Alerts

Choose which members receive each alert by email, and post alerts to Slack, Microsoft Teams, Discord, Google Chat, PagerDuty or a signed webhook.

Path: Settings, Alerts (/settings/alerts).

	Free	Pro	Enterprise
Alerts by email, to the members you choose	Yes	Yes	Yes
Alert channels	No	Up to 10	Unlimited
Choose which alerts each channel takes	No	Yes	Yes
Send one project's alerts to its own channel	No	No	Yes

Plans.

Email

Rule	Behavior
Default	Every owner receives every alert
Who changes it	An owner. Other members see it, read only
Choice	Per member, per category: security, plan limits, billing
Floor	At least one member receives security alerts
Who we mail	Active members only

We send each alert as one email to every chosen member, so each recipient sees who else received it. We record each save as alert.recipients_updated in the audit log.

Mail addressed to one person, such as an invitation or a verification code, ignores this choice.

Channels

Channel	You provide	Create it
Slack	Add to Slack, then pick a channel. Or an incoming webhook URL	Slack incoming webhooks
Microsoft Teams	A Workflows webhook URL	Teams webhooks with Workflows
Discord	A channel webhook URL	Discord webhooks
Google Chat	A space webhook URL	Google Chat webhooks
PagerDuty	An Events API v2 integration key, US or EU. We open one incident per alert	PagerDuty Events API v2
Webhook	Any HTTPS URL. We sign each POST and show you the secret once	Verify a webhook

We refuse a URL that is not on that product's own webhook host. We encrypt the URL or key like your values (encryption in the cloud) and show you only the host or channel name.

Adding a channel needs org:update (roles) and a fresh step-up. Send a test posts a sample alert and shows you what the destination answered.

A new channel takes alerts from the moment you add it. We do not replay earlier ones.

Alerts by category

Category	Alerts
Security	Machine identity created or revoked; credential issued, revoked, drifted or used from two hosts; write-only turned off; an agent asked to reveal a value; keys overdue for rotation; SSO certificate expiring; domain no longer verified; member removed by your directory; encryption key unusable
Plan limits	A plan limit was reached
Billing	Payment failed; plan activated; subscription canceled

An alert carries a title, names and addresses, and a link to the console. It never carries a value or a key. We post a reveal request to channels only; every other alert is also emailed.

On Enterprise, pick a project when you add a channel. It takes that project's alerts: write-only turned off and reveal requests. Workspace alerts, such as billing and credentials, go to channels set to All projects.

Verify a webhook

We sign each POST per Standard Webhooks, with the audit stream's headers and verifier (verify a batch).

{
  "id": "0b8c1f2e-6a4d-4c3b-9e7f-1a2b3c4d5e6f",
  "type": "write-only-disabled",
  "createdAt": "2026-09-24T12:00:00.000Z",
  "organization": "Acme",
  "title": "Write-only was turned off",
  "lines": ["payments-api / production", "By ada@acme.test"],
  "severity": "critical",
  "url": "https://penv.cloud/projects/7d1f0b52-0d8c-4a53-9b1a-2f0c7b1e9a10",
  "projectId": "7d1f0b52-0d8c-4a53-9b1a-2f0c7b1e9a10"
}

Field	Value
`id`	Same on every retry of one alert
`severity`	`critical`, `warning` or `info`
`projectId`	Present only on project alerts

Retries

Destination answers	We
`2xx`	Mark it delivered
`408`, `429`, `5xx`, timeout, unreachable	Retry on the audit stream's schedule, up to 8 attempts
Other `4xx`, a redirect	Stop retrying that alert

After five days of continuous failure we stop the channel and show Stopped. Fix the destination, then press Resume. We do not post alerts from while it was stopped.