Bulletin · Engineering Note
Code as if
someone were
watchingbecause
someone is.
Deva is an AI-native development environment for the rooms where cloud AI cannot follow: classified networks, hospital subnets, defense primes, regulated banks. It catches insecure or non-compliant code as it is written, explains the clause it violates, and writes the fix -entirely against models running inside your boundary.
Deployed against government cyber/intel · medical research · defense primes
Try the scanner
Lite editionA lightweight tester -not the full IDE. The complete platform with 970+ rules, compliance mapping, AI fixes, and local model deployment is available through the full product.
The Platform
One platform.
Everywhere cloud AI cannot go.
Write-time detection, compliance-aware fixes, and local AI -sealed inside your boundary.
Local models, inside your boundary
Runs against an on-prem or air-gapped model. Ships with Deva Coder; bring your own if you prefer. No outbound model calls, ever.
On-prem · dedicated · air-gapped
Write-time detection
Findings surface while the code is being typed -not at commit, PR, or the nightly scan. The difference between preventing and remediating.
25 hybrid detectors · 14 languages
Compliance at the clause level
Every finding maps to the exact control clause it violates, not just the framework. The output mirrors what an auditor expects on a System Security Plan.
17 frameworks · 6 export formats
The Deva Model Family
The local models.
Run entirely inside your boundary.
Purpose-built models trained on domain-specific data. No outbound model calls. No third-party provider dependencies. Source code and patient data never leave the environment.
deva-coder-v8 · benchmarks
H200 · 2026-04-29Operating dossier
DEVA · Q2 · 2026the deva model family
Compute via NVIDIA Inception
Deva Coder
LiveSecurity-focused coding agent. CWE detection, CVE patching, secure code generation. Excelling on SWE-Bench, HumanEval, SecurityEval.
Local · on-prem · gapped
Deva Medical
In trainingHIPAA-aware clinical AI. De-identification of all 18 PHI categories, clinical summarization, ICD-10 coding, FHIR resources.
Clinical NLP · de-id
Deva Gov
In trainingGovernment compliance mapping. CMMC, FedRAMP, NIST 800-53, FISMA controls. Classified-environment workflows.
Compliance · gapped
Deva Finance
In trainingFinancial compliance AI. PCI-DSS, SOX ITGC, SOC 2. Fraud-detection patterns, transaction security, audit evidence.
PCI-DSS · SOX · SOC 2
Compliance Coverage
17 frameworks.
Every finding maps to the exact control clause it violates -not just the framework name. HIPAA 164.312(a)(1). NIST 800-53 SI-10. PCI-DSS 6.3.2. Each control gets a verdict: covered clean, covered with violations, partially covered, not covered, or attestation-required -the format an auditor expects on a System Security Plan.
src/api/users.ts:42
Violates 3 controls:
- 01CWE → control mapping across 17 frameworks
- 025 verdict levels matching SSP format
- 036 export formats: SARIF, OSCAL, JUnit, CSV, JSON, agent-json
- 04Compliance-aware fixes that don't re-introduce violations
DoD & Government
5 frameworks- 01CMMC 2.0mapped
- 02FedRAMPmapped
- 03NIST 800-53mapped
- 04NIST 800-171mapped
- 05NIST CSF 2.0mapped
Code-level mapping · exact control clauses · audit-ready evidence.
situation report · DEVA-2026-Q2 · May
Liveactive user teams
10
Government cyber/intel and medical/health research -the two verticals where compliance most directly blocks revenue.
recognized & backed by
investor relations
Building in, or investing in, regulated-environment AI security? We are meeting actively with teams in gov and healthcare.
Field Reports
Built in the open.
Updated constantly.
Core product shipped in 60 days in 2026. The full timeline follows below.
13,000+ total downloads
Over 10,700 npm downloads and 2,600+ extension downloads across the VS Code Marketplace and Open VSX Registry. Over 13,000 total downloads across all platforms.
Deva Core -MVP readiness
Deva Core reached MVP: quickstart onboarding, built-in readiness checks, Markdown report exports, and expanded test coverage across scanning, compliance, evidence, and validation.
Cloud model reliability & improvement roadmap
Hardened cloud LLM provider health checks and status reporting. Published a model improvement roadmap focused on governed adaptation, customer-local evaluation, and auditable updates.
Deva Core -cloud LLM service & realtime scanning
Shipped the cloud LLM service with realtime scanning and a provider registry covering local, BYOK, Ollama, and managed cloud validation paths. Users choose where their models run.
Deva Core -platform consolidation
Consolidated the product surface under the Deva Core name. Core is the canonical platform for scanning, compliance, SBOM, and reporting. 'Scanner' is reserved for the detection engine inside it.
84 earlier entries withheld pending access.
Sign in for the full log→Dispatch
By post.
Quarterly field reports on Deva -new detectors, frameworks, model releases, and the occasional note from a customer site. No marketing.