The first signed canary went up on 1 March and it will be reissued on the first of every month. You can read the current one, and every previous one, on the canary page.
This post is about what the document does, what it cannot do, and why we still bothered.
What it says
Five statements, in plain language, with no lawyerly hedging:
- We have received no secret order compelling us to hand over customer data.
- We have received no gag order or non-disclosure demand attached to any legal process.
- We have handed over no encryption key, credential or hypervisor access to any party.
- No equipment of ours has been seized, imaged or removed by any authority.
- Control of the company and of the network has not changed.
Each statement is either true on the day of signing or the statement is absent. There is no third option, no softening adverb, and no version of the document in which a statement is quietly reworded rather than removed.
How it is signed
The canary is signed with an OpenPGP key whose fingerprint is published on the canary page and has been the same since March. Inside the signed text is a recent block hash from a public chain, which fixes the earliest moment the document could have been produced. Without that, a stack of pre-signed canaries could be released monthly by anybody holding the key, and the whole exercise would be theatre.
Monthly rather than daily. A daily canary trains everyone to ignore it, and then a genuine omission looks like a public holiday or a broken cron job. Monthly is slow enough to be noticed and frequent enough to be useful.
The legal reasoning, honestly
The theory runs as follows. A state can compel silence. Compelling an affirmative lie is a different thing, and in several legal traditions it runs into protections against compelled speech. A canary tries to convert a prohibition on speaking into an obligation to keep speaking, and then stops.
That theory has three problems and we would rather state them than let you discover them later.
It is largely untested. Very few courts anywhere have ruled on whether a canary can be compelled to continue. The argument is plausible and it is not settled, and anyone telling you otherwise is selling something.
It fails outright in some jurisdictions. We operate in twenty-nine countries. In several of them the compelled-speech reasoning has no purchase at all, and a court that can order silence could plausibly order the publication to continue unchanged. A canary is not equally strong everywhere, and it is strongest in precisely the places you were least worried about.
It is a blunt instrument. The document is fleet-wide. It cannot tell you that something happened at one site and not another, because saying that would itself be the disclosure the gag prohibits. When a canary changes, you learn that something occurred, not what or where.
Why we published it anyway
Because the alternative is nothing, and nothing is worse. A weak signal that everybody can check beats a strong assurance in a marketing page that nobody can.
There is also a discipline argument that we did not anticipate and now value more than the document. Signing five statements every month means five statements that somebody has to verify internally every month, in writing, with a name attached. Any process that would make one of them false now has a checkpoint in front of it.
The protection that actually matters
A canary tells you something happened. What determines the consequences is how much exists to hand over, and the answer here is deliberately very little: an email address, a password hash, a seven-day panel access log, and an invoice record with no identity attached to it. Payment references are purged after settlement. Instance traffic is never recorded.
That inventory is published in full on what we log and the policy behind it is on the no-KYC page. If you have time to read one page and not the other, read the retention table rather than the canary. A canary is a smoke alarm. Not storing anything is not having a fire.
What we will not promise
We will not promise to notify you individually of a legal request. In several jurisdictions where we operate, doing so is itself an offence, and a promise we would have to break under pressure is worse than no promise. Where notification is permitted, we notify. That distinction is in the terms and it is deliberately narrow.
We also will not promise the canary will always be there. If it stops, it stops, and you should treat the silence as information rather than as an outage.