Every word, defined once.

Jump to

The three names people mix up

Get these right and everything else follows.

Canary#

The device — a small, low-power witness you put on a wall, a door, or a shelf. This is the thing people point at and the name they say out loud.

A Canary can have a camera, or radar, or neither. Several Canaries together are a fleet.

See it: /lab

SecuraCV#

The platform a Canary runs on — the witness kernel plus the signed record it keeps. It is the “how,” not the “what.”

Short for Secure Computer Vision. It also runs on cameras you already own, with no Canary involved.

See it: /how-it-works

Errer Labs#

The company that makes SecuraCV and holds the trademarks.

See it: /about

The idea

What makes this different from a security camera.

Witnessing (not watching)#

A watcher keeps footage and can later be asked who was in it. A witness keeps a checkable record of what happened, and structurally cannot answer “who.”

This is the whole thesis. Everything below is a consequence of it.

See it: /watch-over

Event#

The unit of output: a short statement like “large object crossed boundary” or “presence in restricted zone,” with a coarse time and a zone — and no identity.

Events are what the system emits instead of video. They are text, they are small, and they are signed.

See it: /how-it-works

The witness log#

The durable record: every event carries a hash of the event before it plus a signature, so the log can be added to but not silently edited or trimmed.

It is tamper-evident: the promise is not that interference can be prevented — it is that interference becomes visible.

See it: /witness

Privacy by absence#

The surveillance features were never written, so there is no setting to turn off. Guarantees are “can’t,” not “won’t.”

This is why there is no admin toggle for face recognition: there is no face-recognition code to toggle.

See it: /about

Coarse timestamps#

Event times are deliberately bucketed into wide windows, so the log can prove that something happened without becoming a minute-by-minute diary of your day.

Precision is treated as a privacy cost, not a free feature.

See it: /how-it-works

Verified#

A reserved word on this site. It means a cryptographic signature was checked against a key that was pinned in advance — nothing looser.

When we mean something weaker we say “heard,” “reported,” or “presence.” Those are never trust claims.

See it: /verify

Getting footage out

The part everyone asks about second.

The Vault#

The sealed store where raw snapshots live. Sealed means no one — including you, including us — can open it alone.

See it: /vault

Break-glass#

The only way into the Vault: a time-limited, fully audited unseal that needs approval from several of your trustees before it will open.

It is meant to be set up early and rehearsed before you need it, like a fire drill.

See it: /vault

Trustee#

A person you nominate who holds one approval key. A break-glass request needs some agreed number of them to sign — “n of m.”

Pick people who would not all be compelled at once. That is the point of the quorum.

See it: /vault

Evidence envelope#

What an export ships in: a self-verifying container a recipient — an insurer, a lawyer, a neighbor — can check without installing our software.

See it: /verify

The Canary line

Each one is a different sensor answering a different question.

Canary WAP#

The recommended first build: sets itself up over its own Wi-Fi hotspot, stores to an SD card, talks to the others.

See it: /compare

Canary Vision#

The one with a camera and on-device detection — it decides what happened locally and reports the event, not the picture.

See it: /compare

Canary Sense#

Presence and breathing from 60 GHz radar, with no camera at all. Built for care and wellbeing in rooms where a camera would be wrong.

See it: /compare

Canary Sentinel#

A doorway guardian that fuses physically independent senses — motion, radar, Wi-Fi disturbance, light — so fooling one of them is not enough.

A channel that suddenly goes blind is treated as suspicious rather than quiet.

See it: /compare

Canary Display#

The wall screens: the calm, readable surface a household actually glances at.

See it: /modes

Fleet#

The word for a group of Canaries. Never “flock.”

A company called Flock soured the word, so it is off-limits in our copy, product names, and code. The only exception is the unrelated Unix flock() system call.

See it: /fleet

Board tier#

How honest we are about hardware: every board is labeled either verified (proven on real hardware) or compile-tested (builds in CI, not yet bench-proven).

We publish the distinction instead of blurring it. Much of the firmware is CI-verified and not yet hardware-verified.

See it: /lab

How Canaries talk

Three separate channels with deliberately different trust models — mixing them up is the most common misreading of the project.

Opera#

Your household mesh: how your own Canaries stay in sync with each other, over their own low-power radio.

See it: /how-it-works

Chirp#

The neighborly channel: nearby Canaries corroborating that something happened, using throwaway keys that are never stored.

The ephemeral keys are the firewall between Chirp and your household — a corroboration cannot be walked back to your devices.

See it: /how-it-works

Beacon#

A narrow, higher-trust channel for genuine life-safety advisories, held to a smoke-detector bar: boring, mostly silent, unmissable when it matters.

Every alert needs two different devices to sign it, sensors can never fire one on their own, and it carries no descriptions of people. It is explicitly not a neighborhood-watch or suspicious-person reporting system, and not a certified life-safety device.

See it: /how-it-works

Wi-Fi sensing (CSI)#

Detecting movement from how a room disturbs the Wi-Fi already passing through it. No camera, no microphone.

See it: /how-it-works

Presence (vs. verified)#

The deliberately weak claim: “I heard this device recently.” Self-reported, unsigned, and never a security boundary.

See it: /fleet

Things you can actually open

Most of these run in your browser, right now, with no hardware.

The Lab#

The real shipping firmware, compiled to run inside your browser: flash a simulated blank chip, watch it boot, and check the cryptographic birth certificate it just generated.

Nothing is installed and no hardware is needed. It is the fastest honest answer to “does this actually work?”

