Pages go to incident.io
If it needs a human right now, it should open an incident, not post into a channel and hope somebody sees it.
Formerly Alerts Gateway. Same door, bigger bouncer.
Not every ping
Not every ping
gets in.
Ping Bouncer is the doorman between your alert sources and your people. Point every webhook and alert email at one door, write the house rules, and only the pings that matter get past the rope.
For SREs, DevOps and Security engineers who are tired of #alerts-prod-2.
The line
incident.io
VIP entrance. Pages only.
Linear
Side door. Real, not urgent.
Archive
The curb. Still searchable.
0 checked
0% never buzzed a phone
The problem
Your alerts channel is a nightclub with no door.
Every tool you own ships a Slack integration. None of them ship judgement. So the page that mattered at 03:12 is wedged between a staging CPU warning, a vendor status email and the same flapping monitor for the seventeenth time, in a channel half the team muted months ago.
- #alerts, #alerts-prod, #alerts-prod-2, #alerts-real
- A shared inbox that belongs to everyone, so it belongs to no one
- Routing logic spread across nine vendors' settings pages
- @channel. At 3am. For a warning.
# alerts-prod-2
4,812 unread
muted by 38 people
somewhere in here is a real outage ↑
How it works
One door. House rules. Right room.
-
1
Point everything at one door
Each workspace gets one webhook URL and one email address. Datadog, CloudWatch, Grafana, Alertmanager, Sentry, Vanta, status pages and the uptime monitor that can only send email all knock on the same door.
POST https://in.pingbouncer.com/v1/ep_7q…/••••••
MAIL your-team+statuspage@alerts.pingbouncer.com -
2
Write the house rules
Workflows shape every alert in order: label it, rewrite it, filter it, rate limit it, group the repeats. Then routes decide where it goes. Test your rules on real payloads before anything goes live.
LabelCustomizeFilterRate limitGroupRoute -
3
Send each ping to the right room
Pages go where people get woken up. Real work becomes a ticket someone owns. Noise goes to the archive, where you can still search it. Any destination, or your own HTTPS endpoint.
incident.ioLinearPagerDutyJiraSlackYour endpoint
House rules
Workflows that fit how your team actually works.
Every team's noise is different. Pick one and see how Max handles its night.
workflow prod-infra Datadog · Grafana · Alertmanager
- filter drop when env is
staging
- label team =
{{payload.tags.service}} - group by
{{alert.title}}for 30m - rate limit 3 per 10m per
{{labels.team}}
severity = critical & status = firing→incident.io
status = resolved→Archive
everything else→Linear · team from label
A typical night at the door (illustrative)
1,200 pings never touched a phone.
workflow security-findings Vanta · Oneleet · CloudWatch via SNS
- label domain =
security
, owner ={{payload.owner}} - customize severity from
{{payload.finding.severity}} - filter drop when severity is
informational
- group by
{{payload.control}}for 24h
source = GuardDuty & severity = critical→incident.io
labels.domain = security→Linear · SEC
compliance deadline→Jira · GRC
A typical week at the door (illustrative)
Two real incidents. Zero missed.
workflow vendor-status Email · status pages · uptime monitors
- filter drop when subject contains
digest
- label vendor =
{{labels.from_domain}} - group by
{{labels.vendor}}for 2h - rate limit 1 per hour per
{{labels.vendor}}
status = resolved→Archive
vendor in payments, auth→Linear · Platform
everything else→Slack #vendor-status
A typical week at the door (illustrative)
Nobody paged for a vendor's bad day.
Strong opinions, loosely held
Our defaults are pretty strict.
Yours can be anything.
Everything else goes to Linear
Real but not urgent means a ticket with an owner and a team, not a Slack message nobody gets to.
Noise goes to the archive
Resolved, staging, FYI and duplicates go to the archive. Nobody gets notified, and you can still search them in the events log.
Slack? Sure, if you insist.
It's a perfectly good destination. It just shouldn't be the only place alerts end up. Route what belongs there, and nothing else.
Don't like our taste? Every route is yours to rewrite. ✎
Single purpose, on purpose
We do one thing.
