Free
For a team's first rotation.
$0up to 5 responders
- Up to 5 responders
- One schedule and escalation policy
- Push and email paging
- Slack app with all four keys
- 30 days of history
No credit card.
Incident response and on-call for engineering teams
Four keys from page to postmortem.
Lull wakes the right engineer, opens the war room, runs your rollback and writes the first draft of the postmortem. Whoever is on call presses A, W, M and R. Then they go back to bed.
Free for up to 5 responders. No credit card.
INC-2417
checkout-api p99 latency 2.41 s
Paging you, primary on call
Firing.
Press A to take this page, or scroll down to the drill.
Your turn
Take the pager.
This is a real-shaped incident on a checkout service, and you are on call. Press the keys, or tap them.
Firing.
p99 latency above 2 s, error rate 4.1%
- You primary on call Paging
- Sam Ito secondary Wakes at 5:00
- Marco Diaz shipped 4f2a1c Not paged
- Lull is paging you by push, then SMS. If nobody answers in five minutes, it wakes your secondary.
- Acknowledged. The escalation timer stops, so Sam keeps sleeping, and #checkout hears that someone has it.
- War room open. Lull made #inc-2417, started a call and pulled in Marco Diaz, who merged 4f2a1c nine minutes before the alert.
- Rolled back. The service runbook reverted 4f2a1c through your deploy pipeline. p99 is back to 280 ms.
- Resolved. The status page is updated, the incident is closed and a postmortem draft is waiting for you.
Morning
Most incidents are not hard. They are slow. The page goes to someone who has never touched the service, the channel fills with people who did not ship the change, and the postmortem waits until Thursday. Lull takes out the waiting.
What teams see in the first quarter
2 min
median time from page to acknowledge
11 min
median time from page to mitigation
38%
fewer pages once duplicate alerts are grouped
1 day
from resolve to a reviewed postmortem
Illustrative figures for a fictional product. Nothing here was measured.
Standup
Three people have to say yes.
The engineer who carries the pager, the manager who owns the rotation and the CTO who signs the contract want different things from the same tool. Pick one.
Sleep through the noise.
- Grouped alerts. Twenty alerts from one bad deploy become one incident with twenty signals attached.
- Every action has a key. Acknowledge, open the war room, roll back and resolve from the keyboard, from Slack, or from your phone's lock screen.
- Runbooks that run. Attach a rollback, a feature-flag flip or a scale-up to a service, and M runs it after you confirm.
- Swaps in two taps. Trade a shift with a teammate without asking anyone to edit the schedule.
See who is carrying the pager.
- Load per person. Pages, night pages and hours awake for each engineer, week by week.
- Fair rotations. Follow-the-sun schedules, holidays, and a warning when one person lands on call twice in a month.
- Postmortems that get finished. Drafts assemble from the timeline, and action items go to Jira or Linear with an owner and a date.
- Handoff notes. The outgoing on-call writes three lines, and the incoming one reads them before the first page.
Know what broke and what it cost.
- Reliability by service. Incidents, minutes of impact and repeat causes for each service and team.
- Cost of downtime. Put a revenue-per-minute figure on a service and every incident report carries it.
- One audit trail. Every page, acknowledgement and rollback is logged with who did it and when.
- Spend you can predict. You pay per responder. Viewers and stakeholders are free.
Wiring
Alerts in. Fixes out.
Lull takes alerts from your monitoring, routes them by service owner, and acts through the tools your team already has open. Hover or tap a tool to see what it does here.
Alerts in
Monitors arrive as signals. Lull groups them by service and tags, then pages whoever owns that service tonight.
Alert rules post to Lull with their labels. Firing and resolved states stay in sync, so a recovered alert closes itself.
Point a receiver at Lull. Grouping and silences you already wrote in Alertmanager are respected.
A new issue spike opens an incident with the release that introduced it already attached.
Alarms come in through SNS. Lull maps each alarm to a service by its tags.
Anything that can send JSON can page someone. The schema is one page long.
Talk
The incident message carries all four actions as buttons, and #inc channels open and archive themselves.
The same four actions as adaptive cards, for teams that live in Teams.
W starts a bridge and posts the link in the war room channel.
Fix and record
Lull reads recent merges and deploys, so the war room invites whoever shipped last.
