When we pause. Why we pause. What we haven't received.
Last Updated: December 15, 2025
Fix if we can. Pause only if we can't.
Pausing CIRIS services is a last resort, not a first response. If we discover a problem, we fix it. We only pause when the issue is irremediable — when continued operation would cause harm we cannot prevent any other way.
As of December 15, 2025, CIRIS L3C and its operators affirm:
This canary is updated with each release or at minimum every 90 days. If this statement disappears or is not updated, assume the worst.
A cryptographically signed version of this canary is available at /canary. Verify against the public key in the CIRISAgent repository.
These conditions would pause all CIRIS services worldwide:
A discovered vulnerability that cannot be patched immediately and poses active risk to users. We fix vulnerabilities when we can. We pause only when continued operation would expose users to harm we cannot mitigate.
Evidence that CIRIS is causing harm that cannot be stopped through patches, configuration changes, or other remediation. The harm must be ongoing, attributable to CIRIS, and unfixable without full shutdown.
Discovery that CIRIS is fundamentally violating its Covenant principles in a way that cannot be corrected without architectural changes. The system must be taken offline until the violation is addressed at its root.
These conditions may pause services in specific regions while others continue operating:
If US region pauses, EU region continues serving users where possible.
If EU region pauses, US region continues serving users where possible.
Determine if the issue is remediable. Can we fix it? Can we mitigate it? Most issues can be resolved without pausing services.
If fixable, we fix it. Patches, configuration changes, provider switches — whatever resolves the issue while maintaining service.
Only if the issue cannot be remediated do we pause the affected services. Pause is immediate. Status page reflects the outage.
Update the status page. If legally permitted, explain why. If not permitted to explain, the warrant canary will reflect the change.
Work to resolve the underlying issue. Resume service only when the trigger condition is fully addressed. Document the incident publicly when possible.
Your conversations are never stored. CIRISProxy processes requests in real-time and deletes all conversation content immediately after response delivery. We cannot retrieve, replay, or analyze your conversations because we do not retain them.
For debugging and abuse prevention, we collect minimal operational metadata. This data is anonymized by design and cannot be linked to you or your conversations:
| Field | Value | Why Safe |
|---|---|---|
| interaction_id | SHA256 hash (truncated) | Irreversible, no PII |
| request_id | Random UUID | Random, not linked to user |
| retry_count | Integer (0, 1, 2...) | Just a number |
| error_category | "TIMEOUT", "RATE_LIMIT" | Category only, no content |
What we explicitly do NOT collect: User messages, AI responses, email addresses, names, IP addresses, conversation history, or any content that could identify you or reconstruct your interactions.
CIRIS - Ethical AI by Design
© 2025 Eric Moore and CIRIS L3C | AGPL-3.0 License