Pegel - Incident Management and Status Page for a Payroll SaaS

Dashboard, alerts inbox, incidents list, incident room and regulatory tracker. Every one of the 18 demo incidents opens its own room, with Timeline, Alerts, Updates, Tasks and Regulatory tabs.

Sev 1 needs a public update every 30 minutes and a commander, comms lead and scribe; Sev 2 every 60, Sev 3 every 120 and Sev 4 every 240 minutes. Each severity carries its own playbook checklist.

GDPR controller, GDPR processor notice, NIS2, DORA customer contracts and other contract notices, each case with its stages, due times and a countdown that is flagged under 12 hours and again under 4.

22 alerts from five monitoring sources, 12 report cases, 12 tenants, 10 components with 90-day uptime, 3 maintenance windows and 12 staff users.

Alerts Everywhere, Nobody in Charge

Datadog, Prometheus Alertmanager and PagerDuty each paged on their own, and one failing node pool could send dozens of near-identical alerts. There was no single place to see what was firing, who had acknowledged it and whether an incident had been declared.

Customers Asking Before They Were Told

Status updates were written by hand on a static page deployed from the platform that was failing. Around the month-end pay run, enterprise tenants phoned their account manager because nothing told them whether payroll would finish on time.

Reporting Duties That Depend on the Incident

A payslip shown to the wrong employer can be a GDPR personal data breach, where Kahlbergau as processor must tell each controller without undue delay. NIS2 sets 24-hour, 72-hour and one-month stages for significant incidents, and DORA contracts with banks and insurers set their own notice times per tenant.

Evidence Rebuilt After the Fact

After each incident someone pieced the timeline together from Slack. SLA credits against the 99.9% monthly availability promise were worked out in a spreadsheet at quarter end, and contract customers asking for proof of follow-up could not get it quickly.