Pricing

Pay for detection capacity, nothing else.

Every plan runs real canaries: email decoys, trap facts, prompt firewall, honeypots, skill scans. Limits scale with the plan; tamper-evident logging and CanaryAudit start on Shield, the legal PDF export on Pro. API keys are on every plan.

Checking your current plan...

Free

$0 / forever

No credit card required

Best for proving the signal path before you spend anything.

Shield

$12 /mo

Billed monthly

Best for teams that need real prompt defense, alerts, and proof.

RECOMMENDED

Pro

$24 /mo

Billed monthly

Best for production AI teams that want higher limits and automation access.

Enterprise

$120 /mo

Billed monthly

Best for regulated teams that need contracts, support, and compliance depth.

Contact Us
What you getFreeShieldProEnterprise
CanaryVaults (Email)
Protected emails131030, negotiable above
Decoy identities393090, negotiable above
CanaryRAG (Documents)
Documents225200500
Facts per doc3333
Monitor checks/mo105002,0006,000
CanaryShield (Firewall)
Inspections/mo105003,00010,000
Rules engineIncludedIncludedIncludedIncluded
LLM semantic analysisIncludedIncludedIncludedIncluded
CanaryHoneypot
Traps1550200
Intent classificationIncludedIncludedIncludedIncluded
Tamper-evident hit loggingNot includedIncludedIncludedIncluded
CanaryAudit
Audit logs/mo010010,00050,000
Integrity verificationNot includedIncludedIncludedIncluded
Legal export PDFNot includedNot includedIncludedIncluded
CanaryAgent
Skill scans/mo5505001,500
Decoy tool servers1525100
Heartbeat monitoringIncludedIncludedIncludedIncluded
Action timelineNot includedIncludedIncludedIncluded
Alerts
Email alertsIncludedIncludedIncludedIncluded
Telegram alertsIncludedIncludedIncludedIncluded
Tamper-evident loggingNot includedIncludedIncludedIncluded
Access
API accessIncludedIncludedIncludedIncluded
SLANot includedNot includedNot includedIncluded
Negotiated capacityNot includedNot includedNot includedContact sales

Legal PDF export is tamper-evident, not court-admissible. It proves a record hasn't changed since logging; admissibility is a question for your counsel. When you hit any limit, you'll see exactly which one, your reset date, and a one-click upgrade. Existing traps keep alerting.

vs a traditional honeypot

Thinkst Canary and CanaryTokens are excellent at what they do: network and file tripwires you run yourself. CanaryVaults covers the surfaces they don't: AI systems, and the seeding work in between.

DimensionCanaryVaultsTraditional honeypot (Thinkst / CanaryTokens)
Deployment modelManaged SaaS: nothing to host or maintainYou deploy the appliances/VMs (Thinkst) or generate and place tokens yourself (CanaryTokens)
Paste-site seedingIncluded: decoy credentials seeded to paste platforms with staggered timingManual: you decide where tokens go and place them yourself
LLM / RAG leak protectionCanaryRAG trap facts + CanaryShield prompt firewall, on every planNo equivalent: token types cover files, DNS, URLs, cloud keys
Threat-intel enrichmentHits are checked against IP reputation and exposure data, plus a weekly digestPer-alert notification; enrichment and correlation are on you
Price entry pointFree plan, paid from $12/moCanaryTokens.org: free · Thinkst Canary: paid, see canary.tools
Getting startedSign up and plant a decoy from the dashboard, no credit cardCanaryTokens: generate a token, no account · Thinkst: provision the appliance or VM first

Thinkst Canary and CanaryTokens are products of Thinkst Applied Research, no affiliation. Competitor cells reflect their publicly described model at the time of writing. We do not list competitor pricing. Check canary.tools and canarytokens.org for it.

Pricing questions, answered plainly.

Is there a free plan?

Yes. Free includes 3 email canary identities, 2 CanaryRAG documents, 10 CanaryShield inspections per month, 1 honeypot trap, 5 CanaryAgent skill scans per month, 1 decoy tool server, and email and Telegram alerts. No credit card required.

Does every plan include all product surfaces?

Free covers decoy identities, trap documents, prompt inspection, honeypots, skill scans, decoy tools, and email and Telegram alerts. CanaryAudit logging and tamper-evident logging start on Shield; the legal PDF export starts on Pro. API access is not a paid feature: any plan, Free included, can mint a key in Settings, and your plan's limits meter API calls exactly as they meter the console.

What happens when I hit a plan limit?

You see exactly which limit you hit, your reset date, and a one-click upgrade. Existing canaries and traps keep alerting. Hitting a limit never silences detection that is already deployed.

How does billing work?

Paid plans are billed monthly through PayPal. Enterprise is handled by contract: contact us for invoice billing, negotiated capacity, and SLA terms.

Is the legal PDF export court-admissible evidence?

It is tamper-evident, not automatically admissible. The export proves a record has not changed since it was logged; whether that satisfies a court is a question for your counsel.

Start on Free. Upgrade when a limit tells you to.

No credit card. Real canaries and a full evidence log on the Free plan.

Start free