See it: /lab

The Flasher#

The app that writes firmware onto a real board and then keeps an eye on it. There is a browser version and a desktop version.

See it: /download

Canary Doctor#

The symptom-first help flow: describe what’s wrong, get the self-test and the fix.

See it: /checkup

Sticker check#

Scan the sticker on a Canary and confirm in your browser that the device is the one it claims to be. Nothing is uploaded.

See it: /verify

Randomart#

A little ASCII picture generated from a device’s key, so a person can compare identities at a glance instead of reading a long string of hex.

See it: /verify

The Builder#

Fit an enclosure to your exact hardware with dropdowns and get a printable 3D file out, all in the browser.

See it: /builder

The Witness Wall#

The big-screen surface for homes and venues: the verified record on the shared screen, not a grid of live feeds.

See it: /apple-tv

The Hub#

A Raspberry Pi running Home Assistant with SecuraCV on it — the piece that ties cameras, Canaries, and your dashboard together.

See it: /linux

Making and selling

The project is open all the way down, on purpose.

Maker Corps#

The four-tier maker community: how someone goes from printing one case to building kits for other people.

See it: /corps

Works with SecuraCV#

A badge anyone can earn for free, under a published trademark policy — the anti-lock-in promise in a sticker.

See it: /vendors

Warrant canary#

A public statement we update to say what we have and have not been compelled to hand over. Its absence is the signal.

See it: /transparency

Common questions

The ones we get asked most, answered the same way we'd answer them in person — including the parts that aren't finished yet.

Does it do face recognition?#

No — and it can’t. There is no face-recognition code in the project to enable or disable, and the same is true of license-plate reading, gait analysis, and age/gender/race estimation. The things it can report are “person,” “vehicle,” “animal,” “package” — never “who.” This is a rule about what exists, not a setting.

See it: /watch-over

Can someone watch a live feed of my house?#

Not through any normal path — there isn’t one. Raw footage lives briefly in a sealed store with no ordinary way out. Opening it takes break-glass: a time-limited, audited unseal that needs several of your trustees to approve. No single person can do it alone, including you and including us.

See it: /vault

So how do I get footage after an actual break-in?#

You run break-glass with your trustees, and the export comes out as a self-verifying file an insurer or a lawyer can check without our software. Set the trustees up early and rehearse it once — it is a fire drill, not a feature you discover on the worst day.

See it: /vault

Does it phone home? Do I need an account?#

No and no. Records stay on your hardware, there is no telemetry, and nothing about the system requires an account to run. The site itself sets no cookies — a claim we keep enforced in the test suite rather than just written on a page.

See it: /privacy

How do I know the record wasn’t edited?#

Every entry carries a fingerprint of the entry before it plus a signature, so removing or altering anything breaks the chain and verification fails loudly. You can check it yourself, offline, with our verifier or your own — that is what tamper-evident means here.

See it: /verify

What actually breaks these guarantees?#

A compromised computer. If an attacker owns the machine the software runs on, the promises that depend on that machine no longer hold. We write that down rather than gloss over it, and the threat model in the source spells out what survives and what doesn’t.

See it: /how-it-works

Is this finished? Can I buy one today?#

Partly. It is real, open, and running — but treat it as work in progress: some Canaries have released firmware and some are still in development, and much of the firmware is proven in continuous integration rather than on a bench. Every board says which it is. There are no certification claims, and the radios still need the regulatory work that selling them legally requires.

See it: /compare

Do I have to buy anything from you?#

No. Print the case, buy the parts wherever you like, and flash it yourself — the whole path is open under Apache-2.0. Kits exist for people who would rather not, and independent sellers can offer their own under the free “Works with SecuraCV” badge.

See it: /vendors

What’s the fastest way to see whether this is real?#

Open the Lab. It runs the actual device firmware inside your browser — flash a simulated blank chip, watch it come up, and check the cryptographic birth certificate it just made. No hardware, no install, nothing uploaded.

See it: /lab

How do I ask for a feature?#

Say it in one sentence on the Community Ideas board. It becomes a public suggestion anyone can back with a thumbs-up, and the most-backed ones are what get built next — that is genuinely how the roadmap is ordered, not a slogan. You need no technical vocabulary and no idea how any of this works: “I wish it would text me when it sees motion” is a complete, useful request. A reply arrives straight away telling you what happens next.

See it: /ideas

Why do I need GitHub to suggest something?#

Because it puts your idea in the same place as the work, which buys you things a private suggestion form cannot. You can watch the code that answers your idea get written and reviewed, and see which release it ships in. Your words are public, and the everyday moves leave a trail: we can moderate our own tracker like any owner can, but an edited comment keeps a visible edit history and a closed idea shows who closed it and when, so declining one is done out loud with a reason you can read. Deletion is the honest exception — an owner can remove a thread outright and nothing is left behind, so on that one point you have our word rather than a guarantee. Votes are reactions from real accounts, so the counts are checkable rather than something you take on trust. And we never ask for your email, because we keep no list to put it on. The cost is real though: one free account, about thirty seconds, and an unfamiliar page the first time — and if that is too much, the feedback desk takes plain email instead.

See it: /ideas

Which Canary should I get or build first?#

Canary WAP for a general first device; Canary Vision if you want a camera with on-device detection; Canary Sense for presence and breathing with no camera at all; Canary Sentinel for a doorway that is hard to sneak past; Canary Display for a screen the household glances at.

See it: /compare