Intelligence at merge time.Deduction at error time.
The system of record for engineering truth — cryptographically signed, deterministic audit evidence, generated automatically.
Built for Heads of Risk, CROs, CISOs, and audit-firm technologists at firms operating under SOC 2 Type II, ISO 27001, NYDFS Part 500, DORA, or SR 11-7. Déjà connects to your source control platform via background webhook interception — performs deterministic static analysis at every merge, computes a Causal Confidence Score (CCS) from eight weighted scoring factors (W1–W8) at every error, and issues an Ed25519-signed DSR/1.0 receipt written to an immutable, append-only, tamper-evident ledger — verifiable offline by audit firms. No LLM. No probabilistic guessing. No hallucination at audit time. Zero instrumentation. Zero code changes. No trace IDs required.
Connect your tools once, at the org level.
Where incidents originate
Connect Datadog, Sentry, New Relic, Splunk, AppDynamics, Dynatrace, or Honeycomb. When any of your services crashes, Déjà receives the signal automatically — with full stack trace and error context.
Where the fix lives
Connect GitHub or GitLab. Déjà reads your PR diffs at merge time to pre-compute the Upstream Producer Graph — so root cause is identified before the alert even fires.
Where the receipt lands
Connect ServiceNow, Jira Service Management, or a webhook endpoint. Every resolution generates a tamper-proof, cryptographically signed receipt — delivered here, ready for your SOC 2 Type II or ISO 27001 auditor.
Where your on-call lives
Connect Slack or PagerDuty. When a prior fix is found, Déjà notifies your on-call team instantly — with the causal PR and proven resolution — before they open a second terminal.
Create a vault. Add your services.
payments-checkout. One service. One zone. The name becomes the forensic identifier for every incident and receipt.payments-checkout is remembered — whether or not your team has ever seen it before.When something crashes, Déjà handles the rest.
payments-checkout at 02:47 UTC.SIGNAL RECEIVED
Datadog detected a KeyError on payments-checkout
The exception surfaced in production at 02:47 UTC. Déjà received the signal through its observability uplink. The trace ID was gone — Kafka had stripped it at the service boundary. Every other tool stops here. Déjà kept going.
FINGERPRINTING
Déjà fingerprinted the incident deterministically
The error was normalized, stripped of runtime noise, and fingerprinted using SHA-256. This fingerprint was checked against every prior incident in the vault — instantly.
SDE DEDUCTION
Schema Deduction Engine identified the cause
Illustrative example Déjà queried the pre-built Upstream Producer Graph — built from every merged PR in your repos. It found that three weeks ago, PR-4521 removed customer_tier from the upstream message schema. No trace ID needed. No human deduction.
ALERT ROUTING
Your on-call team was notified — with the fix
Slack, PagerDuty, ServiceNow, or email — whichever channel your team uses — received an alert. Not just "something crashed" but "payments-checkout crashed, and the causal PR is PR-4521. Here's what it changed. Here's how to fix it." Your engineer hadn't opened a terminal yet.
SIGNED RECEIPT
A cryptographically signed DSR/1.0 receipt was issued
A tamper-evident chain-of-custody receipt was generated and delivered to ServiceNow — structured to satisfy your SOC 2 Type II, ISO 27001, NYDFS Part 500, DORA, or SR 11-7 audit engagement. Your audit firm — firms such as KPMG, Deloitte, EY, PwC, BDO, Grant Thornton, or independent — verifies the receipt offline using dsr-verifier-cli, no Déjà account required. The Ed25519 signature was set at issuance time. Not even Déjà can alter it.
Déjà remembers every production incident your service has ever had.
The default is manual reconstruction.
Proof of mechanism · what the engine actually does
Déjà is not an LLM wrapper. It is a deterministic engine performing deterministic static analysis on every code change — extracting a Schema Error Tuple (SET), querying the Upstream Producer Graph (UPG), computing a Causal Confidence Score (CCS) from eight weighted scoring factors (W1–W8) summing to 1.00. Output: a Ed25519-signed receipt written to an immutable, append-only, tamper-evident ledger. No probabilistic guessing. No hallucination at audit time. Mathematical certainty by construction. Triggered by background webhook interception on every pull_request.merged event from your source control platform.
For the engineer · zero-friction
- Zero-click compliance — receipts auto-generate at attribution
- Background webhook interception — silent on the merge event
- No manual screenshotting of Jira tickets or Slack threads
- No audit-prep sprints — evidence ready before the auditor arrives
For the auditor · instant verification
- Live Verifier via
dsr-verifier-cli— Apache-2.0 open source (pre-release · public release Q3 2026) - Independent Ed25519 signature verification, offline, no network call to Déjà
- No Déjà account required to verify a receipt
- No source code access required — auditors verify attribution, not the codebase
vs. manual evidence gathering · what the pipeline replaces
Without this pipeline, the default workflow is manual reconstruction at audit cycles. Based on Déjà's conversations with regulated-firm engineering teams, audit prep can consume multiple FTE-weeks per cycle reconstructing what nobody captured at the time — searching Slack for incident context, screenshotting Jira tickets, copying deployment logs into spreadsheets, manually annotating bundles before the auditor arrives. The cost compounds across SOC 2 Type II, ISO 27001, NYDFS Part 500, DORA, and SR 11-7 cycles. The output is unsigned, unverifiable, and reconstructed under deadline pressure. Déjà's pipeline replaces all of that.
Zero-trust principle
Receipts are independently verifiable. No implicit trust required between Déjà, the customer, or the audit firm. The signature is the contract; the verifier is the proof; the append-only ledger is the chain. Even if Déjà were compromised or shut down, your receipts continue to verify — because the verification logic lives in your audit firm's own copy of dsr-verifier-cli, running offline. Trust nobody — verify everything.
Connect once. Remember forever.
Your team keeps shipping. Déjà keeps producing verifiable evidence. Every incident becomes institutional memory — cryptographically verifiable, audit-firm-verifiable, and durable across regulatory cycles.