Canopii.dev presents itself as a control plane for enterprise AI agents, offering per-user attribution and security scoring for MCP servers. The website looks professional, the product pitch is coherent, and the technical infrastructure is competent. That's where the good news ends. For a company asking organizations to trust it with agent governance, incident response, and audit trails, the lack of any identifiable business entity is a dealbreaker. There is no about page, no team listing, no company name, no contact information, and no privacy policy or terms of service. A legitimate enterprise SaaS vendor selling security tooling would have all of these in plain sight — it's a basic requirement for procurement and compliance teams. The domain has no web archive history, no reviews, and no social media presence, which means there is no third-party verification of its claims. Canopii.dev reviews are essentially nonexistent because the site is too new and too anonymous to have generated any independent feedback. Is canopii.dev a scam? There isn't enough evidence to call it that definitively, but the signal pattern is exactly what you would see from a site that wants to look credible without actually being verifiable. If you are evaluating this for your team, ask for a direct introduction to the founders and a signed data processing agreement before connecting anything to it. Until the company steps out from behind the marketing copy, treat it as an unknown entity.
In plain English
I wouldn't trust canopii.dev with anything yet. It looks like a security product for enterprises, but the people behind it are completely invisible — no company name, no team, no contact info, and no legal pages. That's the opposite of how legitimate enterprise software operates, and it makes the polished marketing feel hollow.
What you should do now
Don't panic. These steps limit the damage, and the sooner you take them the better.
Don't enter any details
No passwords, card numbers or personal information — even if the site looks professional.
Close the tab
Especially if you got here from an email, text message or social media ad.
Already paid? Call your bank
Contact your bank or card provider right away. They can often stop or reverse a recent payment.
Warn others
Report the site and share this check with anyone who sent you the link.
Where the score comes from
Solid basics: valid SSL, enforced HTTPS, and no blacklist flags. But the site still accepts old, insecure TLS 1.0 and 1.1 connections, which is a real gap for a product that positions itself as an enterprise security tool.
There's no real way to tell who runs this business. No about page, no team, no company name on the website, and WHOIS is effectively hidden for the .dev TLD. For an enterprise SaaS product that asks teams to trust it with agent governance, this is a critical failure.
The site has zero history — no Wayback Machine snapshots at all, no Trustpilot profile, and it doesn't appear in site rankings. It could be brand new, but combined with the anonymity, there's nothing to check against.
No contact info anywhere on the homepage, no about page, no social media links. For a B2B security platform pitching itself to enterprise customers, this level of opacity is a major red flag. Companies selling governance tools should be easy to reach.
No privacy policy or terms of service found. For a SaaS that handles tool calls, user attribution, and agent actions, missing legal pages is a serious compliance gap. Enterprise buyers will expect clear data handling terms before signing up.
Good technical backbone: Cloudflare CDN, fast load times, properly set up email authentication and DNS. But DNSSEC isn't enabled, and the site relies on basic email handling from a domain registrar rather than a dedicated email provider.
What we checked
Think this verdict is wrong?
Site owners can request a fresh scan. Scores update automatically as signals change.