Skip to content
ZicoderaAttesta
Private preview

The audit trail for AI-written code.

Zicodera Attesta records who — or what — wrote each change, under which policy, and who reviewed it. Verifiable evidence for auditors, customers, and your own engineering leadership.

Get startedTry the interactive preview

Designed to collect metadata and hashes, not source code.

PR-2041 · payments-api

Add idempotency keys to refund endpoint

Sample data

  1. Commit

    Declared

    Commit by m.okafor touching 1 file

  2. AI session

    Attested

    Used: Code assistant

  3. Review

    Attested

    Approved by s.tanaka

  4. CI

    Attested

    Checks passed

  5. Merge

    Attested

    Merged to main in payments-api

Hover or focus a node to see the event, its tier, and its hash. Signatures are simulated. Sample data.

Change explorerSample data

Provenance coverage

75%

Attested 5 · Declared 4 · Inferred 3. Inferred is not counted.

Policy failing

3

of 12 changes

Passing all policies

75%

of 12 changes

  • PR-2041 · payments-api

    Add idempotency keys to refund endpoint

    AttestedHuman review Pass

  • PR-2043 · payments-api

    Retry backoff for settlement job

    AttestedAutomated only Pass

  • PR-2047 · payments-api

    Refactor currency rounding helpers

    DeclaredAutomated only Pass
Sample data

Your codebase has a new author. Your records don't.

Customers, auditors, and leadership are starting to ask how AI is used in software delivery. Today the answers often live in memory and chat threads.

  • Unknown

    Which repositories use AI assistants or agents?

  • Unknown

    Which models and tools touched this change?

  • Unknown

    Who reviewed it, and under which policy?

See what auditors ask

One ledger. Every tool. Verifiable.

Attesta captures provenance signals from your git host, CI, and AI tooling, writes them to a tamper-evident ledger, evaluates your policies, and turns the result into evidence you can hand to an auditor.

SourcesGit host (GitHub: preview)CI attestation stepCommit trailers and labelsAI tools and agentsGateway (planned)LedgerHash-chained eventsSigned checkpointsTier on every eventMetadata and hashes onlyPolicyRules on paths, tools, reviewSimulate against historyWarn, then enforceResults recorded in ledgerEvidenceEvidence packsChange explorerCoverage analyticsQuestionnaire drafts (planned)

What Attesta does

Six capabilities, each labelled with where it stands today.

Connect, capture, prove

Three steps from a read-only install to an evidence pack.

  1. 1

    Connect

    Install the read-only git app. It collects metadata only.

  2. 2

    Capture

    Add the CI attestation step. Route AI tools through Gateway when available.

  3. 3

    Prove

    Review coverage, enforce policy, export an evidence pack.

CI workflow (YAML)
# Illustrative — interface subject to change
- name: Attest change provenance
  uses: zicodera/attesta-action@v1
  with:
    tier: attested

Try it: explore sample changes

Filter the sample changes, switch a policy on and off, open a change, and verify its ledger. Everything here runs in your browser on fictional sample data.

Built for the questions you are being asked

Five situations, and the artifact Attesta produces for each.

Customer security questionnaires

Situation

A customer's security review asks whether AI coding tools are used, which ones, and how output is reviewed. The answer today is assembled from memory and chat threads.

What Attesta provides

  • A current inventory of tools and models, backed by recorded events
  • Review-coverage figures you can quote and trace
  • A drafting assistant whose answers cite ledger eventsPlanned

Output

Questionnaire answer excerptSample data
Question
Do you use AI coding assistants?
Answer (draft)
Yes, in 3 of 4 repositories, from an approved list.
Evidence
42 ledger events · 31 Attested · 11 Declared
Sample data
Illustrative excerpt, not real figures

Fits the tools you already use

Only GitHub is in preview today. Everything else is planned, and we label it that way.

  • GitHubPreview
  • GitLabPlanned
  • BitbucketPlanned
  • Azure DevOpsPlanned
  • GitHub ActionsPlanned
  • JenkinsPlanned
  • JiraPlanned
  • SlackPlanned
  • OktaPlanned
  • SnykPlanned

Product names are trademarks of their respective owners. Listing a name here describes a planned or preview integration and does not imply endorsement, partnership, or certification by the owner.

See all integrations

Your source code stays yours.

Four design principles shape how Attesta handles your data.

  • Metadata-only collection by design

  • Hash-chained ledger with signed checkpoints

  • Least-privilege, read-only app scopes

  • Regional storage and SSO/SCIM

    Planned

Read the security roadmap

Start free. Pay per active contributor.

Launch pricing for private preview.

  • Free

    $0

    For trying Attesta on a small set of repositories.

    Up to 5 contributors, 3 repositories

  • Team

    $15per active contributor / month

    For engineering teams that need policy checks and evidence.

    Minimum 10 contributors

  • Business

    $29per active contributor / month

    For organisations with audit, security, and customer-review obligations.

    Minimum 25 contributors

Enterprise: custom pricing for large or regulated organisations. Talk to us.

Pricing may change during private preview.

Estimate your price with the calculator

Frequently asked questions

Know how your software was made.

Get startedTalk to us