Documentation
Security
A pager holds the keys to waking your people up, so you should know exactly how it is protected. This page is written so that you can check it.
Where it runs and where the data is
IgniteOps runs on AWS in the United States. Your data (organizations, members, alerts, schedules, policies, rules, keys and notification settings) is stored in managed databases, encrypted at rest with keys managed by AWS KMS. Every connection, from a browser, an app or a monitoring tool, is TLS.
Phone calls and SMS are placed through Twilio, push notifications through Apple and Google, email through Amazon SES, and card payments are handled by Stripe: IgniteOps never sees or stores a card number.
Signing in
There are no passwords. Signing in sends a one-time code to your email address, and the session lives in the browser or the app. The mobile app can lock itself behind the phone’s biometrics after a grace period you choose.
Credentials and what they can do
| Credential | Can | Cannot | Lifetime |
|---|---|---|---|
| Integration key (ign_…) | Create alerts for its one team. | Read anything, change anything, reach another team. | 1 day to a year, or none. Revoked or reissued at any time, and the old secret stops at once. |
| Personal API key (PAT) | Everything its owner may do on organizations and teams. | Change the owner’s own notification methods, devices or keys, redirect where its owner is paged, or mint more keys. | 1 to 3,650 days, or none. Revoked at any time. |
| Session token | Everything the person may do. | Short-lived, refreshed while the session is active. |
- Secrets are shown once, at creation, and stored hashed.
- The URL of a webhook or Slack escalation step is treated as a secret: it is returned in full only to the people who may edit the policy and masked for everyone else.
Access control
Every API request passes through one authorizer that evaluates a policy (written in Rego and run as OPA WebAssembly) against the caller’s organization role, team role and plan before any handler runs. Business logic never decides who may do what. The policy does. The roles and the matrix are on the teams and roles page. Every change to an alert, and every notification sent, is recorded on that alert’s timeline with who did it and from where.
Your data
- Deleting an organization deletes its alerts, configuration, keys and billing records. The dialog says what goes.
- Deleting an account schedules it for deletion with a 30-day grace period during which it can be restored. Organizations the account owns go with it unless ownership is transferred first.
- You can also ask for deletion from the data deletion page, and the privacy policy lists what is collected and for how long.
- Schedules export as .ics, and everything else is readable through the API, so your configuration is never locked in.
Reporting a problem
Write to [email protected] with what you found. We answer every report, we do not pursue researchers who act in good faith and keep the data they came across to themselves, and we credit a finding publicly if you want us to.
Checked against the product on November 8, 2026.