Incident Management Platform  ·  View 15 of 34  ·  4 · Data

Incidents, Coverage and Evidence — Data Model

Thirteen entities across alerting, response, scheduling and evidence, with the keys that make ingest idempotent, coverage one lookup and the timeline tamper-evident.

Editable source SVG draw.io All views
integration integration_id PK owner_team quota_per_s secret_ref two active mapping_version alert alert_id PK integration_id FK source_key, fingerprint proposed_severity source_ts, received_ts raw_ref 90 d review review_id PK incident_id FK contributing_factors system_conditions due_at 5 business days state action_item action_id PK review_id FK owner_team, due_at tracker_ref state closed_with_change service service_id PK owner_team policy_id FK runbook_url depends_on incident incident_id PK service_id FK grouping_key state, severity acked_at, mitigated_at resolved_at restricted bool incident_event event_id PK idempotent incident_id FK seq, received_ts type, actor payload prev_hash, hash escalation_policy policy_id, version PK steps targets, wait_s final_step NOT NULL channel_policy notification_attempt attempt_id PK incident_id, step channel, provider provider_msg_id dispatched_at, outcome acked_at, cost contact_method method_id PK responder_id type push|sms|voice|email address encrypted verified_at rotation rotation_id PK iana_zone owner_team handoff_local_time coverage_bucket rotation_id, bucket_utc PK layers ordered method_ids verified only snapshot_version verified_by both resolvers schedule_layer layer_id PK rotation_id FK kind base|secondary|mgmt|override rule or window changed_by, changed_at 1 : N N : 1 1 : N 1 : N cites 1 : N 1 : N 1 : N N : 1 N : M 1 : N N : M 1 : N Incidents, Coverage and Evidence — Data Model incident is a projection of incident_event. contact_method.address is encrypted under a per-responder key; the event log holds only responder ids. v 1.0 · owner Reliability Architecture · date 2026-09

Decisions

  • incident_event carries its own idempotent id, a per-incident sequence and the hash of the previous event. The reconciler can replay the outbox twice without duplicating an event, and any edit to history breaks the chain visibly.
  • coverage_bucket is keyed by rotation and a 15-minute UTC bucket. Paging resolves who is on call with one key read regardless of how many layers and overrides produced the answer.
  • escalation_policy is versioned, and every notification attempt records the version it ran under, so a policy edited during an incident does not change what the timeline says happened.

Personal data

  • contact_method.address is encrypted under a key specific to that responder. The event log refers to responders by id only. Deleting the key on offboarding makes every stored copy of the address unreadable without mutating the immutable log (ADR-28).

Deliberately absent

  • An individual attribution field on review, and a free-form 'root cause' field. Contributing factors are plural by design.
◀  Four Stores, Separated by What May Be Lost and What Must Be Fast All views Alert Ingest — Untrusted In, Normalised Out, Nothing Lost  ▶
Solution Architecture v1.0 · Reliability Architecture · 2026-09 · 34 views · open source, fully on-premises15-data-model