01
A public API, not a closed box
Everything devguard does is backed by a public API. The reference lays out what’s available and how to authenticate, so you can see exactly what you can build on before you write a line.
devguard runs on a public API, so the same compliance work you’d do by hand you can script instead. Connect GitHub, GitLab, Jira and Slack, read the docs, and build on top. You connect what you want, and the evidence links back to the control it satisfies.
devguard isn’t a closed box. The platform runs on a public API, so the compliance work you’d otherwise click through you can drive from your own systems instead.
Everything devguard does is backed by a public API. The reference lays out what’s available and how to authenticate, so you can see exactly what you can build on before you write a line.
The routine compliance steps you’d do by hand in the UI are the kind of thing you can drive from your own scripts and scheduled jobs. Less clicking through screens, more of the work on rails.
Connect devguard to the dashboards, jobs and internal tools your team already maintains, so compliance data sits alongside the rest of your engineering work instead of in a separate tab.
The devguard CLI runs the checks you already have, like npm audit or Trivy, on a schedule and pushes each report into the evidence record it belongs to. Each push replaces the last, so what an auditor opens is days old, not a year.
Four connections ship today. GitHub, GitLab and Jira open and sync remediation issues both ways; Slack carries the alerts. You connect each one on purpose and scope what it sees.
You connect GitHub, GitLab, Jira or Slack explicitly, with access you can revoke, and as issues update and close the trail comes back and attaches to the control it satisfies. So when the audit comes, the proof is already connected, not reconstructed after the fact. More connectors, including cloud, are on the roadmap, and they’ll work the same way.
The docs, the API reference, the integrations and what shipped lately, all in one place.
Guides, references and how-tos for every part of devguard.
Authentication, endpoints and examples, plus the CLI that pushes evidence from CI.
GitHub, GitLab, Jira and Slack, and how each one connects.
Everything new in devguard, shipped and dated.
Yes. devguard runs on a public API, documented at docs.devguard.ch/api. The platform is built to be automated, not only clicked through, so you can read the reference and build against it before talking to anyone.
Yes. The devguard CLI runs collectors you declare, like npm audit or Trivy, secret-scans the output and pushes each report into an evidence record, replacing the previous file. Install it with npx @devguardch/cli and read the reference at docs.devguard.ch/cli.
GitHub, GitLab and Jira sync remediation issues both ways, and Slack receives notifications. That’s the live set. More connectors are on the roadmap, and we list only what actually ships.
You connect a tool, like GitHub, GitLab, Jira or Slack, and issues sync back linked to the control they satisfy, or you upload and map a document directly. The devguard CLI can also run your checks in CI and push each report into an evidence record. Cloud auto-collection from AWS, Azure or GCP is on the roadmap.
devguard is Swiss-hosted by default, in German and English, with on-premise possible. You control where the data sits, and connection credentials are encrypted at rest.
It’s yours. Export your records to CSV and your reports to PDF at any time, and read through the API. Moving in never means you can’t move out.
Start for free and connect a tool, or read the API docs first. You can look around the whole platform without a sales call.
Start free and connect your stack, or read the API docs first. Cloud auto-collection is on the roadmap; today evidence flows from the tools you connect and the CLI you schedule.