On-Call: Customer Communication Guide
Quick reference for on-call engineers during an active incident
1. Determine Severity​
| Severity | Definition | Examples | Response SLA |
|---|---|---|---|
| SEV-1 / Critical | Major outage. Multiple customers or core workflow blocked. | Platform down, auth failure, data pipeline stopped | Contact customer within 1 hour |
| SEV-2 / High | Significant degradation. Important workflow partially blocked. | Slow response times, partial failures, degraded output quality | Contact customer within 3 hours |
| SEV-3 / Moderate | Limited customer impact. Partial workaround available. | Edge case failures, cosmetic issues, non-critical feature degraded | Contact customer within 1 business day |
2. How to Contact the Customer​
Open the Pylon Customer Contact Info dashboard to find the customer's primary communication channel.
| Channel | How to use it | Notes |
|---|---|---|
| Grab address from the Email column in Pylon. CC: account owner, Alexander, Michael, and the dev owner. | Always CC all four parties listed. | |
| Mirror-Slack | Post in the mirror- channel and tag the customer's engineering and executive contacts. | Mirror channels are synced to the customer's Microsoft Teams. Anything you post is visible to them in real time. If you are not in the mirror-slack channel, search for it with the naming convention #mirror-[customerName] |
| Community Slack | Go to the Legion Security community workspace → find the client's external channel → post there. | This is a shared community space, not a private channel. |
3. How Issues Come In​
Pylon Agent (automatic)​
The Pylon agent monitors all customer Slack and Teams channels. When it detects a serious issue, it tags it as P0 and sends an alert to #critical-alerts, tagging @on-call. No action needed to receive these, just monitor #critical-alerts.
Customer-submitted (manual)​
Customers can submit urgent issues via: support.legionsecurity.ai/forms/report-an-issue
These also surface in #critical-alerts automatically, same as Pylon alerts.
Misclassified issue? Update the thread in #critical-alerts and notify the customer with the corrected severity.
4. Escalation Options​
- Back-up on-call engineer
- Escalate in incident.io