Is Canary Technologies a scam?

No. It is a well-funded, widely used company with a working product and large reference customers, including a UK hotel group that adopted it across their properties in November 2025. The criticisms I have of it are about jurisdiction, pricing transparency and fit for European hotels, not legitimacy.

Is Canary Technologies safe?

As software, yes. It handles passport scans and payments at scale and nobody in my network has reported a security incident. As a place for a European hotel to hold guests' identity documents, no, because the data sits under American jurisdiction and can be compelled under the CLOUD Act regardless of where the server is.

Is Canary Technologies safe for hotels in the EU?

Not in the sense a European hotelier needs. The company is scrupulous, but a US company can be legally obliged to hand over data it holds, and your GDPR obligations do not pause for that. The UK subsidiary in Croydon does not change this for a hotel inside the EU.

Where is Canary Technologies based?

San Francisco, California. It incorporated a British subsidiary, Canary Technologies Ltd, in Croydon in February 2024, which is a commercial base for the UK market rather than an EU entity. When I asked about EU data residency, Canary said it was evaluating options.

Does Canary Technologies store guest data in Europe?

Not that they will confirm. Canary told me they were evaluating EU hosting options, which in my experience of American vendors means it is not a priority yet. Canary also does not disclose which AI provider processes guest conversations. Get any residency commitment in writing in the data processing agreement, not on a sales call.

← Insights

Is Canary Technologies legit? Yes, and that's the easy half of the question

marc 6 September 2026

“Is Canary Technologies legit?” I get that question more often than any other about any tool we’ve reviewed, and I understand why. An American company most European hoteliers had never heard of turns up with a polished check-in product, a sales team, and no price anywhere on the website. Reasonable people want to know whether it’s real before they hand over a guest’s passport.

So, plainly: yes. Canary Technologies is a real, established company with a product that does what it says. Nobody signing up is being scammed. If that’s all you came to check, you have your answer.

I’d rather you kept reading, because “is it legit” is the easy half of the question. The half that matters for a hotel in Vienna or Lyon is harder, and it gets asked far less.

What legit means here

The company facts are not in dispute. Canary was founded in 2016 and is headquartered in San Francisco. It has raised around $175 million across its funding rounds, most recently an $80 million Series D in June 2025 that valued the business at roughly $600 million. It serves more than 20,000 hoteliers in over 80 countries. In February 2026 it bought OpenKey and added mobile keys to the platform. In November 2025 Bespoke Hotels in the UK adopted it across their group.

The product is real too. I watched guests at a property go through the contactless check-in without hesitating once, which is rarer than vendors would have you believe. Colleagues of mine in the United States run it and rate it. I gave it a 5 out of 10 in my full review, and none of the points I took off were for legitimacy.

What legit does not mean is worth spelling out, because the word gets stretched. It doesn’t mean the pricing is transparent. Canary has never published a price, and even the rough entry figure of about $99 a month that used to sit on their pricing page has gone. It doesn’t mean every module suits a European property; digital tipping is a feature built for a culture that isn’t ours. It doesn’t mean the product is flawless. The ID photo capture during check-in produces blurry images often enough that it’s a common complaint, and the AI messaging tone reads as robotic. Those are ordinary product criticisms. They’re in the review. They have nothing to do with whether the company is real.

Is it safe? Two questions hiding in one word

When a hotelier asks me whether Canary is safe, they usually mean one of two things, and the answers are opposite.

If you mean is the software secure, is the company careful, will your guest records leak out of a badly built app: I have no reason to think so. Canary handles passport scans and payment details at scale for more than 20,000 properties. The engineering is solid. Nobody in my network has described anything I’d call a security incident. On that reading, yes, it’s safe.

If you mean is it safe for a European hotel to put its guests’ identity documents there, my answer is no. Not because anyone at Canary is careless, but because the data sits under American jurisdiction. Under the CLOUD Act a United States authority can compel a US company to hand over data it holds, regardless of which country the server happens to be in. A company can be scrupulous, well run and honest, and still be legally obliged to hand over your guests’ passport scans. Your obligations under GDPR do not pause while that happens.

That’s the distinction the security page never covers. Safety for a European hotelier isn’t only about protecting data from criminals. It’s about who else can lawfully reach it, and whether you can answer for that if a regulator asks. I make technology decisions for three hotels in Austria, and every one of them rolls out across all three. Every subscription is a vote for the ecosystem you want to exist in five years. I’m not voting for that one.

The UK entity is a foothold, not a firewall

Canary incorporated a British subsidiary, Canary Technologies Ltd, in Croydon in February 2024. I’ve had this raised with me as though it settles the jurisdiction question. It doesn’t, for two reasons.

