Call-out alerting and escalation

When the call-out comes at 3am, the phone has to actually ring.

AlertRoster was built for search and rescue teams. It knows who is on the roster tonight, wakes them, and keeps going down the list until someone answers — so a team mobilises while it still matters, not when somebody happens to check their phone in the morning.

The same roster and escalation runs critical infrastructure up/down alerting, for the on-call engineer who has to be woken when a site goes dark.

Call-out alerting from Cloud Bedrock. Not an emergency service or alarm equipment — read what that means .

Incident

DB-02 stopped checking in

Escalating
  1. 00:00 Heartbeat missed. Alert raised against the Platform roster.
  2. 00:00 Notified Dana Whitfield, primary on call — phone and workstation.
  3. 02:00 No acknowledgement. Policy advanced to the secondary.
  4. 02:00 Notified Marcus Ellery, and engaged site alerting in Bay 3.
  5. 03:12 Acknowledged by Marcus Ellery. Escalation stopped.

Illustrative example. Timings come from the escalation policy you configure.

Built for search and rescue. Useful for anyone who runs a call-out.

The pattern is always the same — a roster of people who have agreed to be reachable, an event that needs them now, and a window that closes.

Search and rescue

Land, mountain, cave, swiftwater, and K9 teams. The reason AlertRoster exists, and the use case everything else was shaped around.

Volunteer fire and rescue

Retained and volunteer crews who need a turnout count before the appliance leaves the station.

Coastal and water rescue

Lifeboat crews, surf rescue, and swiftwater teams working to a tide and a daylight window.

Ski patrol and avalanche

Pre-dawn control work and in-bounds incidents, where the roster changes daily with conditions.

Community response teams

Flood, storm, and disaster relief volunteers who mobilise on short notice and stand down just as fast.

On-call clinical and veterinary

Rotas where a specific person has to be reached, not a general inbox somebody will read eventually.

Utility and restoration crews

Line crews and field techs called out to restore service, often to a site that has gone quiet.

IT and infrastructure on-call

Up/down and heartbeat alerting for the engineer responsible when production fails unattended at 02:00.

What it actually does

One roster, one escalation policy, and every channel that gets a person's attention.

On-call schedules and rotations

Who is responsible, and when. Rotations, handoffs, and overrides live in one roster your team can read without asking anyone.

Escalation policies

If nobody acknowledges, the alert moves to the next person on the policy. It keeps going until someone takes it.

Heartbeat and absence detection

Dead-man's-switch monitoring. When a system that should check in every minute goes quiet, that silence becomes the alert.

Phone, desktop, and the room

A native iOS app, desktop workstations, and on-premise audible and visual alerting hardware at the site itself.

Not alarm equipment — what that means .

Acknowledgement you can go back and read

Who was notified, on which channel, at what time, and who finally acknowledged — recorded per incident.

Tenant isolation, enforced by the database

Separation between organizations is designed as a Postgres row-level security boundary rather than an application-layer convention. The policies land with the first domain migration.

How it works

Four steps, and the fourth one repeats until it doesn't have to.

  1. 1

    An event arrives

    From your monitoring, or from a heartbeat that stopped arriving.

  2. 2

    The roster decides who

    The schedule says who is on call right now. No group chat, no guessing.

  3. 3

    They get notified

    On every channel you have configured for them, at once.

  4. 4

    It escalates, or it stops

    An acknowledgement ends it. Silence moves it to the next person on the policy.

Make the room aware, not just the phone

A phone in a pocket, on a loud floor, in a Focus mode, is a single point of failure for getting someone's attention. AlertRoster can drive on-premise audible and visual alerting hardware at the site, so an unacknowledged alert becomes something people in the space can hear and see.

We supply the software that commands that hardware. We do not manufacture, install, or maintain it.

What AlertRoster is not

AlertRoster is a call-out notification and escalation tool. It notifies people who have agreed in advance to be notified, and records what happened.

It is not an emergency service and does not contact one on your behalf. It is not a fire alarm, a security alarm, or an alarm monitoring service, and it holds no life-safety certification. It is not a replacement for your team's official paging arrangements, and it should not be the only way a call-out can reach your people.

What we will and won't say about delivery

Alerting products are usually sold on promises nobody can keep. Here is the honest version.

Alerts are delivered on a best-effort basis over networks we do not own: Apple's push infrastructure, carrier networks, the public internet, and your own LAN and hardware.

Device settings — Do Not Disturb, Focus modes, silent mode, notification permissions, low power mode — can suppress or delay an alert. That is why the on-site channel exists.

The critical-alert capability on iOS, where available, requires an Apple entitlement and your explicit authorization. Where it is not available, alerts arrive as high-priority time-sensitive notifications, which do not bypass all device silencing.

We do not claim any alert is guaranteed to arrive, to arrive within a stated time, or to override a device's settings.

There is no uptime or delivery SLA today. When there is one, it will be a contractual number rather than a sentence on a marketing page.

We hold no security or privacy certification at this time, and will name the specific audit when we do.

Under the hood

Specifics, because "enterprise-grade" is not a specification.

Elixir and Phoenix on the BEAM
A runtime built for large numbers of concurrent, isolated processes — which is what a fan-out of notifications is.
Every notification is a durable job
Notifications run through a Postgres-backed queue, so each attempt is recorded, retried on failure, and inspectable afterwards.
More than one node, clustered
The application can run across multiple clustered nodes that share queue state, so a node being replaced does not take the queue with it.
Health-checked rolling deploys
New versions roll out behind health checks, and traffic reaches the app over TLS.

Put a name on every alert

AlertRoster is being rolled out with a small number of teams. If your operation has someone on call tonight, we would like to hear how it currently works.