Sealed at the moment, not reconstructed later.
When production breaks, Déjà writes down — at the time, and signed — which change it can tie the failure to, and which it can't. Your auditor checks that record on their own machine, trusting neither you nor us.
Today: field-change attribution in Python, TypeScript and JavaScript, plus Protobuf and Avro schemas · demonstrated on Sentry and GitHub · data held in the US only · no completed attestation yet
For organisations whose change and incident controls are examined from outside — SOC 2, NYDFS Part 500, ISO 27001, HIPAA — and for the internal audit teams who test them first.
Halden Payments · Vault 1 of 2
Payments platform
Verified 6 Oct 2026, 09:30 UTC: the check found no break in this vault's attribution (R1) and no-attribution (R1-N) receipts or in the entity's governance chain (RG).
Owed
1 itemChecked 09:40 UTCSOC 2 Type II CC7.4 and CC7.5 have no evidence this period
CC7.4 and CC7.5 are evidenced only by resolution receipts (R2), and this vault issued none in this period. The other 5 of the 7 controls Déjà can evidence for SOC 2 Type II have evidence.
Chains, Sentry, Datadog, frameworks, auditor pack and delivery
Chains verified 09:30 UTC · Sentry live, last event 08:46 · Datadog live, last event 09:12 · Q3 2026 SOC 2 audit pack prepared 2 Oct 14:05 UTC · SOC 2 Type II in scope · 2 destinations, none failing
This period
Q3 2026 · 1 Jul – 30 Sep 20267 days30 days90 daysQ3 2026Custom rangeEvery type defined →6
Attribution: a change named as the cause, at CCS 0.80 or above
2
Low confidence: a candidate at CCS 0.60–0.80, for you to confirm or reject
23
No attribution: examined, and no change could be named as the cause
0
Resolution: issued when an incident is resolved and every gate has a reading
5
Governance: a setting, zone or review decision, entity-wide
1
Engagement: auditor access created, shared or ended
37 in this period · 10 before it · 5 after it · 52 in all. Excludes the integrity monitor's own check records (RV) and synthetic test receipts, which the ledger lists under Synthetic.
Latest receipts
8 of 52 in this vault's recordOpen the ledger →Error rate above 5% on ledger-sync
ledger
KeyError: 'total_cents' → PR halden/payments-api#412
checkout
Low-confidence attribution confirmed
entity-wide
TypeError: currency_code is undefined
billing
KeyError: 'tax_region'
reporting
Memory limit reached during statement render
statements
Auditor access · Q3 2026 SOC 2 audit
no service zone
AttributeError: 'NoneType' object has no attribute 'iso_code' → PR halden/ledger-sync#88
ledger
The facts nobody owns are the ones between two systems.
Every vendor already proves what happened inside itself. Sentry proves the exception. GitHub proves the merge. The relationship between the two is owned by nobody — which is exactly the relationship an examiner asks about.
Not a GRC platform, not a control, not an opinion. Déjà supplies the record. It doesn't discharge an obligation, and it doesn't tell you what to conclude.
Layers one and two run continuously and don't depend on any incident attributing. Layer three is the narrowest of the three and the only one people usually hear about, which is why it's stated last here rather than first.
Each of these has a page of its own.
Connect a signal source and a change source. Then the record keeps itself.
Nothing to install, and no change to how anyone works. Your observability and paging stay exactly where they are — they're Déjà's inputs, not its replacement.
