L2 canary (dated, public)

Note

Service uptime lives at status.cloakapi.io. This page is the privacy canary: a dated, customer-readable green/red for whether unique synthetic PII left a client and then appeared in plaintext on our servers.

Published 2026-08-23. Machine-readable twin: /canary/latest.json and /canary/2026-08-23.json.

What the canary is

A synthetic CloakAPI account (not a paying customer) sends a prompt that contains globally unique PII-shaped values (one email, one phone) generated for that run. The client tokenises before the bytes leave the device (pretokenised path: X-Cloak-Pretokenised: 1 + client MAC + engine identity headers). After the call returns, we search live gateway storage for the raw canary strings.

Outcome	Meaning
Green	Call succeeded (HTTP 200) and raw canary count in gateway storage is 0.
Red	Raw canary found in storage, or the call did not complete as pretokensied.

This is the public half of the L2 discipline (canary-in-the-wire). It does not replace a TLS-terminating dump of every byte leaving a browser profile; that dump is an internal control. This page answers the customer question: how do I know it still holds today?

Latest run

The result lives in /canary/latest.json; the fields below name where to read it.

• Run at (UTC): see JSON run_at
• Verdict: see JSON verdict (green / red)
• Synthetic user_id: see JSON user_id (never a paying customer)
• Raw canary hits in gateway storage: see JSON raw_hits
• Receipt jti: see JSON jti

A type moves from this page only when the measurement changes, not when the copy does.

What this page is not

• Not an uptime probe.
• Not a precision/recall claim (see Detection coverage and What the engine does not detect).
• Not a promise that every client stack (service worker, sendBeacon, WebSocket) was dumped this run — those channels are named remainders of the internal L2 dump.

Change control

A new dated JSON is written when the canary runs. This page does not inline the result; read /canary/latest.json for the latest run.