M can sync a service back to its previous healthy revision after you confirm.
Postmortem action items become tickets with an owner, a due date and a link back to the incident.
Inspecting
From Datadog
Monitors arrive as signals. Lull groups them by service and tags, then pages whoever owns that service tonight.
Integration names belong to their owners. This list is illustrative.
Security review
Ready for the audit as well as the outage.
Lull stores alert payloads, schedules and incident timelines. It does not need access to your production data, and it keeps no log contents unless someone attaches them to an incident.
- SSO with SAML or OIDC, and SCIM provisioning
- Roles per service: who can page, acknowledge, roll back, or only watch
- An audit log of every action, exportable to your SIEM
- Data stored in the EU or the US, encrypted at rest and in transit
- SOC 2 Type II report and a pen-test summary on request
When Slack is down, paging still works. Pages go out by push, SMS and voice from two regions on separate providers, and you can acknowledge by replying to the text.
Budget
Pay for the people who get paged.
Viewers and stakeholders are free on every plan.
Responders
Team plan, billed annually: $190 a month for 10 responders.
Most teams start here
Team
For teams with a real rotation.
$19per responder per month, billed annually
Everything in Free, plus:
- Unlimited schedules and escalation policies
- SMS and voice paging
- Runbooks and one-key rollback
- A public status page
- Postmortem drafts and action items
- One year of history
Business
For several teams and a security review.
$39per responder per month, billed annually
Everything in Team, plus:
- SSO, SCIM and audit log
- EU or US data residency
- Reliability and downtime-cost reports
- 99.95% uptime SLA
- Unlimited history
Over 200 responders, or need a relay inside your own network? We'll quote it. Talk to sales.
Cancel any time on monthly billing. Annual plans are refunded for unused months within the first 60 days.
| Feature | Free | Team | Business |
|---|---|---|---|
| Responders | Up to 5 | Unlimited | Unlimited |
| Viewers and stakeholders | Free | Free | Free |
| Paging | Push, email | Push, email, SMS, voice | Push, email, SMS, voice |
| Slack and Teams apps | Yes | Yes | Yes |
| Keyboard actions | Yes | Yes | Yes |
| Schedules and escalation | One | Unlimited | Unlimited |
| Runbooks and rollback | No | Yes | Yes |
| Status page | No | Public | Public and private |
| Postmortem drafts | No | Yes | Yes |
| Reliability and cost reports | No | No | Yes |
| SSO, SCIM, audit log | No | No | Yes |
| Data residency | US | US | EU or US |
| Uptime SLA | None | 99.9% | 99.95% |
| History | 30 days | 1 year | Unlimited |
| Support | Community | Email, next business day | Named contact, one-hour reply on SEV-1 |
Questions
Questions from the people who sign off
What counts as a responder?
Anyone who can be paged. People who only read incidents, follow the status page or get the weekly report are viewers, and viewers are free.
What if Slack, or Lull itself, goes down?
Paging does not depend on Slack. Push, SMS and voice go out from two regions on separate providers, and you can acknowledge by replying to the text. Our own status lives on a separate domain and provider.
Can we bring our current schedules?
Yes. Import schedules and escalation policies from a CSV or through the API, then run Lull next to your current pager for two weeks before you switch.
Do the keys work on a phone?
The four actions are buttons in the app and on the push notification, so you can acknowledge from the lock screen. In Slack they are buttons on the incident message.
Do we need runbooks before M does anything?
No. Without a runbook, M opens the last deploys for the service with a revert button beside each one. With a runbook, it runs the step you attached and asks you to confirm first.
Who writes the postmortem?
Your team does. Lull lays out a draft from the timeline: alerts, messages, deploys and graphs, in order. It leaves the cause and the action items for you to confirm, and it never names a person as the cause.
How long does setup take?
Connecting one alert source, one schedule and Slack usually takes an afternoon. Business plans include a guided setup call.
Quiet
Go back to sleep.
Connect one alert source and one schedule today, and the next page goes to the right person.
Free for up to 5 responders. No credit card.
- Postmortem for INC-2417 reviewed, 2 action items
- OPS-881 merged: connection pool back to 50
- Handoff note written for tonight's on-call
- Nothing firing
INC-2417
Resolved, postmortem filed
On call tonight: Sam Ito
Quiet.