Rotations built to your pattern. Coverage you can prove to a client. A fairness ledger an analyst can take apart. Handover that survives the gap between shifts — and between offices. Every client’s coverage measured across every office that serves it.
A settled SOC rotation is a pattern, not a puzzle to re-solve every four weeks. Describe yours once and you extend it as far ahead as you need, in one action, whenever you want more of it. The recurring afternoon that used to disappear into a spreadsheet does not come back.
Everyone rotates on the pattern you gave them. After that the only thing you touch by hand is the exception: approved leave is never written over, and anyone who never rotates stays pinned in place.
Finding out who’s on call tonight, whether next week has a coverage gap, or how this month’s fairness numbers landed used to mean opening the right screen yourself. A chat panel sits over every page in the dashboard, one click away, and answers from your own rota in plain language.
It only reads. The assistant can see schedules, rosters, leave, swaps, holidays, handover notes, fairness and coverage — never assign a shift, approve a request, or change a setting, and it says so if you ask it to. Every answer runs through the same permission checks as the rest of the product and stays inside your organisation, and your conversations are saved privately so you can pick one back up later.
Nobody has to hold the rotation in their head to answer a request. Leave arrives with the shifts it empties, the coverage it costs and the colleagues who could genuinely take them. Swaps arrive with the rest check already done. What reaches a manager is a decision, which is why it can be made in the thirty seconds it deserves instead of deferred to the end of the week.
Leave covers half days, multi-day stretches and recurring absences, and you pick who covers the shift while you approve it rather than as a separate job afterwards. People who cannot take it are still listed, with the reason why. A swap can go straight to a colleague or onto an open board for anyone free to claim, and a manager who lets one through against the rest rules leaves that on the record.
Every analyst can see their own position, the team average, and the arithmetic that produced both. That is what makes the answer hold when somebody disputes it, and disputing it is the point: a fairness number nobody can take apart is a black box, and a black box that ranks colleagues against each other is one people are right not to trust. Managers get the same page, so the conversation starts from shared evidence rather than from whoever remembers last Christmas most vividly.
Nights, evenings, weekends and holidays are worth what you decide they are worth, and a weekend night on a public holiday counts as all three. Every total comes apart into the shift itself, the weekend that fell on it, and the holiday on top of that. Look at the last 30 days or the last year, because an imbalance that shows up over a month but not over a year is a new one. Anyone who does not rotate is listed with the reason rather than quietly dropped from the average.
A client handed between offices is covered for real, not on paper. Each office keeps its own clock and its own people, but the coverage they add up to is a single picture, so the two hours nobody is watching stop being something you learn about from the customer. A nightly sweep tells the managers at both ends of a broken hand-off, which means the first person to know is someone who can fix it.
Each office keeps its own list of clients — the SLA you promised, the offices that cover them, the order they pick them up in — and the gaps and overlaps in a chain are shown to you before you save it. Schedules belong to the offices rather than to the clients, so handing a client on changes who serves it instead of leaving you a second copy to keep in step. When the client asks whether you met the SLA, the answer is a link they open without a login, showing the same figures your own coverage screen does.
Open incidents, live hunts and the thing that will page someone at 03:00 are written down before anyone clocks off, and they are waiting on screen when the next analyst logs in. Nobody has to work out at 04:00 whether the alert in front of them is already being handled. Where a client moves between offices, the note moves with it, so the office picking it up inherits the context instead of starting cold.
There are fields for open incidents, hunts and escalations, or a form you build yourself, and you decide who owes the handover for each shift — a reminder reaches that person half an hour before they finish. The next shift marks it as read, and their name and the time stay on it; only the shift actually taking over can do that, so the record means what it says. Where several offices cover one client, one trip around the chain is grouped together with a slot for each, so an office that passed nothing on is a visible blank rather than a silence.
None of this is a tier, an add-on or a feature flag. It is in the product for every team, at every size, on day one.
Keep every rotation inside working-time law without checking it by hand. Presets for the UK, EU, US and Australia, or set your own limits — and going outside them is a deliberate, recorded decision.
Never staff a shift without the seniority a client was promised. Say how many of each tier a shift needs — two T2 and one T1 on nights — and the schedule holds you to it instead of leaving it in a runbook.
Nobody gets rostered on a day they were entitled to have off. Holidays arrive for every region you operate in, you can add your own, and your weekend is whatever your part of the world actually treats as one.
On-call that cannot contradict the shift schedule underneath it, because it is planned alongside the rotation rather than in a separate tool somebody forgets to update.
Give a team its own schedule without disturbing anyone else’s. A group that works to different hours stops being the reason your rotation needs an exception.
People who do not rotate still count. Pin anyone to a fixed shift and they stay on the roster with the reason shown, rather than disappearing out of your coverage picture.
Everyone sees only what their role should show them. The same person can run one client account and simply work shifts on another, which is how an MSSP actually operates.
Answer “who changed this, and when” without anyone having to remember. Every change to the team, schedule, leave, swaps, handover and settings is recorded, searchable and exportable.
People hear about the things that affect them without being chased. Leave, swaps and handover reminders reach them in the app, and by email or Slack if you want them there too.
You finish setup with a real schedule rather than an empty product. A guided run through your shifts, days off, coverage rules and policy ends by generating your first rotation.
Get the whole team in without adding them one at a time, and open anyone to see their upcoming shifts and leave in one place when you need to answer a question about them.
Start part of it over without losing the rest. Clear your configuration, the generated schedule, the day-to-day workflow data or everything — and nothing goes until you type the name back.
The answer is one click from the screen that raised the question. The guides live inside the dashboard, so nobody goes hunting through a help site mid-shift.
Tell us how your SOC is structured — shifts, tiers, offices, who never rotates. We'll build the rotation, walk through where coverage and fairness land, and answer the questions a generalist scheduling tool can't.