On-call notification and escalation

Alerts that escalate until someone acknowledges.

AlertRoster takes events from the systems you already monitor, works out who is responsible from your schedule and escalation policy, and notifies those people — on their phone, at their desk, and out loud in the room — until one of them acknowledges.

Operational alerting from Cloud Bedrock. Not a life-safety system — read what that means .

Incident

DB-02 stopped checking in

Escalating
  1. 00:00 Heartbeat missed. Alert raised against the Platform roster.
  2. 00:00 Notified Dana Whitfield, primary on call — phone and workstation.
  3. 02:00 No acknowledgement. Policy advanced to the secondary.
  4. 02:00 Notified Marcus Ellery, and engaged site alerting in Bay 3.
  5. 03:12 Acknowledged by Marcus Ellery. Escalation stopped.

Illustrative example. Timings come from the escalation policy you configure.

What it actually does

One roster, one escalation policy, and every channel that gets a person's attention.

On-call schedules and rotations

Who is responsible, and when. Rotations, handoffs, and overrides live in one roster your team can read without asking anyone.

Escalation policies

If nobody acknowledges, the alert moves to the next person on the policy. It keeps going until someone takes it.

Heartbeat and absence detection

Dead-man's-switch monitoring. When a system that should check in every minute goes quiet, that silence becomes the alert.

Phone, desktop, and the room

A native iOS app, desktop workstations, and on-premise audible and visual alerting hardware at the site itself.

Acknowledgement you can go back and read

Who was notified, on which channel, at what time, and who finally acknowledged — recorded per incident.

Tenant isolation in the database

Each organization's data is separated by Postgres row-level security, enforced by the database itself rather than by application convention.

How it works

Four steps, and the fourth one repeats until it doesn't have to.

  1. 1

    An event arrives

    From your monitoring, or from a heartbeat that stopped arriving.

  2. 2

    The roster decides who

    The schedule says who is on call right now. No group chat, no guessing.

  3. 3

    They get notified

    On every channel you have configured for them, at once.

  4. 4

    It escalates, or it stops

    An acknowledgement ends it. Silence moves it to the next person on the policy.

Make the room aware, not just the phone

A phone in a pocket, on a loud floor, in a Focus mode, is a single point of failure for getting someone's attention. AlertRoster can drive on-premise audible and visual alerting hardware at the site, so an unacknowledged alert becomes something people in the space can hear and see.

We supply the software that commands that hardware. We do not manufacture, install, or maintain it.

What AlertRoster is not

AlertRoster is an operational alerting tool. It is not a life-safety system, fire alarm, security alarm, or emergency notification system, and must not be relied upon as a substitute for one. Do not use AlertRoster where failure to receive an alert could result in injury or loss of life.

What we will and won't say about delivery

Alerting products are usually sold on promises nobody can keep. Here is the honest version.

Alerts are delivered on a best-effort basis over networks we do not own: Apple's push infrastructure, carrier networks, the public internet, and your own LAN and hardware.

Device settings — Do Not Disturb, Focus modes, silent mode, notification permissions, low power mode — can suppress or delay an alert. That is why the on-site channel exists.

The critical-alert capability on iOS, where available, requires an Apple entitlement and your explicit authorization. Where it is not available, alerts arrive as high-priority time-sensitive notifications, which do not bypass all device silencing.

We do not claim any alert is guaranteed to arrive, to arrive within a stated time, or to override a device's settings.

There is no uptime or delivery SLA today. When there is one, it will be a contractual number rather than a sentence on a marketing page.

We hold no security or privacy certification at this time, and will name the specific audit when we do.

Under the hood

Specifics, because "enterprise-grade" is not a specification.

Elixir and Phoenix on the BEAM
A runtime built for large numbers of concurrent, isolated processes — which is what a fan-out of notifications is.
Every notification is a durable job
Notifications run through a Postgres-backed queue, so each attempt is recorded, retried on failure, and inspectable afterwards.
More than one node, clustered
The application runs across multiple clustered nodes that share queue state, so a node being replaced does not take the queue with it.
Health-checked rolling deploys
New versions roll out behind health checks, and traffic reaches the app over TLS.

Put a name on every alert

AlertRoster is being rolled out with a small number of teams. If your operation has someone on call tonight, we would like to hear how it currently works.