Pricing

Pay for detection capacity, nothing else.

Every plan runs real canaries — email decoys, trap facts, prompt firewall, honeypots, skill scans. Limits scale with the plan; tamper-evident logging and CanaryAudit start on Shield, the legal PDF export on Pro. API keys are on every plan.

Free

$0 / forever

No credit card required

Best for proving the signal path before you spend anything.

Shield

$12 /mo

Billed monthly

Best for teams that need real prompt defense, alerts, and proof.

MOST CHOSEN

Pro

$24 /mo

Billed monthly

Best for production AI teams that want higher limits and automation access.

Enterprise

$120 /mo

Billed monthly

Best for regulated teams that need contracts, support, and compliance depth.

What you getFreeShieldProEnterprise

CanaryVaults (Email)

Protected emails131030, negotiable above

Decoy identities393090, negotiable above

CanaryRAG (Documents)

Documents225200500

Facts per doc3333

Monitor checks/mo105002,0006,000

CanaryShield (Firewall)

Inspections/mo105003,00010,000

Rules engine

LLM semantic analysis

CanaryHoneypot

Traps1550200

Intent classification

Tamper-evident hit logging

CanaryAudit

Audit logs/mo010010,00050,000

Integrity verification

Legal export PDF

CanaryAgent

Skill scans/mo5505001,500

Heartbeat monitoring

Action timeline

Alerts

Email alerts

Telegram alerts

Tamper-evident logging

Access

API access

SLA

Negotiated capacityContact sales

Legal PDF export is tamper-evident, not court-admissible — it proves a record hasn't changed since logging; admissibility is a question for your counsel. When you hit any limit, you'll see exactly which one, your reset date, and a one-click upgrade. Existing traps keep alerting.

vs a traditional honeypot

Thinkst Canary and CanaryTokens are excellent at what they do — network and file tripwires you run yourself. CanaryVaults covers the surfaces they don't: AI systems, and the seeding work in between.

CanaryVaultsTraditional honeypot (Thinkst / CanaryTokens)

Deployment modelManaged SaaS — nothing to host or maintainYou deploy the appliances/VMs (Thinkst) or generate and place tokens yourself (CanaryTokens)

Paste-site seedingIncluded — decoy credentials seeded to paste platforms with staggered timingManual — you decide where tokens go and place them yourself

LLM / RAG leak protectionCanaryRAG trap facts + CanaryShield prompt firewall, on every planNo equivalent — token types cover files, DNS, URLs, cloud keys

Threat-intel enrichmentEvery hit enriched (AbuseIPDB, IPInfo, Shodan, VirusTotal) + weekly digestPer-alert notification; enrichment and correlation are on you

Price entry pointFree plan — paid from $12/moCanaryTokens.org: free · Thinkst Canary: US$7,500/yr for 5 Canaries (their published list price — verify current)

Time to first canaryMinutes — sign up, plant a decoy, no credit cardCanaryTokens: minutes for a single token · Thinkst: minutes once the appliance/VM is provisioned

Thinkst Canary and CanaryTokens are products of Thinkst Applied Research, no affiliation. Competitor cells reflect their publicly listed model and pricing at the time of writing (Thinkst list price last verified early 2026) — check canary.tools and canarytokens.org for current details.

Pricing questions, answered plainly.

Is there a free plan?

Yes. Free includes 3 email canary identities, 2 CanaryRAG documents, 10 CanaryShield inspections per month, 1 honeypot trap, 5 CanaryAgent skill scans per month, and email alerts. No credit card required.

Does every plan include all product surfaces?

Free covers decoy identities, trap documents, prompt inspection, honeypots, and skill scans. CanaryAudit logging, Telegram alerts, and tamper-evident logging start on Shield; the legal PDF export starts on Pro. API access is not a paid feature — any plan, Free included, can mint a key in Settings, and your plan's limits meter API calls exactly as they meter the console.

What happens when I hit a plan limit?

You see exactly which limit you hit, your reset date, and a one-click upgrade. Existing canaries and traps keep alerting — hitting a limit never silences detection that is already deployed.

How does billing work?

Paid plans are billed monthly through PayPal. Enterprise is handled by contract — contact us for invoice billing, custom limits, and SLA terms.

Is the legal PDF export court-admissible evidence?

It is tamper-evident, not automatically admissible. The export proves a record has not changed since it was logged; whether that satisfies a court is a question for your counsel.

Start on Free. Upgrade when a limit tells you to.

No credit card. Real canaries and a full evidence log from minute one.

Start free

Pricing questions, answered plainly.

Is there a free plan?

Does every plan include all product surfaces?

What happens when I hit a plan limit?

You see exactly which limit you hit, your reset date, and a one-click upgrade. Existing canaries and traps keep alerting — hitting a limit never silences detection that is already deployed.

How does billing work?

Paid plans are billed monthly through PayPal. Enterprise is handled by contract — contact us for invoice billing, custom limits, and SLA terms.

Is the legal PDF export court-admissible evidence?

It is tamper-evident, not automatically admissible. The export proves a record has not changed since it was logged; whether that satisfies a court is a question for your counsel.