Compliance evidence for the whole org, not just one laptop.
deeCtx Core runs entirely on one machine, by design: zero telemetry, nothing leaves the laptop. That's the right default for an individual developer. But an SMB or enterprise compliance team doesn't need to prove what one laptop did; they need to prove what an entire engineering org did, across every developer's AI tool, on demand. deeCtx Pro is the fleet layer that makes that possible, without ever centralizing raw PII.
deectx-ship: a signed pairing client, not a data pipe.
Each developer keeps running the open-source deectx engine, untouched, gaining every Core capability (auto-wire setup, live status, dynamic key-shape routing, Codex/Copilot CLI over /v1/responses) with zero config. A small companion process (deectx-ship) tails that developer's local, hash-only ledger and ships a signed, aggregated summary to your org's compliance server, never the original ledger, never raw PII, and disabled by default.
local ledger.jsonl → tail → identity resolve → regulation bucket
→ Ed25519 sign → spool (on network failure) → POST /v1/teleport
│
org compliance dashboardEach event is attributed to a developer identity: config, environment, or OS username, in that order, so org reports know who touched what, without new per-tool logins.
Every masked entity is mapped into a deterministic bucket: gdpr-art9, cdr-au, or none, before it's shipped.
Each batch carries only entity type, action, alert flag, and a hash, signed with an Ed25519 key so the evidence is tamper-evident end to end.
Network drops don't lose evidence: batches spool to disk and retry with backoff until the server acknowledges them.
Free forever, plus a fleet layer when you need one.
| Feature | deeCtx Core (OSS) | deeCtx Pro |
|---|---|---|
| Local PII/secrets masking proxy | ||
| Reversible, session-scoped rehydration | ||
| GDPR + Australian CDR detection packs | ||
| Local hash-only audit ledger + `audit` CLI | ||
| Custom / community rule packs (YAML) | ||
| Fleet-wide compliance dashboard | ||
| Signed, tamper-evident evidence (Ed25519) | ||
| Per-developer identity resolution across the org | ||
| Regulation-bucketed reporting (GDPR Art. 9 / CDR-AU) | ||
| Resilient shipping: spools & retries through network loss | ||
| SSO & fleet policy management | planned | |
| Priority support & SLAs | planned |
A handful of engineers, one compliance owner wearing multiple hats. Pro gives you an answer to "can you show me what our AI tools touched last quarter?" without building any of the plumbing yourself.
Regulated data holders, larger engineering orgs, and security teams that need org-wide, signed, per-developer evidence, not a spreadsheet stitched together from individual laptops.
deeCtx Pro is still being built, in the open.
The engine underneath, deectx-ship, is under active development against a published spec. Start with the free, open-source Core today; Pro details, pricing, and an early-access program will land here as they're finalized.