Skip to content
Déjà · incident-evidence custody for regulated engineering

Production breaks. Keep the evidence.

When production breaks, Déjà writes down — at the time, and signed — which change it can tie the failure to, and which it can't. Your auditor checks that record on their own machine, trusting neither you nor us.

Start the free 14-day trial Watch one incident, end to end (1:58)

Fully featured · no card

Today: field-change attribution in Python, TypeScript and JavaScript, plus Protobuf and Avro schemas · data held in the US only · no completed attestation yet

For organisations whose change and incident controls are examined from outside — SOC 2, NYDFS Part 500, ISO 27001, HIPAA — and for the internal audit teams who test them first.

Sample data, drawn as the Vault page draws it. Most organisations get no resolution receipt (R2) yet.

Sealed at the moment, not reconstructed later.

Works with
  • GitHub
  • Sentry
  • Datadog
  • Splunk On-Call
  • PagerDuty
  • ServiceNow
  • Slack

Also Azure DevOps, Prometheus Alertmanager, Grafana Alerting, AWS CloudWatch, Jira Service Management, Vanta, Drata and Okta. 49 tools connect today, each on the wall with the line that says what it does now. See every integration

Watch one incident, end to end
Illustration: a sample vault with invented data, following one incident from the alert to the auditor's check, narrated by a synthetic voice. The Vault page is drawn as the app draws it; the rest is explanatory. Most organisations get no resolution receipt (R2) yet.
Transcript of the narration

  1. The vault

    1. This is Déjà, shown with a sample company. First, the vault tells you whether its record is intact.
    2. Owed is what it needs from you. Here, two SOC 2 controls have no evidence this quarter.
    3. Every receipt is counted by type. Most record no attribution, and they're kept too.
    4. Let's follow one incident, from the alert.

  2. One incident

    1. At 3:07 in the morning, Sentry reports an error in checkout. Déjà checks that it's genuine, and ties it to one vault and one zone.
    2. Every change in the thirty-day window is scored against the field that broke, against published thresholds.
    3. Two seconds after the alert, the receipt is signed, with the cause, its score and its margin over the runner-up. Cross-service attribution like this is still in validation.
    4. Twelve minutes later, it's resolved. A resolution receipt needs every gate to have a reading, so most organisations don't get one yet.

  3. No answer

    1. Many incidents end without a named cause. This alert named no field, so there was nothing to score.
    2. This one was scored, and nothing came close. The receipt signs what was examined and the top score; the reason is kept beside it.

  4. A person decides

    1. A low-confidence match waits for a person. It's a record of uncertainty, not a finding.
    2. Confirming or rejecting it becomes a governance receipt, with who decided.

  5. The audit

    1. At audit time, your audit firm gets a token link to the quarter, and downloads the signed report.
    2. Then it checks the report offline, on its own machine, with the command-line verifier and a published key. No Déjà account is needed.

  6. Close

    1. Every incident from the sources Déjà scores, accounted for: sealed when it happened, and checkable without us. Production breaks. Keep the evidence.
What you can hold us to

Eight facts, each with the page that proves it.

Evidence mappings

Production evidence for the controls you already review.

Map incident and change evidence to selected controls in your audit programme.

Selected controls only. The evidence available depends on receipt type and connected sources, and a mapping is not a certification.

What Déjà is

The facts nobody owns are the ones between two systems.

Every vendor already proves what happened inside itself. Sentry proves the exception. GitHub proves the merge. The relationship between the two is owned by nobody — which is exactly the relationship an examiner asks about.

Not a GRC platform, not a control, not an opinion. Déjà supplies the record. It doesn't discharge an obligation, and it doesn't tell you what to conclude.

Illustration: one sample incident told twice, reconstructed afterwards and sealed as it happened, narrated by a synthetic voice. The people, systems and counts are invented.
Transcript of the narration

  1. The question

    1. Nine months after an outage, an examiner asks two questions: what happened, and how do you know?
    2. Every firm can answer the first. Proving the answer is harder.

  2. Five systems

    1. That night's facts sit in five systems. The pager kept a timestamp. The chat kept a guess. The deploy log kept a revert.
    2. Every vendor documents itself. None records the link between one system and the next, and that's where the answer lives.

