The short version
Anyone can create an account on deviops.app. An account alone opens no tool: the DEVI Ops Team reviews every account and every tool request, and each tool is approved on its own.
DEVI tools run on your own Windows computer and work offline. Your evidence, keys, file names and hashes are never sent to DEVI.
Every release file has a published SHA-256, and the Windows apps and their installers are Authenticode-signed, so you can check a download before you run it.
The Trust and Security page has the detail: how each tool handles evidence, the SHA-256 of every published file, and how to check a signature.
Accounts and tool access
- Create an account on the site. Sign up with the email you want to use for DEVI and a password of 12 or more characters. Your email is how you sign in and is never shown.
- Complete your profile. Who you are (law enforcement, prosecution, defense or contractor), your agency or firm, your role, and a supervisor or point of contact. The DEVI Ops Team uses it to review your requests.
- Request each tool. Give a short reason and accept the license agreement. The DEVI Ops Team reviews every request and emails the decision to your sign-in address.
- Access is per tool. Approval for one tool does not open another. Your approval is checked on every download, and a license is for you alone, under the account that was approved.
On the sign-in side, you can add a passkey (Face ID, Touch ID, Windows Hello or your device PIN) and sign in with it instead of a password. With a passkey, the secret that proves it is you never leaves your device. From Account > Security you can change your password, manage passkeys, sign out everywhere, or delete the account.
The tools work offline
- DEVI Validate recomputes hashes and compares them with values from another tool or process. It reads evidence without changing it, and hashing and verification never use the network.
- DEVI Decrypt decrypts Apple and iCloud OpenPGP provider returns. It reads the encrypted file without changing it, never uses the network to decrypt, and does not save the key or the passphrase.
- DEVI Registry looks up sourced application and artifact metadata. Lookups never use the network.
The only request any of them makes is an optional, signed update check. Nothing a tool reads, and nothing it writes, is uploaded to DEVI.
Checking a download
- SHA-256. Every release file has its SHA-256 published on its tool page and on the Trust and Security page. Compare it with the file you downloaded.
- Authenticode signatures. The Windows apps, their installers and their uninstallers are signed through Microsoft Artifact Signing, with a timestamp. A valid signature shows the file came from DEVI unchanged. It does not replace the SHA-256 check.
- Download only from deviops.app. Tool files are behind sign-in. DEVI tools are licensed to approved accounts and their source code is not published.
Protecting the account service
- All traffic to deviops.app and its services is encrypted in transit using current TLS.
- Data at rest in our infrastructure is encrypted.
- Administrative access to our cloud environment is restricted, requires multi-factor authentication, and is logged.
- Infrastructure is defined as code and changed through a reviewed process, so a configuration change is a deliberate, recorded act.
The Privacy Policy lists what an account record keeps and for how long. If we become aware of a breach affecting account data, we will notify the people affected promptly.
What DEVI does not claim
DEVI does not claim certifications or authorizations it has not obtained. No court, standards-body, or laboratory certification is claimed.
DEVI is being engineered to support applicable CJIS Security Policy requirements and other security frameworks relevant to public-sector customers. Compliance depends on the complete deployment, configuration, operational controls, and customer environment.
Independent assessments and certifications will be identified here as they are completed.
A verification record is a hash report, not a statement that a court or a standards body has accepted the result. Each lab should validate a tool under its own procedures before relying on it. The full list is under What DEVI does not claim on the Trust and Security page.
Reporting a vulnerability
If you believe you have found a security vulnerability, email security@deviops.app with enough detail to reproduce it. Please report it to us before disclosing it publicly. A machine-readable contact file is published at /.well-known/security.txt.
In return, we commit to:
- Acknowledge your report within three business days.
- Tell you our assessment, and whether we are treating it as a vulnerability, within ten business days.
- Keep you informed while we fix it, and confirm when the fix ships.
- Credit you if you would like to be credited.
- Not pursue or support legal action against anyone acting in good faith under this policy.
Please do not access, modify, or retain information belonging to anyone else, degrade the Service for others, or use social engineering against our staff or our customers' staff. Never include case data or evidence in a report.
For IT and security teams
If you are evaluating DEVI for an organization and need detail this page does not cover, such as data flow, subprocessors, incident response, or a security questionnaire, write to security@deviops.app and say which organization you represent. We will answer directly, in writing. For anything else, see Contact.