Security center
How the platform handles monitoring, incident response, and responsible disclosure.
Trust Center
Trust center
Every trust surface in one place. Short and honest: what exists is linked below, and nothing is claimed that does not exist.
Trust surfaces
Security posture, privacy handling, live status, incident history, and change history.
Privacy and data handling
What data each product surface handles, plus export and delete controls.
Network status
Component health overview for the canary network.
Incident log
Public record of service incidents and postmortems. None has been published yet.
Changelog
What shipped and when, maintained from the main branch history. RSS and JSON feeds available.
Data Processing Agreement
How DPAs are handled today, and the current state of formal certifications.
Where things stand today
A plain summary, so nobody has to reverse-engineer marketing copy.
- CanaryVaults does not currently hold SOC 2, ISO 27001, or similar third-party certification. If a formal audit is scheduled, the timeline will be published here first.
- Data export and account deletion are self-service from account settings, and both are wired end to end.
- Security-relevant account activity (sign-ins, plan changes, canary triggers, data exports) is recorded in an audit log you can review in your own settings.
- The status page shows a live probe taken when you open it and a recorded history of health samples; the incident log is the authoritative record of user-affecting failures.
Responsible disclosure
Found a security issue? Email the security mailbox directly. It is read by the person who can fix it. The disclosure policy says what to send, what is in scope and what happens next.