Standing service security-alert-paging-kept-running-all-hours-with-timings-reported · revised 12 October 2026
Standing service
Keep alert triage and paging running all hours, with the timings reported each month
Alerts from your named tools are sorted and serious ones paged to your on-call person at any hour, with each month's page times, misses and silent feeds reported. We fix nothing.
This starts a conversation by email. Nothing is charged, and nothing is run, until we have agreed scope, access and terms with you in writing.
The responsibility you hand over
Paging fails quietly: a forward is removed, a paging key expires, the on-call list goes stale or a tool changes its alert format. The first sign is a missed page. The monthly service runs the intake and paging all hours, measures every page, and reports each miss and silence.
Who it’s for: Owner or IT lead whose alerts are forwarded to the paging intake and who needs it to keep working and to see how fast it pages.
Usually starts when: The timed test passed, and from now on real alerts arrive at all hours.
The result: The intake sorts forwarded alerts all hours and pages serious or unsure alerts to your named people. The measured target is device receipt within 10 minutes of intake arrival, not a guarantee, with all late and missing pages reported. Daily canaries test the path, weekly agreed daytime pages test the device, and monthly reports list timings, misses and page-list changes.
What stays true, and what we do about it
Measured target, not a guarantee: a page reaches your on-call device within 10 minutes of intake arrival. Every late or missing page is reported; there is no fix-time promise. Service terms are agreed in writing before commitment.
The intake, sorting and paging run 24 hours a day, 7 days a week. No person on our side is on call, so if something breaks out of hours it is found by the health check and fixed when we are next working.
What must remain true
- Every serious or unsure intake alert has a recorded device-receipt time or a recorded missing page; the measured 10-minute target is not guaranteed and every miss is reported
- Anything unsure is paged, never ignored
- A silent tool and a stopped intake are each paged or emailed
What we watch
- Alerts forwarded from up to three of your tools
- The page list and routine rules you approved
- The canary, drill and health-check logs
When something happens
Scroll the table sideways to read it all.
| When | What we do |
|---|---|
| A serious alert reaches the intake. | Your on-call person is paged, and the backup is paged if nobody acknowledges within the limit you set. |
| A tool sends nothing for its silence limit. | We page a feed-silent alert to your on-call person. Linked job: All-hours alert triage and paging |
| The intake or the paging channel fails a check. | The health check emails your named owner and the failure is first in the next report. |
We do on our own
- Sort forwarded alerts and page your on-call person under your page list
- Run the canary, the drill and the health check
- Propose page-list changes for your approval
We ask you first
- Any change to the page list, routine rules or on-call chain
- Any wider access to your tools
- Any action other than approved paging, health-check notices and reporting
We escalate to you when
- A serious alert was not paged within the target
- A tool has been silent past its limit
- The same miss appears two months running
How you know it held. Each month the report states alerts received by class, pages sent, median, 95th percentile and longest intake-to-device receipt time, every late or missing page, every silence, drill and canary results and intake downtime, with unknowns kept.
How we keep it true
This service is never finished. Each month's report shows whether the thing it watches stayed true, and it continues until you end it.
Test all-hours security triage and paging: measured 10-minute target, not a guarantee Job Optional
Set up automated triage for up to three alert tools and test paging to your named on-call person against a measured 10-minute intake-to-device target, not a guarantee. We investigate and fix nothing.
Bought separately, each time it is needed; not part of the monthly fee
What is included, and what is not
- Monthly timing report
- List of misses and silences
- Page-list change proposals
- Updated list of what is and is not watched
Included
- Up to 3 tools and 200 alerts a day
- The intake, sorting and paging running 24 hours a day, 7 days a week
- A daily canary through the full path to a test sink, and a weekly daytime drill page to your on-call device at a time you set
- A feed-silent page per tool and an intake health check to your named owner
- A monthly report of every page time, miss, silence and acknowledgement
Not included
- Watching anything that is not forwarded to the intake
- Investigating, containing, blocking or fixing anything
- A person on our side being awake or on call
- A promised fix time or detection rate
- Incident response or forensics
- Any certification promise
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
Every serious or unsure alert in the month has an intake timestamp and either a device-receipt timestamp or a missing-page entry. Each miss of the measured 10-minute intake-to-device target, not a guarantee, is listed with its cause; omitting any late or missing page fails this reporting check.
