Zero-retention architecture.Tamper-evident evidence.
The system of record for engineering truth — cryptographically signed, deterministic audit evidence, generated automatically.
Built for CISOs, security architects, audit-firm technologists, Heads of Risk, and CROs at firms operating under SOC 2 Type II, ISO 27001, NYDFS Part 500, DORA, or SR 11-7. Déjà produces evidence that has to hold up to your audit firm's scrutiny — which means our own security posture has to hold up to the same. Deterministic Abstract Syntax Tree (AST) analysis, eight weighted scoring factors (W1–W8), Ed25519-signed receipts written to an immutable, append-only, tamper-evident ledger. No LLM. No probabilistic guessing. No hallucination at audit time. We never store your source code. We cannot alter receipts after issuance, including ourselves. And your evidence verifies offline forever — independent of whether Déjà continues to exist. Verifiable by audit firms — firms such as KPMG, Deloitte, EY, PwC, BDO, Grant Thornton, or independent.
This page documents our security posture. For the SOC 2 Type II report (in preparation, targeted Q3 2026), pen test summary, DPA, and architecture documentation, request via security review.
We never store your source code.
- Transient webhook payloads — at merge time and incident time, processed in-memory for most flows; retry/DLQ and pending-signature queues may briefly persist data
- Error stack traces + exception signatures — extracted from incident signals
- PR metadata — author, merge time, commit SHA (references only, no diff content)
- Source code — your repository is never cloned, mirrored, or persistently stored
- Diff content — merged PR diffs are analyzed in-memory, then discarded
- Runtime data — production logs, database contents, customer PII, API payloads
- Historical repo contents — we do not backfill against your repository history
Receipts that can't be altered after issuance.
dsr-verifier-cli — no Déjà account required.SIGNED_RECEIPT / DSR 1.0// Canonical DSR/1.0 receipt (abbreviated) { "receipt_id": "rcpt_8f2c91ae7b3d", "spec": "DSR/1.0", "issued_at": "2026-04-24T18:22:47.031Z", "vault_id": "vault_payments_core", "incident": { "fingerprint": "sha256:a41b...c92d", "signal_source": "sentry", "first_seen": "2026-04-24T18:22:17Z" }, "attribution": { "causal_pr": "PR-4521", "commit_sha": "f3a2b91", "confidence_score": 0.94, "classification": "HIGH_CONFIDENCE_DEDUCTION", "reasoning_weights": { "w1_fieldOverlap": 0.98, "w2_temporalProximity": 0.91, "w3_blastRadius": 0.89, "w4_errorTypeMatch": 1.00, "w5_authorHistory": 0.80, "w6_zoneBoundary": 1.00, "w7_producerGraphDistance": 0.60, "w8_schemaStability": 0.92 } }, "signature": { "algo": "ed25519-v1", "value": "7fBxK2mP4nQ8vR3eL6jF1wCytY0hG9dN8kM2pX4bV7zA3rE6qJ1iU5oH0fT8cS9aB3rKwNpDqME1u+Cz4XvQRs==", "fields_signed": ["receipt_id", "issued_at", "vault_id", "incident", "attribution"] } }
The Ed25519 signature is computed over the JCS-canonical payload (RFC 8785) at the exact moment the receipt is issued. Modifying any signed field invalidates the signature — including changes made by Déjà's operators.
Your audit firm — firms such as KPMG, Deloitte, EY, PwC, BDO, Grant Thornton, or independent — verifies receipts with dsr-verifier-cli, an Apache-2.0 open-source tool that runs locally on their machine, requires no Déjà account, and verifies the signature against the canonical DSR/1.0 specification.
If Déjà's service disappeared tomorrow, your receipts would still verify. The verifier is offline and open. Evidence durability is architectural, not contractual.
Receipts are written to an append-only ledger per vault. Prior receipts chain to subsequent ones via fingerprint references — producing a tamper-evident chain of custody across all incidents in a vault.
How your data is handled.
Every customer has an isolated vault.
Each vault has its own chain of custody, its own signing keys, and its own tenant boundary. Cross-tenant data access is enforced at two independent layers: PostgreSQL Row-Level Security at the database engine (active for every customer-facing query) and application-layer org membership validation. A query missing an org predicate is rejected by the database before it reaches the application.
AES-256 at rest, TLS 1.3 in transit.
Encryption keys are managed via AWS KMS with automatic rotation. TLS 1.3 for all traffic — internal service-to-service, external webhook ingestion, and customer-facing APIs.
US live. EU + APAC coming H2 2026.
Default region is us-east-1 (AWS). Enterprise and Sovereign tiers will support dedicated EU (Frankfurt) or APAC (Sydney) deployment with no cross-region data replication — available H2 2026. US residency is live on all tiers today.
You own when data leaves.
Standard tier: 5-year retention. Enterprise: custom (common: 7 years for financial services). Sovereign: multi-decade. Deletion on cancellation happens within 90 days after export window closes — verifiable via deletion certificate.
Portable, forever verifiable.
