypot fingerprints attackers. CanaryAudit creates tamper-evident action records. CanaryAgent watches your agents for silence and scans their skills. The original CanaryVaults product monitors email-based data theft.

What they share is the operational layer: one login, one alert system (email + Telegram), one evidence store, and one billing surface. This means a team can adopt one product, prove its value, and expand to others without re-onboarding.

The pricing reflects this. Every plan includes access to all six products. The limits change, but the surface does not. API keys are not a paid feature — a Free account can mint one. What genuinely moves with the plan is volume, plus two things: audit logging starts on Shield, and the legal PDF export is Pro.

This article is about a shipped surface: All product surfaces. Integration details live in the docs.