You can answer the question. You just can’t prove it.
Every firm can eventually reconstruct what happened during an incident. The reconstruction is assembled after the fact, by the people being asked about it, from systems that each hold one fragment. It is usually accurate — and it is never independent, which is the part that matters when someone official is asking.
Request arrives nine months later
- Reconstruction · people
- 6
- Systems consulted
- 5
- Sealed record · people
- 0
- Checkable by a third party
- yes
Reconstructed afterwards
assembled over 3 daysWhat exists today: five systems, six people, and a narrative written by the team being asked about it.
- 03:0?paging tool
Someone was paged. The page is retained; what it was about is inferred from the alert title.
timestamp retained · cause not recorded
- ~03:15chat history
“pretty sure this is the payments change from yesterday”
the load-bearing sentence · never revisited
- 03:19deploy log
A revert went out. Which change it reverted is clear; that it was the cause is an assumption.
correlation recorded as causation
- 09:40postmortem doc
A tidy narrative, written by two of the six, from memory and scrollback.
author is also the subject
- +9mothe request
An examiner asks what happened and how you know. Two of the six have left. Log retention was 30 days.
answer exists · independence does not
Sealed as it happened
no human in the loopThe same night, written by the systems that were already going to fire, in the order they fired.
- 03:07:41received
KeyError: total_cents — checkout-api
queued for scoring · sealed in the receipt below
- 03:07:43examined
14 changes in the window, scored against the affected field
scoring_version 1.0.14 · thresholds published
- e4a17c92-5b3d-4f08-9a61-2d7c8e0f4b1903:07:43signed
total_cents removed by payments-api#412
CCS 0.96 · second candidate 0.31 · both on the receipt
- R203:19:02resolved
Reverted · no resolution receipt yet
an R2 follows only if every gate has a reading when its window closes
- bundle+9moexported
Your audit firm verifies it on their own machine, without an account
nobody who was there that night is required
Illustrative. The difference isn’t accuracy — the left column is probably correct. The difference is who has to be believed. Thresholds and the scoring version above are the live ones: 0.80 to attribute, 0.60 for low confidence, scoring version 1.0.14.
Nobody owns the fact that lives between two systems.
Your error tracker proves the exception. Your source control proves the merge. Your paging tool proves someone was woken up. Each is authoritative about itself, and each is silent about the others — and the relationship between them is the whole of what an examiner is asking about. Whose change, which service, at what time, and how do you know.
That gap is filled today by a person. Someone opens five tabs, reads backwards, and writes the sentence that connects them. The sentence is usually right. It is also produced after the fact, by the party with an interest in the answer, from data that may have already rotated out — which is a description of testimony rather than evidence.
The record was never too hard to keep. It was only ever kept afterwards.
Everyone knows this and nobody fixes it, because the fix has always meant asking engineers to be more disciplined during the worst hour of their month. That request loses to the outage, correctly, every single time.
So don’t ask anyone to be more disciplined. Watch the systems that were already going to fire, seal what they said when Déjà scores it rather than the next morning, and hand the result to someone who can check it without asking you anything. The discipline problem disappears when the record costs nothing to keep.
Five things that are true whether or not you buy anything.
- One
Reconstruction is memory
A postmortem is a recollection of an outage written by tired people from data that expires. It is the standard artefact, and it is the weakest kind of evidence a firm produces about itself.
- Two
Self-attestation isn't independent
A firm's own record of its own conduct can be evidence. It is not independently verifiable evidence, and an examiner is trained to know the difference.
- Three
The seam is nobody's job
Every vendor documents itself. Not one of them owns the relationship between itself and the next system, which is exactly where the interesting facts live.
- Four
Absence is the hard part
Proving something didn't happen, or that nothing was found, is far harder than proving something did. A record that only holds findings can't answer it at all.
- Five
Evidence must outlive the vendor
If checking your record requires calling a vendor's API, your evidence has a dependency on that vendor still existing, still answering, and still being trusted.
- So
What follows
Keep the record as it happens, include what wasn't found, and make it checkable by someone who trusts nobody. That is the entire product, and it is why the narrow parts are stated narrowly.
The work doesn’t get faster. It stops existing.
