Three things. One witness.
When Steve Jobs introduced the iPhone, he didn't unveil a new gadget. He took three things you already owned and fused them so cleanly you forgot they were ever separate. A Canary does the same trick — with one twist that makes it harder, and better.
What Jobs actually did
The genius wasn't invention. It was fusion — and the tell of a real product is that afterward, nobody counts the parts.
"An iPod, a phone, and an internet communicator. An iPod, a phone… are you getting it? These are not three separate devices. This is one device."— Steve Jobs, Macworld, January 2007
A music player, a phone, a way onto the web. Three familiar objects, welded into a single rectangle of glass. So what are the three familiar objects inside a Canary — the small, local witness that runs on your hardware instead of someone's cloud?
A camera. A notary. A vault.
Each is an object you already understand. Put all three in one calm device and you get something that isn't quite any of them.
A camera
The job Ring and Nest sell you.
A Canary watches a doorway, a lab bench, a driveway. But person-detection runs on the sensor's own chip and only a sentence comes out — package at front door, never a face, a plate, or an identity. On the Vision device, no pixels ever leave the board.
A notary
The job a court stamp or a signature does.
Every event is Ed25519-signed and hash-chained — each record locked to the one before it. Edit the history and the break shows up the moment anyone verifies. Offline. The promise isn't that tampering is impossible; it's that tampering becomes visible.
A vault
The job a bank vault with two keys does.
The rare raw frame that truly matters is sealed so the device can't read it back. Opening it takes a quorum of trustees — no single person, not even us. Breaking the glass is loud, logged, and on the record.
His three were friends. Ours were enemies.
An iPod, a phone, and a browser helped each other — nobody ever said you couldn't have all three. A camera, a notary, and a vault are the opposite. For twenty years the whole industry has told you these three cannot coexist: a camera that sees you destroys your privacy · privacy destroys the evidence · real evidence means handing it to a stranger's cloud. You were told to pick two.
So we stopped making you choose. Not three devices — one. And it isn't even a camera.
It's a witness. Witnessing without watching.
Pick two — unless you don't have to
Every camera on the shelf lands in one of the first three boxes. The Canary is engineered to sit in the fourth.
The surveillance camera. Great evidence, full identity archive. Everyone in frame is catalogued.
The camera you trust to forget. Nice in theory; nothing you could ever verify or stand behind.
A notarized logbook with no eyes. Honest, and blind.
Sees what happened, proves it wasn't altered, and forgets who you are — because the surveillance code was never written.
Privacy here is absence, not a setting. There's no toggle to switch off, because the code that would identify a face, read a plate, or track a body doesn't exist in the build. Not disabled. Not hidden. Missing.
Three ideas do all the work
The same three-word rhythm the engineering already runs on. You don't have to trust us — that's the whole point.
A key that never leaves
Each claim is signed on the device with a key held in hardware. On iPhone and iPad the companion app keeps custody in the Secure Enclave — the private key never travels.
Every record locked to the last
A hash chain ties each event to its predecessor, so a silent edit anywhere breaks the chain everywhere after it. cargo run --bin log_verify proves it — on your machine, no network.
It runs on your hardware
No cloud, no subscription, no phone-home. The picture stays in the room; only a sentence ever leaves. If we disappear, your fleet and its verifier keep working.
Don't take the pitch on faith
The whole product is built so you can check the claim instead of believing it.
SecuraCV is an independent, Apache-2.0, v1 release candidate. Everything above is drawn from the shipping architecture, but features still marked design or pending bench validation are exactly that — in the spirit of the product, this page won't pretend otherwise.