The first is that the United Kingdom is not in the European Union. Post-Brexit, a UK company is a third-country company from the point of view of a hotel in Munich or Barcelona. The second is that a subsidiary doesn’t remove the parent’s obligations under American law. The records are still held by an American group. What the Croydon entity does is give Canary a commercial base for selling into Britain, and Bespoke Hotels signing up shows that’s working. It changes nothing for a property inside the EU.

I asked Canary directly about EU data residency. The answer was that they were evaluating options. I’ve heard that phrase from American vendors before. It means it isn’t a priority yet.

The question nobody asks: which AI reads the messages

Anna went through the sub-processor lists and privacy policies of every guest communication tool we’ve reviewed, and her finding on Canary is worth repeating. Canary does not disclose its AI provider. Not in the privacy policy, not in the trust centre, not in the marketing. For a company that runs guest conversations and identity documents through AI features, that silence is itself a finding. Most of the category routes through OpenAI in San Francisco. Canary won’t say. When you’re being asked to trust a vendor with passport scans, “we’d rather not tell you” is not a neutral answer.

What I’d check before signing, if you’re going to

Some readers will sign regardless, and for some of them it’s the right call. If that’s you, get these five things in writing before the contract, not on a call.

Data residency, in the DPA. Not “we host in Europe” from a salesperson. The region, the entity, and what happens to the identity documents specifically.
The full sub-processor list, including the AI provider. If they won’t name it, you’ve learned something.
Which legal entity you’re contracting with, and whether that entity is the one holding the records. A Croydon contract with a San Francisco database is the American arrangement with a British letterhead.
Exit terms. How you get the ID scans back, how deletion is confirmed, and how long it takes.
A price for the modules you’ll actually switch on. The platform is sold piece by piece, the cost climbs as you adopt more of it, and it climbs again across a group. Sophie’s pricing page covers what is and isn’t known.

Who should sign anyway

American chains, obviously. The product was built for them, it’s priced in their currency, and the jurisdiction question doesn’t arise.

A British property is a closer call than a European one, and it’s not my call to make. The UK sits outside the EU and a UK hotelier’s calculus is their own.

A large European group with a legal team that can price the exposure and decide to carry it: perhaps, with eyes open. I’d still ask why, when the European tools in this category keep guest data inside EU jurisdiction and, on messaging specifically, do that job better than Canary does, because messaging is their entire product rather than one module in a suite. The alternatives we’ve paid for and run ourselves are listed there. One warning on that list: Akia is not a jurisdiction fix. It’s a San Francisco company too, and switching from one to the other solves nothing.

A small European independent: no. There is no version of the maths where the exposure is worth it for a 40-room hotel.

What I did

I scored it 5 and did not roll it out. The check-in is good. The company is real. Neither of those was ever the problem. The problem is where your guests’ passports end up once that polished check-in has collected them, and that’s the question I’d want any hotelier searching “is Canary Technologies legit” to walk away asking instead.

Questions people actually search

Is Canary Technologies legit?: Yes. Canary Technologies is an established San Francisco company founded in 2016, with around $175 million raised, an $80 million Series D in June 2025, and more than 20,000 hoteliers using the platform across 80-plus countries. The product does what it claims. Nobody signing up is being scammed.
Is Canary Technologies a scam?: No. It is a well-funded, widely used company with a working product and large reference customers, including a UK hotel group that adopted it across their properties in November 2025. The criticisms I have of it are about jurisdiction, pricing transparency and fit for European hotels, not legitimacy.
Is Canary Technologies safe?: As software, yes. It handles passport scans and payments at scale and nobody in my network has reported a security incident. As a place for a European hotel to hold guests' identity documents, no, because the data sits under American jurisdiction and can be compelled under the CLOUD Act regardless of where the server is.
Is Canary Technologies safe for hotels in the EU?: Not in the sense a European hotelier needs. The company is scrupulous, but a US company can be legally obliged to hand over data it holds, and your GDPR obligations do not pause for that. The UK subsidiary in Croydon does not change this for a hotel inside the EU.
Where is Canary Technologies based?: San Francisco, California. It incorporated a British subsidiary, Canary Technologies Ltd, in Croydon in February 2024, which is a commercial base for the UK market rather than an EU entity. When I asked about EU data residency, Canary said it was evaluating options.
Does Canary Technologies store guest data in Europe?: Not that they will confirm. Canary told me they were evaluating EU hosting options, which in my experience of American vendors means it is not a priority yet. Canary also does not disclose which AI provider processes guest conversations. Get any residency commitment in writing in the data processing agreement, not on a sales call.