Zero-Retention Architecture
Déjà is designed as a pass-through analysis layer. We hash your stack traces in memory and discard the raw payload immediately. We never store your source code.
Our Terms of Service explicitly prohibit the training of generative AI models on customer data. Our 'Deterministic Matching' engine (Patent Pending) relies on hashing, not inference, eliminating the risk of model hallucination or data leakage.
Outputs are evidence-based artifacts (PR + diff that shipped), not generated remediation text.
Déjà minimizes retention by design. Raw incident payloads are used only to compute stable incident identity and to evaluate validation gates.
- • Raw stack traces/log payloads are processed in memory and discarded immediately
- • Only hashes and minimal metadata required for recall/validation are persisted
- • Retained data is scoped to the customer tenant and purpose-limited
Each customer has a logically isolated vault. Data does not mingle across tenants. Access is scoped by integration permissions and governed by tenant-level controls.
Vault architecture
High-level data flow showing minimization, hashing, and tenant isolation.
Access is granted via scoped OAuth tokens or app installations. Permissions are limited to what is required for operation (least privilege).
Raw payloads are not retained; processing is ephemeral (TTL: immediate discard).
Retention is purpose-limited. Where temporary text is required for normalization/validation, it is processed ephemerally and discarded immediately.
Security controls overview
The controls below summarize our approach across confidentiality, integrity, and availability. Specific implementations may vary by deployment configuration.
- •Encryption in transit (TLS)
- •Encryption at rest
- •Tenant isolation boundaries
- •Least-data retention (TTL: raw payloads discarded immediately)
- •Audit logging for sensitive actions
- •Least-privilege access controls
- •Scoped integration tokens (OAuth/app installs)
- •Change management and deployment controls
- •Incident response procedures
- •Ongoing dependency and vulnerability management
Compliance-Ready Design
Déjà's infrastructure is built on AWS GovCloud standards, with encrypted-at-rest data vaults and single-tenant logical isolation. We support rigid Data Processing Agreements (DPAs) and immediate 'Right to be Forgotten' execution.
Policies, access governance, logging, evidence collection, and risk review.
Controls testing, remediation, and auditor-aligned readiness reporting.
SOC 2 Type I, followed by Type II based on customer timelines and operating period.
During evaluation, we can provide a security overview, integration scopes, and retention behavior to support your internal review.
The Data We Do NOT Touch
Explicit boundaries on what we never ingest or store.
- ×Source Code Repositories — We only read Metadata/SHAs.
- ×PII / User Databases — We sanitize payloads instantly.
- ×Environment Variables / Secrets
Security review ready.
We will walk your CISO through access scopes, retention policies, and architectural isolation. The goal is straightforward: prove Déjà is safe to connect.
GDPR & CCPA Compliant