The measurable effect isn’t a better postmortem. It’s that the assembly step — the tab-opening, the scrollback reading, the asking someone to remember — is no longer part of answering the question, because the answer was written down at the time by the systems themselves.
That work is currently invisible in every budget, because it’s absorbed by senior engineers and compliance staff in hours nobody codes to a project. It only becomes visible when an examiner sets a deadline, at which point it becomes the most expensive week of the quarter.
We won’t put a number on it for you. What it costs your firm depends on how often you’re asked, how long your retention is, and how many systems the answer spans — and a vendor inventing that figure is doing the same thing we’re arguing against.
What actually changes
- BeforeEvidence request arrives → someone reconstructs from five systems
- AfterExport the period. Hand over the bundle.
- Before“We believe the cause was…” signed by you
- AfterA score, a candidate and the runner-up, on the artefact
- BeforeQuiet periods and busy periods look identical in the record
- AfterEvery scored signal has a receipt, including nothing found
- BeforeYour auditor asks you for evidence about you
- AfterYour auditor checks it themselves, offline, without an account
- BeforeThe engineer who was there is a required input
- AfterNobody who was there is required
Who this is for, and who it isn’t.
A page arguing for independently checkable evidence should be checkable about its own applicability. Read the right-hand column first.
Buy this if
- You're accountable by name. Someone signs a certification about your controls, and their exposure is personal rather than institutional.
- An evidence request has already hurt. An examiner, auditor or client asked what happened and the answer took weeks or came out thin.
- Your incidents span teams. The systems that break and the systems that changed are owned by different people, in different repositories.
- Your audit firm is external. The value is highest where the person checking the evidence has no reason to take your word for anything.
- You can grant scoped access to an error tracker and a change source. No agent, and no runtime change.
Don’t buy this if
- You need it to satisfy a regulation. Déjà supplies the record. Determination, classification, filing and certification stay with your accountable individuals.
- You want root-cause analysis. Attribution covers three field-change patterns. Everything else gets a receipt describing the outcome, not a cause.
- You need a completed attestation today. Ours is in progress, not complete, and we'd rather lose the deal than imply otherwise.
- Your stack isn't on the status page. One qualifying signal source is demonstrated today. If yours isn't, say so before the trial rather than after.
- Nobody has ever asked you for evidence. Then this is insurance against a question you may not get, and there are better uses of the budget.
If the right-hand column describes you, tell us and we’ll say so rather than running a pilot that was never going to work. The status page is the fastest way to find out.
What would have to be true for this to be worth it.
Rather than a business case built from our assumptions, here are the conditions the pilot should test. If they don’t hold in your environment, the answer is no and we’d like to find that out in fourteen days rather than in month nine.
- 01
Your signals reach Déjà at all
Connected sources deliver, and the ledger sequence advances during a normal week. This is the cheapest thing to test and the one everything else depends on.
- 02
The record is more complete than what you'd have assembled
Take a real incident from the pilot period, reconstruct it the way you do today, and compare it to the ledger. If yours is better, we've learned something important.
- 03
Your audit firm accepts the artefact
Not that they like it — that they can verify it, unaided, and would accept it in place of a narrative you wrote. Bring them into the trial; this is the test that matters most.
- 04
The exception receipts are readable by someone who wasn't there
Hand a no-attribution receipt to a colleague with no context and ask what it tells them. If the answer is nothing, the evidence layer isn't doing its job.
- 05
Assembly effort actually falls
Measure the time spent answering one evidence request before and after. This is the number that justifies the spend, and it's yours to measure rather than ours to assert.
Has an examiner ever asked for a record you couldn’t produce?
If the answer is no, wait. If it’s yes, the useful version of this conversation starts with the incident you’re still slightly uncomfortable about.
Déjà supplies a record of what connected systems reported and what changed. It does not determine root cause, file regulatory reports, or discharge any obligation under DORA, 23 NYCRR Part 500 or any other regime — those remain with your named accountable individuals. “Sealed” means written into an append-only chain with a content hash when the receipt is issued; “signed” is used only where a receipt additionally carries a signature — Ed25519 on Déjà's managed key, RSA-PSS or ECDSA on a vault's own KMS key — and the bundle states which is which per receipt. Scenarios and figures on this page are illustrative.