  3. The reconstruction

    1. So the answer is reconstructed: a postmortem, written days later by the people involved, from memory and scrollback.
    2. It's usually accurate. It's never independent. And by the time anyone asks, two of the six have left, and the logs expired after thirty days.

  4. Sealed as it happened

    1. Déjà keeps the record while it happens. When Sentry reports the error, Déjà scores the changes in the window and seals a signed receipt two seconds later.
    2. When there's no supported answer, that's sealed too. A record that holds only findings can't say what wasn't found.

  5. Checkable by anyone

    1. Months later, your auditor checks it on their own machine, offline, without an account. Nobody who was there that night is required, and the check doesn't call Déjà at all.

  6. What stays yours

    1. Your postmortem still gets written, now citing a sealed record instead of memory. Déjà doesn't find every cause or file for you: the conclusions stay yours.

  7. Close

    1. Keep the record as it happens. Include what wasn't found. Make it checkable by someone who trusts nobody.
Layer oneGovernance — connector grants, key rotations, zone locks, auditor invitations. Independent of any incident.RG · always on
Layer twoOccurrence — a signal from Sentry, Datadog, Splunk On-Call and Alertmanager · Grafana is sealed when it is scored, as proof it arrived and was examined, even when nothing is attributed. A Datadog alert ends only in a no-attribution record (R1-N). Alerts from the other connected sources get no receipt yet, and R0 is issued only for incidents posted to Déjà's own endpoint.R0 · R1-N
Layer threeCausation — a producer-side field change linked to the downstream error it broke. Narrow by design, and the only layer that names a cause.R1 · R1-L · R2

Layers one and two run continuously and don't depend on any incident attributing. Layer three is the narrowest of the three and the only one people usually hear about, which is why it's stated last here rather than first.

How it works

Connect a signal source and a change source. Then the record keeps itself.

Nothing to install, and no change to how anyone works. Your observability and paging stay exactly where they are — they're Déjà's inputs, not its replacement.

  1. you
    Connect your sources
  2. you
    Sign the genesis receipt
  3. Déjà · unattended
    Signals sealed, changes examined, receipts chained
  4. exceptions
    Gaps and failures sealed too
  5. your auditor
    Verifies offline, without an account

  1. Connect your sources

    An error tracker for the signal, a source-control provider for the change. Déjà writes nothing back to Sentry or GitHub; it reads events and each pull request's metadata and diff as it's opened, updated and merged, secrets scrubbed, never a file outside that diff. Besides delivering receipts where you point them, it writes back in two places: an event into Honeycomb when an incident is resolved, and ServiceNow incidents if you turn on incident sync.

  2. Sign the genesis receipt

    Written once at setup, with your organisation and the time inside the signature. Every later governance receipt chains behind it, and the ledger is append-only — enforced in the database, not by convention.

  3. Signals are queued for scoring

    Each new signal is queued for scoring as it arrives. Signals from Sentry, Datadog, Splunk On-Call and Alertmanager · Grafana are sealed when Déjà scores them: each one that reaches scoring ends in a signed receipt, whether or not a cause is found. A Datadog alert ends only in a no-attribution record (R1-N). That is what makes the ledger a record of the period rather than a record of the interesting parts of it. Alerts from New Relic, Dynatrace, Honeycomb, AppDynamics and Splunk (alerts) are received but not scored yet, so they get no receipt, and whether PagerDuty, AWS CloudWatch, Azure Monitor, Google Cloud Monitoring, incident.io, Rootly and FireHydrant incidents reach scoring is still being checked.

  4. Changes are examined and scored

    Producer-side changes in the lookback window are enumerated and scored against the affected field the signal carried — eight weighted signals, published thresholds. Above the threshold the receipt carries the score and the candidate. Below it, the receipt says so.

  5. The exceptions are sealed as well

    Nothing matched, confidence below threshold, the fix didn't hold, the same field broke again — each has its own receipt type. A ledger that only records the cases that worked is a brochure.

  6. Your auditor verifies without us

    Export the bundle; they run the open CLI on their own machine against a published key. No account, no call to our API, no request we could refuse or fail to answer.
A method reviewers can inspect

Deterministic scoring. Explicit uncertainty.

