Incident timelines, on-call pages and postmortems from a cloud SaaS

Summary

Every production incident at one infrastructure SaaS company over eight years: the alerts that fired, who was paged, the incident channel conversation minute by minute, and the written postmortem with action items. 1,960 incidents have full postmortems with root cause and contributing factors. Hostnames, IP addresses, customer names and staff identities are replaced with consistent placeholders.

Collected to order. We collect it from US companies for your order. Scope, volume and timing are confirmed in writing before you sign.

Pricing on request

Request scope and pricing

At a glance

Planned scope. Volume, sources and timing are confirmed in writing before you sign.

Records: 14Kincidents with timelines
Size: 1.4 GB
Tokens, estimated: 110M
Years: 2018 to 2026
Firms: 1

Owner profile: US infrastructure software company running a hosted data platform for mid-market and enterprise customers, 300 to 500 staff
Industry: Software
Data type: Company operations archive
Headcount: 300 to 500 staff
Region: United States
Languages: English
Formats: JSONL, Parquet
Updated: 2026-09-27

Sources

System	Kind	Records
PagerDuty	Support tickets	14,280 incidents, 611K alerts
Slack public channels	Team chat	1.9M incident channel messages
Confluence	Projects and wiki	1,960 postmortems
Jira	Projects and wiki	11.4K follow-up action items

Good for

training SRE agents to summarize a live incident channel and propose next steps
evaluating root cause reasoning against the postmortem the team actually wrote
learning which alerts turn into real incidents and which are noise
drafting postmortems from raw timelines and scoring them against the final document

Fields

Field	Type	Description
incident_id	string	De-identified incident id
severity	enum	SEV1 to SEV4
opened_at	timestamp	When the first page went out
resolved_at	timestamp	When the incident was marked resolved
services	array<string>	Affected services
timeline	array<object>	Channel messages and status updates in order, with timestamp and text
root_cause	string	Root cause from the postmortem, null if none was written
action_items	array<string>	Follow-up actions filed after the incident
customer_impact	string	Impact statement as published to customers

Example record

{
  "incident_id": "INC-20250219-03",
  "severity": "SEV2",
  "opened_at": "2025-02-19T03:04:18Z",
  "resolved_at": "2025-02-19T04:47:51Z",
  "services": [
    "query-api"
  ],
  "timeline": [
    {
      "at": "2025-02-19T03:12:40Z",
      "text": "[PERSON_9] (incident lead): p99 on query-api is 14s and climbing. Replica lag on [HOST_3] is 9 minutes. Pausing the backfill job."
    },
    {
      "at": "2025-02-19T03:31:05Z",
      "text": "[PERSON_4]: Lag back under 2s since the backfill paused. Writes healthy. Holding the incident open until the morning batch passes."
    }
  ],
  "root_cause": "A schema backfill ran without a rate limit and saturated WAL replay on the read replicas, so API reads served data up to 9 minutes stale.",
  "action_items": [
    "Add a rate limit to the backfill runner",
    "Page on replica lag above 60s instead of 300s"
  ],
  "customer_impact": "Some dashboards showed data up to 9 minutes old for 1 hour 43 minutes. No data was lost."
}

One record, de-identified. Placeholders such as [PERSON_12] and [COMPANY_4] stay the same across the whole dataset, so threads still read correctly.

Licenses available

Exclusive
One buyer. Nobody else can license it during the exclusive term, usually 2 years.
Non-exclusive
Licensed to more than one buyer.
First look
One buyer gets 2 to 4 weeks to make an offer before anyone else sees the dataset.

What ships with it

Datasheet: what it is, what it is good for, verified size, sources, years, format and limits.
Provenance file: the owner shown by code, staff notice and consent status, exclusions, mapped to the EU AI Act Article 53 training-data summary and California AB 2013.
Manifest with a hash for every file.
QC report and de-identification report.
Your own copy, with unique canary records.

How it is de-identified

Default exclusions removed, files flattened to text, identifiers found in three layers and replaced with consistent placeholders, and the result measured against a 99% bar for each identifier type in each source.

The full method