- youConnect your sources
- youSign the genesis receipt
- Déjà · unattendedSignals sealed, changes examined, receipts chained
- exceptionsGaps and failures sealed too
- your auditorVerifies offline, without an account
Connect your sources
An error tracker for the signal, a source-control provider for the change. Déjà writes nothing back to Sentry or GitHub; it reads events and each pull request's metadata and diff as it's opened, updated and merged, secrets scrubbed, never a file outside that diff. Besides delivering receipts where you point them, it writes back in two places: an event into Honeycomb when an incident is resolved, and ServiceNow incidents if you turn on incident sync.Sign the genesis receipt
Written once at setup, with your organisation and the time inside the signature. Every later governance receipt chains behind it, and the ledger is append-only — enforced in the database, not by convention.Signals are queued for scoring
Each new signal is queued for scoring as it arrives. Signals from Sentry, the signal source demonstrated end to end today, are sealed when Déjà scores them: each one that reaches scoring ends in a signed receipt, whether or not a cause is found. Datadog, Splunk On-Call and Alertmanager · Grafana alerts are scored too, but not yet demonstrated end to end, and a Datadog alert ends only in a no-attribution record (R1-N). That is what makes the ledger a record of the period rather than a record of the interesting parts of it. Alerts from New Relic, Dynatrace, Honeycomb, AppDynamics and Splunk (alerts) are received but not scored yet, so they get no receipt, and whether PagerDuty, AWS CloudWatch, Azure Monitor, Google Cloud Monitoring, incident.io, Rootly and FireHydrant incidents reach scoring is still being checked.Changes are examined and scored
Producer-side changes in the lookback window are enumerated and scored against the affected field the signal carried — eight weighted signals, published thresholds. Above the threshold the receipt carries the score and the candidate. Below it, the receipt says so.The exceptions are sealed as well
Nothing matched, confidence below threshold, the fix didn't hold, the same field broke again — each has its own receipt type. A ledger that only records the cases that worked is a brochure.Your auditor verifies without us
Export the bundle; they run the open CLI on their own machine against a published key. No account, no call to our API, no request we could refuse or fail to answer.
- GitHub · Demonstrated end to end
- Sentry · Demonstrated end to end
Outbound webhook delivery is demonstrated end to end too, and 46 more tools connect today, each on the wall with the line that says what it does now. See every integration
No-attribution receipt · unscorable signal
R1N-0e51b7R1-Nledger-syncConnection pool exhausted · 03:11:02
- SIGNAL
- No affected field present in the payload. error_class: other
- GATE
- Not entered — attribution requires an affected field to score against.
- WINDOW
- 30 days, 9 changes recorded across 2 producers.
- CANDIDATES
- #318 #319 #322 #327 #331 #334 #340 #341 #344
- REASON
- Outside attribution scope. Recorded and listed, not scored.
The ledger records the outcome, not only the finding.
A no-attribution receipt comes in two kinds, and it says which. When scoring runs, the receipt records what was examined and why nothing cleared the threshold. When the signal isn't scorable — no affected field to score against — it records the eligibility condition that failed and why scoring was never entered, and still lists the changes in the window.
A tool that records only its successes has told you nothing about the period it covers. This is the part an examiner is actually testing for.
Three patterns. And everything else.
The narrow part of Déjà is stated plainly here rather than discovered in month two. Layers one and two cover far more; layer three covers this.
A field was removed
A producer stops emitting total_cents. A consumer reading it raises KeyError. The signal names the field; the change removed it.
A field was renamed
currency_code becomes currency. Same shape as removal from the consumer's side, and the same evidence on the producer's.
A field changed type
A string becomes an object. The consumer raises TypeError or AttributeError on a field the change touched.
- else
Everything else gets a receipt, not an attribution
Timeouts, memory, capacity, auth failures, rate limits, logic bugs, performance regressions, infrastructure. These are sealed as no-attribution receipts carrying the processing outcome and, when scoring ran, what was examined. They are evidence of the period; they are not a claim about cause. - gate
Four conditions have to hold at once
The signal arrives from a connected source; the signal carries the affected field; the language has a real parser; and a matching change exists in the lookback window on a change with a resolved edge. Fail any one and the result is a no-attribution receipt. - yours
The proportion is yours to establish
What share of your incidents are cross-team field breaks is a number about your architecture, not about Déjà, and we won't invent it for you. It's also the wrong number on its own: the cross-team schema break is the case where nobody knows the cause, because it lives in another team's repository.
You don't have to trust Déjà to trust Déjà.
A vendor's own attestation is not independently verifiable evidence by itself, and that constraint applies to us as hard as to anyone. So every attribution receipt is signed — with Déjà's Ed25519 key, or on Enterprise and Sovereign with your vault's own KMS key — and verifies against a published public key with open tooling on a machine we don't control, with no account and no call to our API.
