Investigate production incidents with the evidence already in your systems.

Every claim traces back to one log line

This is a real screenshot of the running app — not a mockup. Seeded log events went through the actual ingestion → grouping → analysis pipeline shown below.

Incident detail — payment-svc

Incident detail — api-gateway same pipeline, different service

From first alert to resolved, not just the analysis screen

War rooms and on-call paging are live in the backend — Slack-linked, Twilio-paged, calendar-aware — they just don't have their own dashboard page yet, so they're shown here in the same design system rather than as live screenshots.

One log event, followed all the way through

Same eight stages every time. Here's real data going in and what comes out the other side.

{
  "serviceId": "payment-svc",
  "level": "ERROR",
  "message": "HikariPool-1 - Connection is
    not available, request timed out
    after 30000ms.",
  "timestamp": "2026-09-14T08:12:03.441Z"
}

{
  "title": "payment-svc: HikariCP
    connection pool exhausted",
  "severity": "CRITICAL",
  "status": "OPEN",
  "eventCount": 3,
  "confidenceScore": 0.58
}

• ingest — POST /api/v1/logs, API-key authenticated (SHA-256 hashed key), rate-limited per key.
• correlate / group — fingerprinted by service, alert name, and severity; repeat occurrences roll into the same incident instead of creating a new one.
• analyze — evidence is passed to the analysis engine, which returns a structured, evidence-cited result (summary, likely cause, confidence, unknowns, next checks). Secrets and tokens are masked before evidence is ever stored, regardless of which analysis backend handles the request.
• evidence / explain — the returned summary and likely cause are cross-checked against cited log evidence IDs before being shown.
• unknowns / next checks — missing metrics or traces are listed explicitly; suggested checks are read-only diagnostics only.

Where incidents get reported and resolved

What's built and shipped today.

What's actually enforced

Every claim below is something you can find and read in the source, not a compliance badge.

Usage limits, not guesswork

Limits are enforced per calendar month and reset automatically. What's below is what the system actually enforces.

Configurable log retention (up to 365 days) is available on every plan and purged automatically — it isn't a paid tier feature.