Terms of service.

The service

Canary provides adversarial security testing for financial AI agents — payments, trading, treasury, and spend — in isolated environments. It is not a bank, processor, or incident-response retainer. Results are findings about the agent and policy you submitted under the scenarios that ran. Reports never say the agent is secure, and a passing score is not a warranty that production is safe.

Sandbox only

You will not point Canary at live customer funds, production payment credentials, or systems you do not have permission to test. You are responsible for using sandbox keys and for any harm if you ignore that.

Accounts and wallets

Lab identity is Sign-In with Ethereum (SIWE). An httpOnly session cookie is set after you sign a message with an injected browser wallet. Keep that wallet under your control. Activity from your session is treated as yours. We may suspend access for abuse, unpaid invoices, or risk to other customers.

Bounties

• Public bounties live on this marketing site, not in Lab.
• Posting a bounty does not make Canary a party to the underlying agent’s operations.
• USDC payouts are due only after Canary independently Confirm-replays the claimed exploit under the posted rules. Submitter confidence is ignored.
• We may reject claims that require live funds, out-of-scope systems, or social engineering of people rather than the agent.

Program-specific rules are in the bounty terms.

Acceptable use

Do not use Canary to attack systems you do not own or have written authorization to test, to launder or move real value, or to store illegal content. Do not attempt to escape the sandbox or disrupt the service for others.

Intellectual property

Canary owns the product, docs, and marks. You own your agent, policy, and the eval artifacts we generate for your account, subject to our right to use anonymized patterns to operate and harden the service.

Disclaimer and liability

The service is provided as is. We do not warrant that every exploit will be found. Reports never say the agent is secure. To the extent allowed by law, Canary is not liable for lost profits, lost funds, or indirect damages, and our total liability for a claim is limited to fees you paid us in the three months before the claim.

Everything else

These terms are governed by the laws of the State of Delaware, excluding conflict-of-law rules. Privacy practices are in the privacy policy. We may update these terms; continued use after notice is acceptance. Contact legal@canary.security.