One platform, six product surfaces, fewer blind spots

Why CanaryVaults keeps modules distinct while still sharing auth, routing, and alerting across the full platform.

CanaryVaults is not one product. It is six products that share infrastructure. Email canary identities, RAG leak detection, prompt injection defense, AI honeypots, tamper-evident audit trails, and agent heartbeat monitoring. Each product solves a distinct problem, but they all share authentication, alerting, billing, and the trust surface.

This architecture exists because AI security is not one problem. It is a surface area. Different attack vectors require different detection methods, different evidence types, and different response workflows. Trying to solve all of them with one tool creates a product that is mediocre at everything.

Instead, each CanaryVaults product is designed to be excellent at exactly one thing. CanaryShield blocks prompt injection. CanaryRAG detects document leaks. CanaryHoneypot fingerprints attackers. CanaryAudit creates tamper-evident action records. CanaryAgent watches your agents for silence and scans their skills. The original CanaryVaults product monitors email-based data theft.

What they share is the operational layer: one login, one alert system (email + Telegram), one evidence store, and one billing surface. This means a team can adopt one product, prove its value, and expand to others without re-onboarding.

The pricing reflects this. Free includes every product except CanaryAudit, which starts on Shield, and every paid plan includes all six. API keys are not a paid feature: a Free account can mint one. Beyond that, what moves with the plan is volume, plus the legal PDF export, which starts on Pro.

This article is about a shipped surface: All product surfaces. Integration details live in the docs.