For supported field-change patterns, Déjà applies defined scoring rules and published thresholds. The record keeps the examination outcome, including a candidate that needs review or a cause that stays unresolved.

Repeatable scoring.

Identical captured inputs, graph state, configuration and scoring version produce the same scoring outcome.

Inspectable criteria.

Published factors, thresholds and a recorded scoring version let a reviewer examine the basis for a finding.

Uncertainty retained.

Low confidence and no attribution stay visible outcomes. A score is a weighting, not a guarantee of cause.

Understand the method and its limits

No-attribution receipt · unscorable signal

R1N-0e51b7R1-Nledger-sync

Connection pool exhausted · 03:11:02

SIGNAL
No affected field present in the payload. error_class: other
GATE
Not entered — attribution requires an affected field to score against.
WINDOW
30 days, 9 changes recorded across 2 producers.
CANDIDATES
#318 #319 #322 #327 #331 #334 #340 #341 #344
REASON
Outside attribution scope. Recorded and listed, not scored.
sha 4d1e…90bcchain +103:11:06
The receipt nobody else writes

The ledger records the outcome, not only the finding.

A no-attribution receipt comes in two kinds, and it says which. When scoring runs, the receipt records what was examined and why nothing cleared the threshold. When the signal isn't scorable — no affected field to score against — it records the eligibility condition that failed and why scoring was never entered, and still lists the changes in the window.

A tool that records only its successes has told you nothing about the period it covers. This is the part an examiner is actually testing for.

R1

Attribution.

A supported field-change finding, within the engine's eligibility conditions, at a score of 0.80 or above.

R1-L

Low confidence.

A candidate for human review, its confidence on the record. Confirming one adds a signed governance record beside it.

R1-N

No attribution.

The examination produced no attribution, or the signal could not enter scoring. The receipt says which.

Attribution coverage is narrower than custody, and receipt availability varies by source.

Scope · attribution

Three patterns. And everything else.

The narrow part of Déjà is stated plainly here rather than discovered in month two. Layers one and two cover far more; layer three covers this.

Pattern one

A field was removed

A producer stops emitting total_cents. A consumer reading it raises KeyError. The signal names the field; the change removed it.

Pattern two

A field was renamed

currency_code becomes currency. Same shape as removal from the consumer's side, and the same evidence on the producer's.

Pattern three

A field changed type

A string becomes an object. The consumer raises TypeError or AttributeError on a field the change touched.

  • else

    Everything else gets a receipt, not an attribution

    Timeouts, memory, capacity, auth failures, rate limits, logic bugs, performance regressions, infrastructure. These are sealed as no-attribution receipts carrying the processing outcome and, when scoring ran, what was examined. They are evidence of the period; they are not a claim about cause.
  • gate

    Four conditions have to hold at once

    The signal arrives from a connected source; the signal carries the affected field; the language has a real parser; and a matching change exists in the lookback window on a change with a resolved edge. Fail any one and the result is a no-attribution receipt.
  • yours

    The proportion is yours to establish

    What share of your incidents are cross-team field breaks is a number about your architecture, not about Déjà, and we won't invent it for you. It's also the wrong number on its own: the cross-team schema break is the case where nobody knows the cause, because it lives in another team's repository.
Verification

You don't have to trust Déjà to trust Déjà.

A vendor's own attestation is not independently verifiable evidence by itself, and that constraint applies to us as hard as to anyone. So every attribution receipt is signed — with Déjà's Ed25519 key, or on Enterprise and Sovereign with your vault's own KMS key — and verifies against a published public key with open tooling on a machine we don't control, with no account and no call to our API.

The ledger is append-only, and that constraint is enforced in the database rather than by application policy — an issued receipt cannot be updated through the product, and your auditor can read the constraint definition themselves. What each signature independently establishes is narrower and more durable: that this receipt's content is the content that was signed by the holder of the published key.

The bundle states, per receipt, whether it is signed or content-hashed, rather than letting the stronger word cover both.

