Built to observe,
not replace.
CDK sits alongside the systems you already run — GitHub, GitLab, Jenkins, your cloud platform — and turns the events they produce into signed, portable, independently verifiable evidence.
Five systems. One evidence model.
Attestation Engine
Generates signed evidence from delivery events — approvals, builds, deployments — using open, portable standards.
Evidence Graph
Connects every software change into a complete, queryable history from commit to production.
Policy Engine
Turns organizational requirements into executable controls, enforced continuously rather than reviewed after the fact.
Compliance Mapping
Translates technical evidence into the language auditors and regulators expect, automatically.
Enterprise Control Plane
Centralizes trust across teams, environments, and business units at organizational scale.
Where CDK sits.
CDK doesn't compete with CI/CD platforms, and it doesn't replace GRC systems. It connects what engineering already produces to what governance already needs.
What "trust" means here.
Six properties, each independently verifiable, that together make up a trust claim CDK can stand behind.
- Identity
- Who initiated or approved an action, cryptographically verified.
- Policy
- The rules that were supposed to apply, expressed as executable logic.
- Provenance
- Where an artifact came from, and every step it passed through.
- Integrity
- Confirmation that nothing was altered between steps.
- Verification
- Independent confirmation that a signature and its claims are valid.
- Assurance
- The cumulative confidence that results from all five, continuously.
From event to evidence.
Event occurs
A commit is approved, a build completes, a deployment is authorized.
Captured
CDK observes the event through its integration with the originating system.
Signed
The event becomes a cryptographic attestation using open signing standards.
Linked
The attestation connects to every related event in the Evidence Graph.
Verified
Anyone holding the evidence can independently confirm its signature and claims.
Anyone can verify. No account required.
Evidence is signed, not secret. Auditors, customers, and security teams can verify any attestation independently, without access to CDK itself.
Evidence, programmatically.
A REST API and SDKs for Go, TypeScript, and Python — generate and query evidence from inside pipelines, scripts, or custom tooling.
POST /v1/attestations
Authorization: Bearer sk_live_•••
{
"event": "deployment.approved",
"artifact": "release-2026.07",
"policy": "release-policy-v3"
}
{
"id": "att_8f92ab",
"status": "verified",
"signature": "sha256:8f92ab…"
}