Comparison
Internal bot frameworks: Chatops tooling vs. self-hosted overnight PR desk.
Internal Slack, Teams, and chatops-based bot tooling operates inside the chat surface and routes from a narrow set of internal events — chat messages, slash commands, internal workflow rules — to a chat reply or a workflow action. Driftlock runs offline inside the customer’s VPC and reads overnight engineering signals — CI failures, Dependabot alerts, CVE feeds, on-call pages — turning each into one signed pull request on the customer’s own protected branches. Where internal bot tooling optimises for the chat surface, Driftlock optimises for the audit-linked PR; the unit of work is different, so the comparison below frames posture rather than parity.
Posture
Driftlock runs self-hosted in your VPC; no third-party LLM is ever called at the test step.
Identity
Commits sign with your cosign key in your KMS or HSM. Keys rotate on your schedule.
Audit
Seven per-PR columns — alert id, sandbox run hash, SBOM hash, approver chain, signature, diff bytes, triage verdict — replayable on your storage tier.
What they do
Internal bot frameworks in one paragraph.
Internal bot frameworks are chatops bots, slash-command orchestration, and workflow rules running inside Slack, Teams, or a similar chat platform; the unit of work is a chat message or a triggered bot action, and the tool routes from a narrow set of internal events to a chat reply rather than to a signed pull request on a protected branch.
Where Driftlock differs
Eight dimensions where the posture diverges.
Each row names one axis — autonomy, hosting, audit, signing, SBOM, sandbox, monorepo scale, CI touch — and states both sides on that axis. No feature checklist, no marketing re-framing.
Axis · autonomy scope
Them
Reacts to a narrow set of internal events (chat messages, slash commands, internal workflow rules); CI failures, Dependabot alerts, CVE feeds, and on-call pages are typically not first-class triggers.
Driftlock
Acts only on overnight signals already in your stack (CI failure, Dependabot alert, CVE, on-call page); no message, no run.
Axis · self-hosting
Them
Runs as a hosted SaaS bot or inside the chat vendor’s cloud; the integration tier is the chat platform, not the customer’s VPC.
Driftlock
Single Helm + Terraform deployment inside your VPC, behind your egress policy.
Axis · audit trail
Them
Audit lives in the chat platform’s message log and the bot’s action history; replay requires the chat vendor as the intermediary and does not natively surface pull-request-level audit columns.
Driftlock
Records seven per-PR columns (alert id, sandbox run hash, SBOM hash, approver chain, signature, diff bytes, triage verdict) replayable on your storage tier.
Axis · commit-signing
Them
The output is a chat reply or a workflow action, not a signed pull request; cosign-style commit signing is not part of the unit of work.
Driftlock
Commits sign with your cosign key kept in your KMS or HSM; key rotation happens on your schedule.
Axis · SBOM
Them
Does not emit a per-message or per-action SBOM; SBOM concerns are out of scope for the chat surface.
Driftlock
Emits an SBOM hash per PR, recorded alongside the diff and the signature so reviewers can diff two SBOMs without re-running the build.
Axis · sandbox execution
Them
Operates inside the chat platform’s integration runtime; there is no hermetic sandbox that mounts the monorepo toolchain or replays a regression.
Driftlock
Runs inside a hermetic sandbox that mounts the existing monorepo’s toolchain and test cache, and replays the original regression before opening the PR.
Axis · monorepo scale
Them
Designed for many chat workspaces and many bots; large monorepos are not the design target and the tool routes no pull requests into the team’s review queue.
Driftlock
Built for one large monorepo per deployment; the sandbox mounts the monorepo’s existing caches so a CI rerun is bounded by what CI itself already proves.
Axis · CI touch
Them
CI failures, Dependabot alerts, CVE feeds, and on-call pages are read through webhook integrations at best; they are not first-class engineering-signal triggers.
Driftlock
Treats CI as the source of truth — the agent reads CI failures as triggers and reruns the original regression inside the sandbox before opening the PR.
8 axes · posture-level · no feature checklist
FAQ
Questions comparison-stage buyers ask.
See it on your stack
Compare on a real monorepo, not a slide deck.
The architecture page names the four signal sources the watcher reads; the governance page enumerates the seven per-PR columns a regulator replays. Run the comparison against one of your real monorepos on a ten-day scoped trial — you'll see the diffs Driftlock ships and the audit trail your reviewers sign.