SECURITY LAYERS FOR FINANCIAL AGENTS
CANARY

LEGAL / PRIVACY

Privacy policy.

Last updated 30 August 2026. Canary is a security-testing product for financial AI agents. This policy describes what we collect when you use the site, the lab, and bounties.

Who we are

Canary (“we”) operates canary.security and the related lab and bounty services. Questions: privacy@canary.security.

What we collect

  • Wallet addresses you use to SIWE into Lab or to connect an injected browser wallet on bounty pages.
  • Eval configuration: agent description, tool schemas, spend policy, and sandbox credentials you submit — not production keys, and not live funds.
  • Run artifacts: traces, scores, and replay packages needed to show an exploit. Reports never say the agent is secure.
  • Bounty posts, claims, Confirm-replay outcomes, and USDC payout records.
  • Usage logs (pages, errors, approximate location from IP) to operate and secure the service.

What we do not want

Do not paste production secrets, customer card data, or live wallet seed material into an eval. Canary is built for isolated credentials. If you submit live secrets by mistake, rotate them and tell us.

Why we use it

To run evals, score policy, Confirm-replay exploits, operate bounties, prevent abuse, and improve the product. We do not sell personal information. We do not use eval traces to train a public model on your agent’s traffic unless you opt into a separate, written program.

Sharing

We share data with infrastructure providers who process it on our instructions (hosting, analytics, email, RPC). If you post a public bounty, the title, scope, and confirmed replay may be visible to other users. Legal requests: we disclose when required by law.

Retention

Account data lasts for the life of the account. Eval traces are kept so you can rerun and compare; you may request deletion of a run except where we must keep a record of a paid bounty. Backups expire on a rolling cycle.

Cookies

Lab uses an httpOnly SIWE session cookie. Bounty pages store injected wallet connection state in first-party cookies (not WalletConnect). Details are in the cookie policy.

Your rights

Depending on where you live you may access, correct, export, or delete personal data, or object to certain processing. Email privacy@canary.security. We will need enough information to find your account or wallet.