Get the verifier

Offline verification · your auditor's machine

Pack · Q3 2026 SOC 2 audit, of 52 in the vault's record
36 receipts
Manifest signature · ed25519
valid
Signature · ed25519 against published key
36 / 36 valid
Sequence · files 1–36
no gaps
Canonical form · recomputes to the signed bytes
match
Déjà API calls required
0

$ dsr-verifier-cli verify-bundle bundle.zip --key deja-managed-v1.pub

Contributor origin is context

Human, agent, or both. The incident still needs a record.

The custody purpose stays the same as the way software is written changes. The record should support a review whichever way the change was made.

Agent involvement and incident cause are separate findings. Each needs its own evidence. Agent identity, task and approval context are a proposed extension, not something Déjà records today.

Compare

Everything here keeps a record. None of them keeps this one.

These systems each preserve what happened inside themselves, and they do it well. What none of them produces is a single artefact spanning several of them, carrying its own examination outcome, that a third party can check without asking any of us anything.

How Déjà compares with observability and paging, probabilistic RCA, and GRC platforms
CapabilityObservability & pagingProbabilistic RCAGRC platformDéjà
Primary artefactTelemetry and events, inside its own environmentA ranked inference over that telemetryAn entry in a control registerA cross-system receipt linking what several systems reported
Captured as it happensYes, within the systemYes, over the same dataNo — entered afterwards by a personYes for scored sources — sealed into an append-only chain when scored
Explicit no-attribution outcomeNot generally what it is forUsually surfaces as a lower-ranked candidateA blank fieldA receipt stating what was examined, or which eligibility condition failed
Deterministic attributionCorrelation and change tracking, not a deterministic claimProbabilistic and ranked by designWhatever was typedThree field-change patterns, scored against published thresholds
Independent verificationGenerally not its evidence modelGenerally not its evidence modelSelf-asserted by the customerOffline signature check against a published key, for signed receipt types
Evidence formatVendor-specificVendor-specificPlatform-specificDSR/1.0 receipts and bundles — open spec
If the vendor disappearsExport, typically unattestedThe inference goes with itExport, still self-assertedSigned receipts still verify against the published key

Keep all of them. Observability and paging are Déjà's inputs; a GRC platform is where the evidence lands. Déjà is the substrate underneath, not a replacement for any of the three.

Our own status

What we can show you today — and what we can't yet.

Déjà is early. Pretending otherwise would waste the first hour of your security review, so here is the position in writing. If a connector matters to you and it's in the second list, say so before the trial rather than after.

  • Sentry

    Alerts scored, each ending in a sealed receipt

    A real exception in a production organisation produced a sealed receipt through the full signal path. That is a narrower statement than cross-system attribution in production, which we are not yet claiming.
  • GitHub

    Merged changes read

    Merge events write producer-side edges. Consumer-side resolution across services is built and being validated; until it lands, cross-service attribution isn't something we'll claim.
  • Datadog

    Connected · cannot name a field

    Its alerts are scored, but Déjà's intake keeps no title, message or stack trace — Error Tracking included — so a Datadog alert cannot name the field, and its receipt records that none was extracted. Our endpoint accepts a delivery that carries the connection's secret in a header, which a Datadog webhook can be set to send.
  • Slack · PagerDuty

    Connected

    They deliver and they page. A PagerDuty incident that reaches scoring is scored on its title, from which a field can be read, but whether PagerDuty's current webhook format reaches scoring is still being checked, so no PagerDuty receipt is claimed.
  • ServiceNow · Jira

    Beta, untested by us

    In the codebase, not yet validated end to end. Listed here rather than on an integrations grid with a checkmark next to it.
  • GitLab

    Connects, not read yet

    Déjà registers its own webhooks on the projects you choose, but merged merge requests are not read yet, so nothing the GitLab connection receives becomes a candidate for attribution.
  • Languages

    Python proven on real payloads

    The Python parser works on real payloads. JavaScript and TypeScript are supported but not yet run by us on a real incident, and nor are Protobuf and Avro schemas.
  • Certifications

    In progress, not complete

    No SOC 2 report is complete. Type I is in preparation. [Awaiting owner: SOC 2 Type I target date, or none] We'd rather lose a deal than imply an attestation we don't hold.

