Alerts & Escalation
How StackSpend generates alerts, routes them to the right people, escalates unresolved issues, and notifies your team via email and Slack.
Where alerts come from
Every alert in StackSpend originates from one of two sources:
| Source | When it fires | Learn more |
|---|---|---|
| Anomaly detection | After every sync. StackSpend compares the latest spend against a per-provider baseline and fires when the deviation is statistically significant. | Anomaly detection |
| Budget thresholds | When monthly spend for a provider crosses 50%, 80%, or 100% of its configured budget. | Budgets |
Alert severity
Anomaly alerts are assigned a severity level based on the how far spend deviated from the normal range and the absolute dollar impact. Budget alerts are assigned severity based on which threshold was crossed.
| Severity | Meaning |
|---|---|
| Low | Minor deviation from baseline — worth noting, unlikely to require immediate action. |
| Medium | Moderate deviation — review soon. |
| High | Significant deviation — investigate promptly. |
| Critical | Large deviation or 100% budget breach — act immediately. |
Alert lifecycle
Each alert moves through the following states. Team members can advance an alert manually from the Inbox.
| State | Description |
|---|---|
| New | Alert just fired. Appears in Inbox and triggers notifications. |
| Acknowledged | Someone has seen it and is looking into it. Stops escalation clock for owned alerts. |
| Resolved | Root cause identified and addressed. Removed from active Inbox and escalation lists. |
| False positive | The spike was expected (deployment, migration, etc.). Feeds back into baseline tuning. |
| Dismissed | Closed without action. Removed from Inbox and escalation lists. |
Who alerts go to
Alert routing in the Inbox depends on whether the alert has an assigned owner:
- Owned alerts — appear under "For you" in the owner's Inbox.
- Unowned alerts — appear under "Needs attention" for every workspace member so nothing falls through the cracks.
In addition to the Inbox, all alerts are broadcast to every configured notification channel (see Notification channels below).
Escalation
If an owned alert remains open (not resolved, not dismissed, not marked false positive) for more than 3 business days, StackSpend escalates it:
- The alert surfaces in every admin's Inbox under a dedicated "Escalated" section, marked with a shield icon.
- The original owner still sees it in their "For you" section — they are not removed from the loop.
- Weekends do not count toward the 3-day threshold. Only business days (Monday–Friday) are counted.
- Once the alert is resolved, dismissed, or marked as a false positive, it is removed from the escalated list for all admins.
Notification channels
Both anomaly and budget alerts trigger notifications through the channels you have configured:
| Channel | Routing | Configure in |
|---|---|---|
| Broadcast to all configured report recipients. | Settings → Daily report | |
| Slack | Broadcast to the connected Slack channel. | Settings → Integrations → Slack |