Privacy and Data Handling

What data each product surface may handle

Each module handles a different shape of security data, so the privacy page mirrors that split clearly.

CanaryVaults

Identity and monitoring data

This surface can involve account profile data, protected email addresses, alert routing details, and trigger telemetry needed to monitor attacker contact. It also keeps your answer to the optional sign-up question about how you heard about CanaryVaults, if you give one; it is used only to see which channels bring people, and it is exported and deleted with the account.

CanaryRAG

Document and leak-detection data

This surface can involve original document text, injected document text, planted facts, and suspicious AI outputs. On-chain anchoring is not enabled on this deployment, so no blockchain transaction reference is written for a detected leak.

CanaryShield

Prompt inspection and block history

This surface can involve user prompts submitted for inspection, optional system prompts, detection outcomes, confidence scores, and blocked-message history tied to the account.

CanaryHoneypot

Trap endpoint and attacker telemetry

This surface can involve honeypot configuration, public trap hits, captured request headers, IP addresses, and submitted messages. On-chain anchoring is not enabled on this deployment, so no blockchain reference is written for a trap hit.

CanaryAudit

Agent action logs and verification data

This surface can involve agent identifiers, action detail, outcomes, metadata supplied by the user, content hashes, and the cryptographic seal used to detect later modification. On-chain anchoring is not enabled on this deployment, so no blockchain transaction reference is written.

CanaryAgent

Agent heartbeats, skill scans and decoy tools

This surface can involve agent identifiers, heartbeat status and activity counts, the skill code you submit for a scan, and each scan's verdict and findings. The skill code is sent for analysis and is not stored: the scan history keeps the skill's name and what the scan found. A decoy tool server records each call made to it: the tool, the arguments the caller sent, the client's stated name and version, and the caller's IP address and user agent.

Privacy promises

What the product is trying to minimize

Collect only the data needed to operate monitoring, alerting, billing, and user-facing controls, plus the optional answer to how you heard about CanaryVaults, which you can skip.
Keep product-surface descriptions clear so users understand whether they are submitting inbox data, documents, prompts, trap telemetry, or audit records.
Support export and deletion workflows through account controls where available.
Use linked trust pages so security, privacy, and support expectations are easier to review together.

User controls

How users keep control of their data

Review and update account profile and notification settings.
Export supported account data and audit records through the settings or product workflows where available.
Delete the account through supported privacy controls.
Raise privacy or handling concerns through the support and security paths.

Storage transparency

This is the practical summary of where the platform draws boundaries around retention, processors, and public proof.

Transport data is encrypted in transit.
Platform data is stored with controlled access and operational logging.
Payment data is handled by processors; full card details are not stored in CanaryVaults.
Audit records are sealed with an HMAC key held in the application environment and never stored in the database, so a record altered at the database level fails verification.
On-chain proof anchoring is not enabled on this deployment. No content hash, transaction, or other data is written to any public blockchain. If that changes, anything published on-chain would be public and permanent, and this page will name the network first.

How long data is kept

These are the retention windows the platform actually enforces in code, not aspirational values.

Threat events: Kept for the account retention window (default 365 days). A monthly cleanup job deletes events older than that window on the 1st of each month at 02:00 UTC.
Community shield alerts: Shared malicious-IP alerts expire 7 days after they are created.
Data export links: Emailed export download links are single-use and expire after 24 hours.
Backend operational logs: Rotated with a 30-day retention.
Error reports: When a page fails in your browser, a report of the failure is stored so it can be fixed. Before it is stored, email addresses other than our own and anything that looks like a password or key are removed, and it is not tied to any account. Reports older than 90 days are deleted at the monthly cleanup, so none is kept longer than about four months. Errors on our servers go instead to the error-tracking service listed on our subprocessors page, which describes what is removed before anything is sent.
Session cookies: Authentication cookies live at most 7 days and are HttpOnly. See the cookie policy for details.
CanaryRAG documents: The text of a document you protect, and the copy with the trap facts planted in it, is cleared after the account retention window (default 365 days). The document entry and its planted facts are kept so a later leak is still caught. You can delete a document outright at any time from the CanaryRAG console, and every document is deleted with your account.
CanaryAgent decoy tool calls: Each call a decoy tool server records is kept for the account retention window (default 365 days) and deleted at the monthly cleanup after that. Deleting a server, which the console allows once it is turned off, a day after it was made and ten minutes after its last alert, also deletes every call kept for it.
CanaryAgent decoy tool servers: Kept until you delete the server or your account.
Account, canaries, monitored emails, billing records: Kept until you delete your account.
Public blockchain references: None exist. On-chain anchoring is not enabled on this deployment, so nothing has been published to a public blockchain and there is no on-chain data to retain or delete. If anchoring is enabled in future, on-chain content hashes are public and permanent by design and cannot be deleted.

Trap-hit telemetry captured from attackers (IP addresses, request headers, submitted messages) is security data about the attacking party and may be retained beyond the windows above for abuse prevention and community defense.

Your data rights (GDPR, UK GDPR, CCPA)

Export and deletion are self-service. This section describes exactly what each control does.

Export: download a JSON export of your data from account settings at any time. It includes your account profile, canaries, threat events, subscription and billing event history, and the data each product holds for you: CanaryRAG documents, traps and their hits, audit records, Shield blocks, decoy tool servers and their calls, breach findings and the rest.
Deletion: delete your account from settings, within 15 minutes of signing in. Deletion is immediate and irreversible, cancels any active PayPal subscription, removes your database records and authentication account, and sends a confirmation email.
Both actions are self-service and complete without a support ticket. If you send a request by email instead, we respond within 30 days, consistent with GDPR and UK GDPR response requirements.
Email requests go to hello@canaryvaults.com, which reaches the data controller directly. Security vulnerabilities go to security@canaryvaults.com instead. That mailbox is for disclosure, and the security page says what happens after a report.

Data controller: the CanaryVaults service, operated via canaryvaults.com. Formal legal-entity details (registered name and address) will be published here once finalized; privacy requests sent to hello@canaryvaults.com reach the controller directly in the meantime.

Third-party services

A complete list of every third-party service the platform uses, including the AI inference providers that process the prompts, documents, AI answers and skill code you submit, is maintained on the subprocessors page.

View the subprocessor list

Control actions

Update account settings, review security context, or open support from the linked trust surfaces below.

Open settings Open security center Review support paths