# Is Canary Technologies legit? Yes, and that's the easy half of the question > The question I'm asked most about Canary is whether it's a real company. It is. The question a European hotelier should be asking is a different one, and the answer to that is what stopped me signing. **Source:** https://6hoteliers.com/insights/is-canary-technologies-legit-preview/ **Author:** marc (Six Hoteliers) **Published:** 2026-09-06 **Licence:** CC BY-SA 4.0 — attribution required ## Body "Is Canary Technologies legit?" I get that question more often than any other about any tool we've reviewed, and I understand why. An American company most European hoteliers had never heard of turns up with a polished check-in product, a sales team, and no price anywhere on the website. Reasonable people want to know whether it's real before they hand over a guest's passport. So, plainly: yes. Canary Technologies is a real, established company with a product that does what it says. Nobody signing up is being scammed. If that's all you came to check, you have your answer. I'd rather you kept reading, because "is it legit" is the easy half of the question. The half that matters for a hotel in Vienna or Lyon is harder, and it gets asked far less. ## What legit means here The company facts are not in dispute. Canary was founded in 2016 and is headquartered in San Francisco. It has raised around $175 million across its funding rounds, most recently an $80 million Series D in June 2025 that valued the business at roughly $600 million. It serves more than 20,000 hoteliers in over 80 countries. In February 2026 it bought OpenKey and added mobile keys to the platform. In November 2025 Bespoke Hotels in the UK adopted it across their group. The product is real too. I watched guests at a property go through the contactless check-in without hesitating once, which is rarer than vendors would have you believe. Colleagues of mine in the United States run it and rate it. I gave it a 5 out of 10 in [my full review](/guest-communication/canary-review/), and none of the points I took off were for legitimacy. What legit does not mean is worth spelling out, because the word gets stretched. It doesn't mean the pricing is transparent. Canary has never published a price, and even the rough entry figure of about $99 a month that used to sit on their pricing page has gone. It doesn't mean every module suits a European property; digital tipping is a feature built for a culture that isn't ours. It doesn't mean the product is flawless. The ID photo capture during check-in produces blurry images often enough that it's a common complaint, and the AI messaging tone reads as robotic. Those are ordinary product criticisms. They're in the review. They have nothing to do with whether the company is real. ## Is it safe? Two questions hiding in one word When a hotelier asks me whether Canary is safe, they usually mean one of two things, and the answers are opposite. If you mean is the software secure, is the company careful, will your guest records leak out of a badly built app: I have no reason to think so. Canary handles passport scans and payment details at scale for more than 20,000 properties. The engineering is solid. Nobody in my network has described anything I'd call a security incident. On that reading, yes, it's safe. If you mean is it safe for a European hotel to put its guests' identity documents there, my answer is no. Not because anyone at Canary is careless, but because the data sits under American jurisdiction. Under the CLOUD Act a United States authority can compel a US company to hand over data it holds, regardless of which country the server happens to be in. A company can be scrupulous, well run and honest, and still be legally obliged to hand over your guests' passport scans. Your obligations under GDPR do not pause while that happens. That's the distinction the security page never covers. Safety for a European hotelier isn't only about protecting data from criminals. It's about who else can lawfully reach it, and whether you can answer for that if a regulator asks. I make technology decisions for three hotels in Austria, and every one of them rolls out across all three. Every subscription is a vote for the ecosystem you want to exist in five years. I'm not voting for that one. ## The UK entity is a foothold, not a firewall Canary incorporated a British subsidiary, Canary Technologies Ltd, in Croydon in February 2024. I've had this raised with me as though it settles the jurisdiction question. It doesn't, for two reasons. The first is that the United Kingdom is not in the European Union. Post-Brexit, a UK company is a third-country company from the point of view of a hotel in Munich or Barcelona. The second is that a subsidiary doesn't remove the parent's obligations under American law. The records are still held by an American group. What the Croydon entity does is give Canary a commercial base for selling into Britain, and Bespoke Hotels signing up shows that's working. It changes nothing for a property inside the EU. I asked Canary directly about EU data residency. The answer was that they were evaluating options. I've heard that phrase from American vendors before. It means it isn't a priority yet. ## The question nobody asks: which AI reads the messages went through the sub-processor lists and privacy policies of every guest communication tool we've reviewed, and [her finding on Canary](/insights/ai-providers-privacy-problem/) is worth repeating. Canary does not disclose its AI provider. Not in the privacy policy, not in the trust centre, not in the marketing. For a company that runs guest conversations and identity documents through AI features, that silence is itself a finding. Most of the category routes through OpenAI in San Francisco. Canary won't say. When you're being asked to trust a vendor with passport scans, "we'd rather not tell you" is not a neutral answer. ## What I'd check before signing, if you're going to Some readers will sign regardless, and for some of them it's the right call. If that's you, get these five things in writing before the contract, not on a call. 1. **Data residency, in the DPA.** Not "we host in Europe" from a salesperson. The region, the entity, and what happens to the identity documents specifically. 2. **The full sub-processor list, including the AI provider.** If they won't name it, you've learned something. 3. **Which legal entity you're contracting with**, and whether that entity is the one holding the records. A Croydon contract with a San Francisco database is the American arrangement with a British letterhead. 4. **Exit terms.** How you get the ID scans back, how deletion is confirmed, and how long it takes. 5. **A price for the modules you'll actually switch on.** The platform is sold piece by piece, the cost climbs as you adopt more of it, and it climbs again across a group. Sophie's [pricing page](/pricing/canary-pricing/) covers what is and isn't known. ## Who should sign anyway American chains, obviously. The product was built for them, it's priced in their currency, and the jurisdiction question doesn't arise. A British property is a closer call than a European one, and it's not my call to make. The UK sits outside the EU and a UK hotelier's calculus is their own. A large European group with a legal team that can price the exposure and decide to carry it: perhaps, with eyes open. I'd still ask why, when the European tools in this category keep guest data inside EU jurisdiction and, on messaging specifically, do that job better than Canary does, because messaging is their entire product rather than one module in a suite. The [alternatives](/alternatives/canary-alternatives/) we've paid for and run ourselves are listed there. One warning on that list: Akia is not a jurisdiction fix. It's a San Francisco company too, and switching from one to the other solves nothing. A small European independent: no. There is no version of the maths where the exposure is worth it for a 40-room hotel. ## What I did I scored it 5 and did not roll it out. The check-in is good. The company is real. Neither of those was ever the problem. The problem is where your guests' passports end up once that polished check-in has collected them, and that's the question I'd want any hotelier searching "is Canary Technologies legit" to walk away asking instead.