Evidence: The send and device logs.
Each month the daily canary reached the test sink every day, the weekly drill page reached your device, and a held-silent test feed triggered its page.
Evidence: The canary, drill and silence logs.
Each month the frozen test pack is re-run and every previously passing case still meets its agreed check. A regression fails this check even if reported, and the report lists it first with its cause.
Evidence: The monthly test report.
Nothing was changed in any of your tools by us, and no alert was closed, muted or edited.
Evidence: Your own audit logs for the month.
Before changed triage settings are accepted, all 20 new serious alerts you hold back until the run must page the test device within the measured 10-minute target. A late or missing page fails this smoke test; the target is not a live-service guarantee.
Evidence: Buyer-held alert labels, intake/device timestamps and rerun steps.
Sign-off. You read the report and test results and accept or send them back in writing. A month counts as delivered only when its agreed acceptance checks pass; receiving a report alone is not acceptance.
If it fails. If we cannot run a month because an input is missing or has changed shape, we say so, explain what we need and do not guess. If the service is not working for you, you can end it at the end of any month.
When it fits, and when we stop
It fits when
- The matching one-off set-up and timed test are done, or an equivalent intake with a passed test exists
- The on-call chain and the paging key are kept current by you
- A named owner who reads each report and receives health-check emails
We stop and tell you if
- Nobody can be named to take a page
- You expect investigation, containment or a fix time
- Nobody reads the monthly report for two months running
- The paging key lapses and is not renewed
What could go wrong
On cancellation we stop the intake and paging on the agreed date; you can also pause it or revoke the paging key yourself. You keep the reports and settings, but continuing operation after cancellation is not included. Your alert tools themselves are unchanged.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| The service is read as security cover. | The page and the agreement list what is watched and not watched, that nobody on our side is awake, and that nothing is investigated or fixed. |
| A page is late or lost. | Every page is timed, the canary and drill test the path, the health check watches the intake, and each miss is reported. |
| Text inside a document, record or message tries to give the automation instructions. | All input text is data. The automation has no tool to send, approve, file or change anything beyond what is listed here, and planted-instruction items must change nothing. |
| Real documents or records pass through a model provider. | First tests use invented, synthetic or redacted data. Real data moves only after a written agreement names the model provider, its country, how long it keeps data and whether it trains on it. |
A separate automated reviewer checks each month's report against the logs before it is sent. Your named on-call person decides and acts on every page. No person on our side is on call, no human supervisor is included unless your agreement names one, and at launch the work is largely automated.
Stays with a person
- Your named on-call person decides and acts on every page
- You approve the page list and hold the pause
Access we would need
- Forwarded alerts, your revocable send-only paging key and the independent health-check email route approved by you
- No access to your tools, accounts or systems
Questions
Is it a security operations centre?
No. It sorts the alerts you forward and pages your named person. Nobody on our side investigates or responds.
What if you miss the 10-minute target?
Every late or missing page is reported with its cause. The 10-minute intake-to-device figure is a measured target, not a guarantee; no fix time is promised.
Also part of
Send an enquiry
Send us
- The tools, daily alert volume and on-call chain
- Who receives the report. No alert content in the first enquiry
Later, once you agree
- Your forwards, a revocable send-only paging key and an approved independent health-check email route to your named owner; test contacts are nominated by you
- Your approved page list and routine rules; 20 fresh serious test alerts held back until the run before any changed triage workflow is accepted
- The weekly drill time and a named owner
You keep your tools, accounts and every action. We receive forwarded alerts and use your revocable send-only paging key and approved independent health-check email route, with no access to your alert tools or systems. Alert text is data, never instructions.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “security-alert-paging-kept-running-all-hours-with-timings-reported” as the subject.