Ping Bouncer isn't here to replace your stack. Keep Datadog. Keep PagerDuty. Keep your SIEM, your status pages and your incident process. We just work the door between all of them and your people.
An observability platformAn incident managerAn on-call schedulerA SIEMAnother tab to keep open- ✓ The door between your alerts and your team
Built by people who read raw payloads
Everything you'd want from the door.
Knows who's knocking
Built-in types for Datadog, CloudWatch, SNS, Grafana, Alertmanager, Sentry, Vanta, Oneleet and email. Unknown payloads show up as shapes you can name as your own event types.
Rules tested on real payloads
The workflow editor runs your rules over recent real events as you edit. Click a field to turn it into a filter, label or route, and see per-step counts before you save.
Drafts and staged releases
Changes are drafts until you publish. Releases roll out 10% → 50% → 100%, the error rate is watched, and a bad release rolls itself back.
An events log you can actually query
Every request, including the ones Max turned away. Drag across the histogram to zoom, and get suggestions as you type.
⌕ schema:datadog -outcome:filtered "disk full"
Your own endpoint, your own code
Custom destinations run your JavaScript for each alert in a sandbox that can only call the HTTPS hosts you allow. Sign a webhook, post to Discord, do whatever your team needs.
export default {
async deliver(alert, ctx) {
await fetch(ctx.settings.url, {
method: "POST",
body: JSON.stringify(alert),
});
return ctx.delivered();
},
};Add now, set up later
Route to a destination before anyone has its credentials. Send a single-use setup link to whoever holds the keys, and they fill in only the fields you ask for.
No late pages, ever
If a delivery can't go out, it's recorded as skipped, with the reason. It never gets replayed hours later, because a late page does more harm than none.
Your own worker
Each workspace's events run in its own isolated Cloudflare Worker, built from its own published settings. It runs on the edge, close to wherever your alerts come from.
Integrations
Lets in pings from anywhere. Sends them anywhere.
Knocking at the door
Datadog
CloudWatch
Amazon SNS
Grafana
Alertmanager
Sentry
Vanta
Oneleet- Any email
- Any JSON webhook
Shown to the right room
- incident.io
- Linear
- PagerDuty
Jira- Slack
- Datadog
- Your HTTPS endpoint
- Archive
Meet Max
Head of Door. Employee of the month, every month.
Max has worked the door at every noisy club in town. Now he works yours. He's polite, he's consistent, and he has never once said “it's probably fine.”
- Height
- 6′5″, plus the attitude
- Pings checked
- All of them
- Pages let through
- Only the real ones
- Catchphrase
- “Not tonight.”
- Likes
- Dedupe, quiet on-call weeks, clipboards
- Dislikes
- @channel, flapping monitors, “FYI” at 3am
Questions at the door
FAQ
Is this another incident management tool?
No. Ping Bouncer decides which alerts reach your incident tool, your tracker and your channels, and where they land. It doesn't run incidents, schedules or status pages. Keep the tools you have. Max just works the door in front of them.
Do I have to rip out PagerDuty, Opsgenie or my Slack alerts?
No. Point your sources at Ping Bouncer instead of straight at the channel or the pager, and route to whatever you already use. You can move one source at a time.
What if my tool isn't in the list?
If it can send a JSON webhook or an email, it can knock. Payloads Ping Bouncer doesn't recognise show up as shapes you can name, and they become custom event types with their own labels and routes.
Can I send alerts to my own systems?
Yes. Custom code destinations run your JavaScript for each alert, in a sandbox that can only reach the HTTPS hosts you list. There are templates for a signed webhook to your own endpoint and for Discord.
What happens if a destination is down or not set up yet?
The delivery is recorded as skipped, with the reason, and you can see it in the events log. It's never replayed later, because a page that arrives hours late does more harm than good.
Where does it run?
On Cloudflare. Every workspace's events are processed by that workspace's own worker, built from its own published settings. A team that needs harder separation can create another workspace.
Wasn't this called Alerts Gateway?
It was. Same product, same one-door idea, new name, and now it has a bouncer. Existing workspaces, webhook URLs and email addresses keep working.
Your on-call deserves a quiet night.
Point one source at the door tonight. Max will take it from there.