Monitoring you
can actually trust

The tools meant to tell us when things break were the least trustworthy things we ran. False alarms trained whole teams to ignore their pagers, the one outcome a monitoring product must never cause.

So we built the opposite. Every check runs from several regions, and an incident opens only when enough of them agree on a failure within a short window. A single flaky region cannot wake you up, and a genuinely down service still pages you in seconds.

Everything else follows from that idea: bundled on-call, status pages, and programmable alerts, all hanging off one boring, observable Postgres pipeline that is easy to operate and hard to surprise.