Everything in the second list either gets proven or comes off this page. Ask for the current version of it before the demo — it's the fastest way to find out whether this is worth either of our time.

Pricing

Priced by scope. Never billed by volume.

A bad quarter costing more than a quiet one is an incentive pointed the wrong way. Tiers are priced on vaults, retention, isolation and support — never on how many receipts your systems produced.

Charter$30Kper year · locked for life
  • For design partners shaping the roadmap
  • Direct line to the team, DSR working-group seat
  • Up to 15 seats · one vault
  • Two-year receipt retention
  • Limited seats
Apply for Charter
Standard · recommended$10K$10,000 a month, or $120,000 a year
  • One vault, full receipt lifecycle, framework mapping
  • 30 admin seats · unlimited auditor invitations
  • Five-year retention · SSO/SAML · governance receipts
  • Offline verification and exportable evidence bundles
  • 14-day trial, fully featured, no card
Start the free 14-day trial
Enterprise$300K+per year · custom contract
  • Multi-vault, your own AWS KMS key, custom retention
  • Support response times: [Awaiting owner: support response times]
  • Procurement-grade review
  • Sovereign deployments from $1M a year
Book a call

No overage on any tier. Standard includes an allowance of 200 attribution receipts a month and Charter 42; nearing it sends your Primary Owner a warning and opens a scope conversation, never a bill, and no-attribution and low-confidence receipts never count. A quarter with four hundred incidents costs what a quarter with four costs. The 14-day trial starts when you sign up. It needs a work email address: a vault is identified by an organisation, so personal domains are declined at signup.

Reasonable objections

Questions we would ask too.

We already have Datadog and PagerDuty.
Keep them — they're inputs. They observe and they page; neither produces a sealed, offline-verifiable record of what arrived and what changed. Different layer, not a replacement, and Déjà is worth nothing without them.
Why should we trust your attribution?
You shouldn't have to. Scoring is deterministic and published, the score travels on the receipt, and where confidence is below threshold or nothing matched the receipt states that instead. A system that records its uncertainty explicitly is the only kind worth checking.
What if it attributes the wrong change?
Then the receipt carries the score and the margin, and an engineer can see the second candidate was 0.004 behind. That's why the number is on the artefact rather than behind it. Where two candidates sit inside the tie band, the receipt is sealed as low confidence rather than as a finding.
What happens to our evidence if you shut down?
Signed receipts remain signature-verifiable offline against a published key, and an audit engagement's period report remains independently integrity-checkable. None of that depends on us being reachable — or existing. The ledger export does not hold everything: it takes up to 2,500 receipts at a time, leaves out RV and RE, and lists an R0, R2-F or R2-R issued before those types were signed with its content hash rather than as a signed file.
Our auditors won't accept this.
They don't have to accept it — they verify it, on their own machine, without an account. Bring your audit firm into the trial; that's what the trial is for, and their objections are more useful to us than our answers are to them.
Does this satisfy Part 500, HIPAA or DORA?
No, and be wary of anyone who says it does. Déjà supplies the record. Filing, determination, classification and certification remain with your named accountable individuals, and no vendor can take that on for you.
Before you go further

Four things that may rule us out.

  • ResidencyData is stored in US West (N. California) · us_west_1 only. Storage in other regions is not offered yet.Procurement
  • LanguagesAttribution parses Python, TypeScript and JavaScript, plus Protobuf and Avro schemas. A change in any other language is recorded as unsupported and cannot be named as a cause.Integrations
  • ResolutionMost organisations get no resolution receipt (R2) yet: Déjà issues one only for an incident with an attribution receipt (R1), once 48 hours have passed since a user marked it resolved, and only if every gate then has a reading, which takes connected source control, Sentry, and Datadog (with a metrics read key) or New Relic. So SOC 2 CC7.4 and CC7.5 usually get no evidence from Déjà.For auditors
  • AttestationDéjà holds no completed SOC 2 report or other attestation yet.Security & trust
Read further

Each of these has a page of its own.

Has an examiner ever asked for a record you couldn't produce?

Fourteen days to decide. Bring your auditor.

Start the free 14-day trial Read the status page first