Platform
One platform. Three depths of analysis.
Intelligence depth controls the analysis that is available at any plan. Detect is included. Correlate and Architect add to it, and the price scales with the depth you choose.
“Revelara has uncovered some terrifying/juicy findings. There were certainly surface level findings, but also way way deeper than I would have gotten, even with multiple human review passes. Critically, it's not just telling me the problem, but I can already start to see the matrix beyond it as the same failure class is highlighted across multiple disparate repositories.”
Principal Engineer, ex-Amazon/ex-Google
Detect: your code against real incident patterns
Detect surfaces individual risks by matching your codebase against historical incident patterns. It includes pattern-based risk detection, the incident knowledge base, and keyword and semantic search across your own knowledge base.
A finding shows its reasoning: the pattern that matched, what went wrong for someone else, and why it matters for your service.
- Many findings cite a real incident, not a generic rule
- Cross-incident pattern analysis
- Chat with incidents and your own knowledge
Correlate: the risks that combine
Correlate discovers compound and converging risks that span multiple services. It identifies when separate low-severity risks combine into a high-severity scenario.
Three medium findings in three services do not look urgent in three backlogs. Together, on one request path, they can be an outage.
- Cross-service dependency analysis
- Automated risk clustering
- Low-severity risks that converge into one high-severity scenario
Architect: systemic hazards, before they cause incidents
Architect adds STPA-inspired systemic hazard analysis, adapted from Systems-Theoretic Process Analysis (Leveson, MIT). It includes control structure analysis and loss scenario modeling.
It surfaces candidate unsafe control actions for your engineers to review. Each scenario says how the hazard would trigger in your system, so the review is about a specific path and not a general worry.
- Control structure analysis
- Loss scenario modeling
- Candidate unsafe control actions, for your engineers to review
A risk register that fills itself
- Auto-classified by category and severity
- Linked to services, teams, and controls
- Evidence coverage tracked automatically
- Approve, defer, or route each finding to the right team
See it by team, and see which way it moves
Your repos declare their owning team in .revelara.yaml, and scans carry it in. After that, every surface gains a team dimension: the risk register, the compliance matrix, scan coverage, and evidence.
Team trajectory tracks new against resolved risks week over week, ranked by direction and not by count.
PlanPer-team views start at the Plus plan. The organization trend is in every plan. See pricing.
Example data. Rose is new risks, lavender is resolved. The ranking is by direction and not by count, so a team that degrades slowly shows next to one that is bad but improving.
70 controls. Ship controls, not tickets.
- A 70-control catalog, highest-signal first
- Remediation guidance inside your coding agent
- Priority-scored, so the team works on what matters most
| Control | checkout | payments | platform |
|---|---|---|---|
| SLO-Tied AlertingRC-001 · detective | – | 2 | – |
| Synthetic MonitoringRC-002 · detective | 1 | – | – |
| Alert Noise ReductionRC-004 · corrective | 9 | 7 | 5 |
| On-Call CoverageRC-005 · preventive | – | – | 2 |
| Incident RunbooksRC-006 · preventive | 4 | – | – |
Example data. A lit row is one failure class that recurs across teams. A lit column is one team with many.
SOC 2 readiness: reliability evidence that stays current
SOC 2’s reliability controls live in engineering, not in a compliance tool. Revelara maps them to the criteria they support and keeps the evidence current between audits.
This is readiness, not certification. Your auditor still issues the report.
- Coverage by criterion: Common Criteria and Availability
- Export as Markdown, as PDF, or as a live proof page
PlanThe compliance matrix starts at the Plus plan. See pricing.
Evidence carries a scope: team, service, or global. A control counts for the organization only when every team is covered.
Run your first scan free.
Install the CLI, scan a repo, and read the findings in your terminal. Your source code stays on your machine.