The ledger is append-only, and that constraint is enforced in the database rather than by application policy — an issued receipt cannot be updated through the product, and your auditor can read the constraint definition themselves. What each signature independently establishes is narrower and more durable: that this receipt's content is the content that was signed by the holder of the published key.
The bundle states, per receipt, whether it is signed or content-hashed, rather than letting the stronger word cover both.
Offline verification · your auditor's machine
- Pack · Q3 2026 SOC 2 audit, of 52 in the vault's record
- 36 receipts
- Manifest signature · ed25519
- valid
- Signature · ed25519 against published key
- 36 / 36 valid
- Sequence · files 1–36
- no gaps
- Canonical form · recomputes to the signed bytes
- match
- Déjà API calls required
- 0
$ dsr-verifier-cli verify-bundle bundle.zip --key deja-managed-v1.pub
Everything here keeps a record. None of them keeps this one.
These systems each preserve what happened inside themselves, and they do it well. What none of them produces is a single artefact spanning several of them, carrying its own examination outcome, that a third party can check without asking any of us anything.
| Capability | Observability & paging | Probabilistic RCA | GRC platform | Déjà |
|---|---|---|---|---|
| Primary artefact | Telemetry and events, inside its own environment | A ranked inference over that telemetry | An entry in a control register | A cross-system receipt linking what several systems reported |
| Captured as it happens | Yes, within the system | Yes, over the same data | No — entered afterwards by a person | Yes for scored sources — sealed into an append-only chain when scored |
| Explicit no-attribution outcome | Not generally what it is for | Usually surfaces as a lower-ranked candidate | A blank field | A receipt stating what was examined, or which eligibility condition failed |
| Deterministic attribution | Correlation and change tracking, not a deterministic claim | Probabilistic and ranked by design | Whatever was typed | Three field-change patterns, scored against published thresholds |
| Independent verification | Generally not its evidence model | Generally not its evidence model | Self-asserted by the customer | Offline signature check against a published key, for signed receipt types |
| Evidence format | Vendor-specific | Vendor-specific | Platform-specific | DSR/1.0 receipts and bundles — open spec |
| If the vendor disappears | Export, typically unattested | The inference goes with it | Export, still self-asserted | Signed receipts still verify against the published key |
Keep all of them. Observability and paging are Déjà's inputs; a GRC platform is where the evidence lands. Déjà is the substrate underneath, not a replacement for any of the three.
What we can show you today — and what we can't yet.
Déjà is early. Pretending otherwise would waste the first hour of your security review, so here is the position in writing. If a connector matters to you and it's in the second list, say so before the trial rather than after.
- Sentry
Signal-to-receipt path demonstrated end to end
A real exception in a production organisation produced a sealed receipt through the full signal path. That is a narrower statement than cross-system attribution demonstrated in production, which we are not yet making. It is currently the one qualifying source we can say even this much about. - GitHub
Change side demonstrated
Merge events write producer-side edges. Consumer-side resolution across services is built and being validated; until it lands, cross-service attribution isn't something we'll claim. - Datadog
Connected · cannot name a field
Its alerts are scored, but Déjà's intake keeps no title, message or stack trace — Error Tracking included — so a Datadog alert cannot name the field, and its receipt records that none was extracted. Our endpoint accepts a delivery that carries the connection's secret in a header, which a Datadog webhook can be set to send, and we have not yet shown a real Datadog delivery end to end. - Slack · PagerDuty
Connected, not yet demonstrated
They deliver and they page. A PagerDuty incident that reaches scoring is scored on its title, from which a field can be read, but whether PagerDuty's current webhook format reaches scoring is still being checked, so no PagerDuty receipt is claimed. - ServiceNow · Jira
Beta, untested by us
In the codebase, not yet validated end to end. Listed here rather than on an integrations grid with a checkmark next to it. - GitLab
Connects, not read yet
Déjà registers its own webhooks on the projects you choose, but merged merge requests are not read yet, so nothing the GitLab connection receives becomes a candidate for attribution. - Languages
Python demonstrated
The Python parser is demonstrated. JavaScript and TypeScript are supported but not yet demonstrated by us, and so are Protobuf and Avro schemas. - Certifications
In progress, not complete
No SOC 2 report is complete. Type I is in preparation. [Awaiting owner: SOC 2 Type I target date, or none] We'd rather lose a deal than imply an attestation we don't hold.
