Skip to main content

Escalation and on-call

Escalation exists for one situation: a critical incident is open, nobody has acknowledged it, and time is passing. The ladder makes sure the next person hears about it, louder, until someone presses acknowledge.

The ladder​

Alerting, Delivery and on-call, Escalation. The first step is the normal notification and fires immediately. Every further step is "after N minutes, tell X", where X is the on-call person, the second on-call (the next person in the rotation, a second pair of hands), a role, or the whole workspace, over the usual channels or by phone. Each step fires exactly once, at its second: a step due "after 5 minutes" fires five minutes after the incident opened, not at the next round minute. An acknowledgement or a resolution stops the ladder where it is; a reopened incident starts it again.

Escalation delivery deliberately ignores severity floors and quiet hours. It exists to pierce them. It is off by default; enable it when the team is ready to be woken.

On-call​

One rotation per workspace: an ordered list of people and a period in days. The rotation can be split into day and night slots so different people carry the phone at different hours, and date overrides (a vacation, a swap) win over the rotation for their range. The week strip shows who is on when.

Coverage gaps are computed to the minute and shown as a warning on the strip. If tonight's call would reach nobody (no one on call, or the person on call has no verified number), the workspace owner is told in the evening, not at three in the morning when the call fails.

When a step is aimed at on-call and nobody is on call at that moment (no schedule, or a gap in it), the step does not fire into the void. For a workspace managed by an agency it reaches the agency's own on-call person, provided that person is a member of the workspace; otherwise it falls back to the owners, then the admins.

Shift reminders​

Thirty minutes before a shift starts, the person taking over (and the second on-call, when the rotation has one) gets a reminder over their first reachable personal channel: Telegram, then browser push, then e-mail. Never a phone call. The reminder is on by default and has its own switch in My account, Notifications.

Phone calls​

On plans that include phone alerting, a step in the ladder can be a call: to the on-call person, to a role, to the whole workspace. Enabling calls adds a visible step, "after 10 minutes, call on-call", which you edit like any other. The call speaks the incident in your language and then listens: 1 acknowledges, 2 resolves, exactly what the console buttons do, and the timeline records who pressed what, next to the person who was dialled and how the call ended.

A number is called only after its owner verified it: add it in My account, Profile, and type back the four-digit code the verification call speaks. The verified number is the consent; there is no separate "call me" switch to forget. To stop being called, remove the number (the x in the field). A new number starts unverified.

How a call step rings​

  • A chain, not a blast. The step dials its people one at a time, one call a minute, until somebody takes the incident. For a step aimed at the whole workspace the order is the on-call person, then owners, admins, everyone else; for a role step it follows the roles as the step lists them.
  • Two calls per person. A call that is not answered (busy, no answer, a failed dial) is retried after two minutes while the chain moves on. A call that was answered but nobody pressed 1 or 2 waits five minutes before that person is rung again. Nobody gets more than two calls for one incident.
  • Waves. Critical incidents that reach a call step within five minutes of each other are folded into one wave: the call says how many incidents it is about, 1 takes them all on, 2 resolves them all. The two-calls limit counts per wave, so a storm of twenty incidents is still two calls per person at most.
  • Partial take-on pauses the chain. When a member acknowledges one incident of the wave from the console or Telegram, the chain stops ringing the others. If fifteen minutes later incidents of that wave are still unacknowledged, one reminder call goes to the person who took on ("N still open"); pressing 1 takes the rest. A later step of the ladder still fires: first to the person already involved, then to the step's people, within everybody's two calls.
  • A later step does not redial. People already called for this incident are not called again by the next step; only the new names join the chain (within their two calls).

Safeguards and limits​

  • Calls go only to numbers in supported regions, with premium-rate ranges blocked.
  • A workspace places at most ten calls per member per day; a call blocked by that cap is recorded with its reason in the incident timeline and the usage tab.
  • Answered calls are metered against your plan: a number of calls is included, and beyond it a euro limit per billing cycle that you set yourself in Billing (see Billing and plans). Owners are told at 80% and at 100% of the budget; at the limit calls stop and every other channel keeps going. For a workspace managed by an agency, the agency sets the limit.
  • A sudden burst of calls (a large share of the day's cap within an hour, or several blocked calls in a row) tells the owners early, and reaches us too. It never stops the calls by itself.
  • When the call route itself is failing, the owners get one note per half hour, over Telegram or e-mail, instead of silence.