IncidentBot holds some of the most sensitive operational data a company has: who is on call and how to reach them, what broke, when, and what was said while it was broken. This page describes how access is controlled, how data is protected and stored, how paging stays reliable, and what your procurement and security teams receive when you buy the Enterprise plan.
| Time | Actor | Event |
|---|---|---|
| 09:12:40 | Workspace admin | SAML single sign-on enforced for all users |
| 09:20:05 | Workspace admin | Escalation policy checkout-api: tier 1 timeout 10 min to 5 min |
| 10:02:18 | SCIM | User deprovisioned, removed from Payments schedule |
| 14:12:30 | Comms | Status page update published: Checkout |
On Business and Enterprise, responders and stakeholders sign in through your identity provider with SAML single sign-on. You decide who gets in, you enforce your own multi-factor policy, and leaving the company in your directory means leaving IncidentBot.
SCIM keeps the user list in step with your directory. New engineers appear with the right team and role, and people who leave are deprovisioned without anyone opening a ticket. Group membership maps to teams, which is how on-call schedules stay accurate after a reorganisation.
Every plan separates responders (billed seats that can be on call and act on incidents) from stakeholder viewers (read-only, never billed). Enterprise adds advanced roles and permissions: who can edit a schedule, change an escalation policy, publish to a status page, export reports or manage integrations, scoped per team where you need it.
On Business and Enterprise, the audit log records who changed what and when: schedule edits, overrides, escalation policy changes, integration keys created or revoked, role changes, status page publications and workspace settings. Entries are read-only for everyone, including administrators, and export for your own review or your SIEM.
Security practice is described here in plain terms, because a questionnaire answer should match what the product does.
Alert payloads your monitoring tools send, on-call schedules and escalation policies, contact details used for paging (email, phone number for SMS and voice, mobile push tokens), incident records and timelines, status page content, postmortems and action items. In Slack, the bot reads messages only in the incident channels it creates or is invited to, so it can build the timeline. It does not read the rest of your workspace.
Enterprise customers choose where their workspace data is stored: in the United States or in the European Union. The choice is made when the workspace is set up and covers incident records, timelines, schedules, alert payloads and status page content.
By default, incident history is kept for as long as your subscription is active, because trends in incident tracking depend on it. Enterprise sets custom retention: alert payloads can be kept for a shorter period than incident records, and data past the window is deleted on schedule.
Paging is the part of incident management software that cannot fail quietly. Enterprise contracts include a 99.99 percent uptime SLA on paging, with service credits defined in the agreement.
Enterprise includes what procurement needs to sign.
SAML single sign-on and the audit log are included in Business and Enterprise. SCIM, advanced roles, data residency, custom retention and the paging SLA are on Enterprise. Every plan and price is on the pricing page.
Stakeholder viewers sign in through the same SSO and appear in the same audit log. They are read-only and are not billed as seats.
Yes. The incident simulator demo runs in your browser on a sample scenario and needs no account and no company data, so engineers can evaluate the workflow while the review runs.
Send it to [email protected] with the plan you are evaluating. The same address handles DPA requests and security questions.
Enterprise is 398 USD per user per month, or 199 USD billed annually, and starts by card on the pricing page. Send your questionnaire and DPA request to [email protected] and the answers come back by email.
Your work email and your team size. That is all we need to set up the account.
One price per seat for alerts, on-call, Slack incidents, status page and postmortems.