Export your full receipt ledger at any time as a portable JSON + PDF bundle. Bundle verifies offline via dsr-verifier-cli. No proprietary format, no vendor dependency. If Déjà ceases operations, you retain verifiable evidence indefinitely.
Verifiable data destruction.
Deletion requests complete within 30 days (GDPR-compliant). Destruction is cryptographic — encryption keys are destroyed, rendering data unreadable. Receipt of destruction certificate issued on completion. Subprocessors are notified simultaneously.
Who can reach your data — and what we do if something goes wrong.
Authentication and least-privilege access.
- SSO / SAML 2.0 — included on Charter, Standard, Enterprise, and Sovereign tiers. Okta, Azure AD, Google Workspace, Auth0.
- Multi-factor authentication — required on all paid-tier admin accounts. WebAuthn (hardware keys supported via WebAuthn), TOTP supported.
- Role separation — admins manage vault configuration; auditors have read-only access; engineers receive notifications but never authenticate to Déjà.
- Audit logging — every admin and auditor action generates a log entry. Logs are append-only, immutable, and exportable for SOC 2 / ISO 27001 evidence.
- Staff access — Déjà employees cannot access customer vaults without explicit time-boxed, audit-logged customer approval via the support-access workflow.
- Session management — configurable session timeout (default 8 hours), explicit re-authentication for sensitive operations.
What happens if something goes wrong.
- Breach notification SLA: 72 hours — per GDPR Article 33. Affected customers are notified first, then regulators as required.
- On-call security rotation — 24/7 security incident response. PagerDuty escalation for all severity-1 and severity-2 events.
- Documented runbooks — for credential compromise, data exposure, vendor breach, DDoS, and ransomware. Tested quarterly via tabletop exercises.
- Post-incident disclosure — public transparency report issued within 30 days of resolution. Status page + incident history →
- Lifetime incident count: zero — no reported security incidents involving customer data as of April 2026. This page will be updated in real time if that ever changes.
- Responsible disclosure — security@deja.app for researchers. We acknowledge within 48 hours, work in good faith, and publicly credit reporters.
Where we are, where we're going.
Every vendor that could see your data.
Additional posture for financial services, healthcare, and government.
Enterprise and Sovereign tiers support FFIEC guidance alignment (US financial services), HIPAA Business Associate Agreements (healthcare), SOX control mapping, and ISO 27701 privacy controls. Regulatory integrations (direct reporting to central banks, for example) are negotiated under Sovereign tier engagements.
Request what your security team needs.
Deterministic by construction. Verifiable by anyone.
Déjà is not an LLM wrapper. It is a deterministic engine performing raw Abstract Syntax Tree (AST) analysis on every code change. The engine produces a Causal Confidence Score (CCS) from eight weighted scoring factors (W1–W8), then issues an Ed25519-signed receipt. No probabilistic guessing. No hallucination at audit time. No "AI that might be right." A CISO building an audit defense cannot risk evidence that depends on a probabilistic model — when the auditor asks "why was this attribution chosen over an alternative?", the answer must be reproducible math, not a confidence interval. Triggered via background webhook interception — payloads authenticated via HMAC-SHA256 signature verification.
- Zero-click compliance — receipts auto-generate; no engineer tickets at audit time
- Background webhook interception — silent on the merge event, HMAC-SHA256 authenticated
- No manual screenshotting of Jira tickets or Slack threads
- No source code stored by Déjà — diffs only, transient, then cryptographic fingerprints
- Live Verifier via
dsr-verifier-cli— Apache-2.0 open source (pre-release · public release Q3 2026) - Independent Ed25519 signature verification, offline, no network call to Déjà
- No Déjà account required to verify a receipt
- No source code access required — auditors verify attribution, not the codebase
The CISO's audit-defense problem is structural: manual evidence reconstruction creates audit findings. Based on Déjà's conversations with regulated-firm engineering teams, audit prep can consume multiple FTE-weeks per cycle reassembling what nobody captured at the time — searching Slack for incident context, screenshotting Jira tickets, copying deployment logs into spreadsheets. The output is unsigned, unverifiable, and reconstructed under deadline pressure. That output is what produces the audit-finding category of "evidence reconstruction was manual" — the finding the CISO has been carrying for three years running. Déjà eliminates the category at the architectural layer: signed at attribution, immutable thereafter, verifiable independently.
Receipts are independently verifiable. No implicit trust required between Déjà, the customer, or the audit firm.
The signature is the contract. The verifier is the proof. The append-only ledger is the chain. Even if Déjà were compromised, exfiltrated, or shut down, your receipts continue to verify — because the verification logic lives in your audit firm's own copy of dsr-verifier-cli, running offline against the receipts you already hold. Zero implicit trust. Zero vendor dependency. Zero reliance on Déjà's continued existence. This is the property that defines audit-defensible evidence — and the property no other compliance category preserves. Trust nobody. Verify everything.
Security is our product.
Déjà's job is to produce cryptographically signed audit evidence for regulated industries. If our own posture couldn't withstand the same scrutiny, our product wouldn't be worth shipping. Your security team's questions deserve direct answers — not sales theater.