Everything in the second list either becomes a demonstration or comes off this page. Ask for the current version of it before the demo — it's the fastest way to find out whether this is worth either of our time.
Priced by scope. Never billed by volume.
A bad quarter costing more than a quiet one is an incentive pointed the wrong way. Tiers are priced on vaults, retention, isolation and support — never on how many receipts your systems produced.
- For design partners shaping the roadmap
- Direct line to the team, DSR working-group seat
- Up to 15 seats · one vault
- Two-year receipt retention
- Limited seats
- One vault, full receipt lifecycle, framework mapping
- 30 admin seats · unlimited auditor invitations
- Five-year retention · SSO/SAML · governance receipts
- Offline verification and exportable evidence bundles
- 14-day trial, fully featured, no card
- Multi-vault, your own AWS KMS key, custom retention
- Support response times: [Awaiting owner: support response times]
- Procurement-grade review
- Sovereign deployments from $1M a year
No overage on any tier. Standard includes an allowance of 200 attribution receipts a month and Charter 42; nearing it sends your Primary Owner a warning and opens a scope conversation, never a bill, and no-attribution and low-confidence receipts never count. A quarter with four hundred incidents costs what a quarter with four costs. The 14-day trial starts when you sign up. It needs a work email address: a vault is identified by an organisation, so personal domains are declined at signup.
Questions we would ask too.
- We already have Datadog and PagerDuty.
- Keep them — they're inputs. They observe and they page; neither produces a sealed, offline-verifiable record of what arrived and what changed. Different layer, not a replacement, and Déjà is worth nothing without them.
- Why should we trust your attribution?
- You shouldn't have to. Scoring is deterministic and published, the score travels on the receipt, and where confidence is below threshold or nothing matched the receipt states that instead. A system that records its uncertainty explicitly is the only kind worth checking.
- What if it attributes the wrong change?
- Then the receipt carries the score and the margin, and an engineer can see the second candidate was 0.004 behind. That's why the number is on the artefact rather than behind it. Where two candidates sit inside the tie band, the receipt is sealed as low confidence rather than as a finding.
- What happens to our evidence if you shut down?
- Signed receipts remain signature-verifiable offline against a published key, and an audit engagement's period report remains independently integrity-checkable. None of that depends on us being reachable — or existing. The ledger export does not hold everything: it takes up to 2,500 receipts at a time, leaves out RV and RE, and lists an R0, R2-F or R2-R issued before those types were signed with its content hash rather than as a signed file.
- Our auditors won't accept this.
- They don't have to accept it — they verify it, on their own machine, without an account. Bring your audit firm into the trial; that's what the trial is for, and their objections are more useful to us than our answers are to them.
- Does this satisfy Part 500, HIPAA or DORA?
- No, and be wary of anyone who says it does. Déjà supplies the record. Filing, determination, classification and certification remain with your named accountable individuals, and no vendor can take that on for you.
Four things that may rule us out.
- ResidencyData is stored in US West (N. California) · us-west-1 only. Storage in other regions is not offered yet.Procurement
- LanguagesAttribution parses Python, TypeScript and JavaScript, plus Protobuf and Avro schemas. A change in any other language is recorded as unsupported and cannot be named as a cause.Integrations
- ResolutionMost organisations get no resolution receipt (R2) yet: Déjà issues one only for an incident with an attribution receipt (R1), once 48 hours have passed since a user marked it resolved, and only if every gate then has a reading, which takes connected source control, Sentry, and Datadog (with a metrics read key) or New Relic. So SOC 2 CC7.4 and CC7.5 usually get no evidence from Déjà.For auditors
- AttestationDéjà holds no completed SOC 2 report or other attestation yet.Security & trust
Has an examiner ever asked for a record you couldn't produce?
Fourteen days to decide. Bring your auditor.