Security center
How the platform handles monitoring, incident response, and responsible disclosure.
Trust Center
Trust center
Every trust surface in one place. Short and honest: what exists is linked below, and nothing is claimed that does not exist.
Trust surfaces
Security posture, privacy handling, live status, incident history, and change history.
Privacy and data handling
What data each product surface handles, plus export and delete controls.
Network status
Component health overview for the canary network.
Incident log
Public record of service incidents and postmortems. Currently empty — and that is the honest state.
Changelog
What shipped and when, maintained from the main branch history. RSS and JSON feeds available.
Data Processing Agreement
How DPAs are handled today, and the current state of formal certifications.
Where things stand today
A plain summary, so nobody has to reverse-engineer marketing copy.
- CanaryVaults does not currently hold SOC 2, ISO 27001, or similar third-party certification. If a formal audit is scheduled, the timeline will be published here first.
- Data export and account deletion are self-service from account settings, and both are wired end to end.
- Security-relevant account activity (sign-ins, plan changes, canary triggers, data exports) is recorded in an audit log you can review in your own settings.
- The status page shows representative component health; the incident log is the authoritative record of user-affecting failures.
Responsible disclosure
Found a security issue? Email the security mailbox directly — it is read by the people who can fix it. The repository security policy is published on GitHub.