Trust boundary

Security and privacy

CanaryGuard collects bounded release facts and keeps deterministic policy authoritative. The public intake never requests credentials, source archives, source code, production logs, deployment configuration, contracts, quotations, invoices, or payment details.

Controls

Designed for minimum necessary access.

Bounded evidence

Normalized findings exclude raw logs, raw scanner responses, secret values, prompt content, and unrestricted workflow contents.

Tenant isolation

Digest-only credentials, repository grants, explicit roles, and concealed cross-tenant resources protect customer boundaries.

Safe acquisition

Strict schemas, request-size limits, credential-shape rejection, idempotency digests, consent, and a honeypot constrain public intake.

Retention

Every lead receives a 180-day retention deadline. Operators must delete or lawfully extend it when that deadline arrives.

External commerce

Written scopes, contracts, quotations, payments, and private customer materials remain outside the application.

Recovery

Staged provider flags, additive migrations, explicit rollback order, and revision health checks preserve operational control.