Test the evidence without asking us for anything.

What is signed, and what is only hashed.

A signed receipt carries a signature over its canonical payload, which you check offline against the published key. A hashed receipt carries a SHA-256 content hash: it shows the receipt has not changed, but binds it to no key.

Vaults on Déjà's managed key sign with Ed25519, and every managed vault shares that one key. Enterprise and Sovereign vaults can sign with their own AWS KMS key instead, using RSA-PSS or ECDSA. Déjà's managed key is published with any key it has retired, so receipts signed with it verify offline. For vaults on their own KMS key, Déjà publishes the current public key of at most one such vault per organisation and no key that has been rotated out, so any other key an auditor needs comes from the customer.

What it checks, and what it leaves out.

Every 15 minutes, Déjà's integrity monitor runs these checks, in this order:

1. 1 · receipt sequence
2. 2 · signature validity
3. 3 · content hash
4. 4 · key authority
5. 5 · vault isolation
6. 6 · verification schedule
7. 7 · governance chain
8. 8 · genesis anchor

Checked

• R1
• R2
• RG
• GENESIS

Not checked

• R1-L
• R1-N
• R0
• R2-F
• R2-R
• RE

The monitor reads none of these, so it would not report a fault in one.

RVis the record of a check: what the monitor writes, not something it checks.

The controls a receipt maps evidence to.

A receipt is evidence for a control, never the whole of it: the rest of each control is tested outside Déjà. Every regime a regulated firm asks about has a row here, including the ones Déjà does not map.

• SOC 2Maps evidence to
  • CC2.2
  • CC7.2
  • CC7.3
  • CC7.4 † (evidenced only by an R2)
  • CC7.5 † (evidenced only by an R2)
  • CC8.1
  • CC9.2

  Common criteria of the 2017 Trust Services Criteria. Every other criterion is evidenced outside Déjà.

• NYDFS Part 500Maps evidence to
  • 500.2
  • 500.16

  23 NYCRR Part 500, as amended in November 2023. Every other section is evidenced outside Déjà.

• ISO 27001Maps evidence to
  • A.5.24
  • A.8.32

  ISO/IEC 27001:2022 Annex A: incident management planning and change management.

• HIPAAMaps evidence to
  • 164.308(a)(1)
  • 164.308(a)(6)
  • 164.308(a)(8) † (evidenced only by an R2)

  The Security Rule's administrative safeguards, 45 CFR 164.308.

• DORAOwner's view only
  • DORA.2
  • DORA.3 † (evidenced only by an R2)
  • DORA.4
  • DORA.5
  • DORA.6

  Shown on your own Frameworks page in Déjà's own numbering until counsel has reviewed the regulation's references, and left out of the auditor's evidence pack until then. Data is held in the US only today.

• SR 11-7Owner's view only
  • SR11-7.1
  • SR11-7.2
  • SR11-7.3
  • SR11-7.4
  • SR11-7.5 † (evidenced only by an R2)

  Shown on your own Frameworks page in Déjà's own numbering until counsel has reviewed the guidance's references, and left out of the auditor's evidence pack until then.

• SOX ITGCNot mapped

  Not mapped. Supports change-management evidence through SOC 2 CC8.1, and through the ServiceNow change record a deploy ran under, which is shown beside the receipt. [Awaiting owner: counsel review of the SOX change-management wording]

• SEC / FINRANot mapped

  Not mapped. No control in Déjà's table names an SEC or FINRA rule.

• FCANot mapped

  Not mapped. No control in Déjà's table names an FCA rule, and data is held in the US only.

• PCI DSSNot mapped

  Not mapped. No control in Déjà's table names a PCI DSS requirement.

• NIST CSFNot mapped

  Not mapped. No control in Déjà's table names a NIST CSF function or category.

• FedRAMPNot mapped

  Not mapped, and Déjà holds no FedRAMP authorisation.

† Evidenced only by a resolution receipt (R2). Most organisations get no resolution receipt (R2) yet, so these controls usually get no evidence from Déjà; §05 says when one is issued. A regime marked owner's view only is shown on the audited organisation's own Frameworks page in Déjà's numbering, and is left out of your evidence pack.

What you cannot test with Déjà.

Recovery controls, most of the time

SOC 2 CC7.4, SOC 2 CC7.5, HIPAA 164.308(a)(8), DORA.3 and SR11-7.5 get evidence from a resolution receipt (R2) only. Most organisations get no resolution receipt (R2) yet: Déjà issues one only for an incident with an attribution receipt (R1), once 48 hours have passed since a user marked it resolved, and only if every gate then has a reading, which takes connected source control, Sentry, and Datadog (with a metrics read key) or New Relic. Until one is issued, these controls get no evidence from Déjà. An R2 in an engagement's scope is listed in the portal, not packed in the period report.

Independent issuance time

Issuance time is asserted by Déjà, not externally anchored. A receipt's issue time comes from Déjà's own clock, and no timestamp authority or public log countersigns it. If your test depends on independent time, raise it before the engagement.

The whole ledger in one file

The ledger export takes up to 2,500 receipts at a time and leaves out R0, R2-F, R2-R, RV and RE receipts. Each receipt in it is a signed file dsr-verifier-cli checks on its own; the bundle the CLI checks as a whole is the period report of an audit engagement.

A source that went quiet

Déjà does not yet alert you when a connected source stops sending, and in the ledger a quiet source looks the same as a quiet period.

Which vault signed, from the signature alone

Every vault on Déjà's managed key signs with the same Ed25519 key, so a signature shows that Déjà signed a receipt and that it has not changed since, not which organisation's vault it came from. On Enterprise and Sovereign, a vault can sign with its own AWS KMS key instead.

Evidence about the vendor itself.

• Déjà staff access, approved by you

  A Déjà staff member asks to read your organisation's activity for 1 to 24 hours, and only an Owner can approve, decline or end it. Every read under an access is listed, with 90 days exportable as CSV for your auditors.

  Each approval, decline and end is a governance receipt. This covers reads through Déjà's staff console.

• Governance receipts

  Changes to how the audited organisation's evidence is kept are written as governance receipts (RG): signed, chained to the one before, and checked by the integrity monitor. They cover:

  • Signal sources and integrations
  • Delegated set-up
  • Members and ownership
  • The organisation
  • Vaults and zones
  • Service zones
  • Frameworks
  • Signing
  • Sign-in and SSO
  • Domains
  • Access policy
  • API keys
  • Notification routing
  • Déjà staff access
  • Engagements and exports
  • Evidence packs
  • Billing

• Audit log streamed to your SIEM

  Your organisation's audit log is posted to an HTTPS address you choose. Each POST carries an HMAC-SHA256 Deja-Signature header, and adding, resuming or re-keying a stream is a governance receipt.