Bounded evidence
Normalized findings exclude raw logs, raw scanner responses, secret values, prompt content, and unrestricted workflow contents.
Security controls
Security and privacy
CanaryGuard collects limited release evidence. Deterministic policy makes the release decision. The public form never requests credentials, source archives, source code, production logs, deployment configuration, contracts, quotations, invoices, or payment details.
Controls
Collect only the evidence needed for review.
Tenant isolation
Credentials are stored as digests. Repository grants and roles control access, and requests for another tenant’s records are rejected.
Request validation
The form limits request size, rejects credential-like content, requires consent, and checks for duplicate requests and automated spam.
Retention
Every lead receives a 180-day retention deadline. Operators must delete or lawfully extend it when that deadline arrives.
Contracts and payments
Scopes, contracts, quotations, payments, and private customer materials are handled outside the application.
Recovery
Provider settings, database migrations, rollback procedures, and revision health checks support deployment recovery.
Privacy and provider processing
Understand where information goes.
Responsible operator
Valerie Rwamba Munyi trading as NextEdge Analytics operates CanaryGuard. Business contact details and the release challenge are used to assess and respond to the request. Only authorized operators can manage customer requests.
Privacy requests
Use the request form to identify a correction or deletion request with minimal business contact details. An operator verifies the request before acting. Do not submit identity documents, credentials, or additional sensitive data.
Retention and deletion
Lead records receive a 180-day retention deadline. Deletion or a lawful extension requires operator action; the deadline does not promise automatic deletion. Engagement-specific release-data retention, backup treatment, and offboarding are agreed before work begins.
Hosting and GitHub
The public service is hosted on Render and uses PostgreSQL when persistence is enabled. Authorized GitHub App integrations collect bounded repository evidence. The engagement must identify the actual hosting, database, access, and data-location arrangements.
Notification providers
The configured notification path uses a Cloudflare Worker and Resend. It receives the configured operator recipient, fixed subject, request reference, event time, and idempotency key. Customer contact details and challenge text are excluded from that relay payload.
Optional OpenAI analysis
MOCK is the default and makes no external model call. Enabling OpenAI sends the sanitized review request, which can include bounded change and diff content, for analysis. Customer authorization and provider terms must be agreed first. Requests use store: false; this does not guarantee zero provider retention. CanaryGuard telemetry excludes prompts, raw diffs, credentials, and raw model output.
The public form is for bounded business inquiries. Customer processing instructions, confidentiality, permitted providers, and any required data-processing agreement are finalized before integration. Evidence preparation does not establish regulatory compliance.