NIS2 reporting, MTTA, MTTR and audit log. Every incident becomes evidence.
Keep NIS2 deadlines, report drafts and submission evidence in one place, see how fast your team responds and resolves, and keep every change in the audit log. Every export comes from European infrastructure, ready for management and auditors.
On-call scheduling, acknowledgement and incident timeline are currently in beta.
Made and hosted
in the European Union
No US subprocessors
for your incident data
NIS2-ready exports
for report cases and audits
NIS2-ready exports. The reporting stays with you.
If your organization or your client falls under NIS2, every hour counts after a significant incident. A report case groups the affected incidents, walks you through the ten criteria for the decision, shows the deadlines from the moment of awareness and prepares the report drafts. You submit in the BSI portal yourself, and Uptimeify keeps the evidence of what you submitted and when, on European servers and for three years.
- Deadlines from awareness: early warning within 24 hours, notification within 72 hours, final report one month after the notification, so no deadline gets lost in daily work.
- Drafts ready to paste: every stage in German or English, as Markdown or plain text, with missing details clearly flagged, so you never start from a blank form under time pressure.
- Evidence and management report: the submitted text is frozen with the BSI reference, and the quarterly PDF supports management oversight, so your proof holds in the next audit.
A report case moves through assessment, not_reportable or reportable, then early_warning_submitted, notification_submitted, final_submitted and closed. It links up to 50 incidents. Ten criteria are confirmed or rejected by a person, and suggestions from monitoring data exist only for a total outage over 30 minutes and for planned maintenance. The decision is possible once every criterion is decided, and "not reportable" requires a reason.
Drafts exist for early warning, notification, interim, progress and final report. When you log a submission, the server freezes the submitted text with its reference as evidence, and stages follow the legal order. Uptimeify transmits nothing and never classifies an incident on its own. Closed report cases are kept for three years.
GET /api/im/report-cases/:id/draft returns each stage as Markdown or plain text in de or en, with a draftToken that signs exactly that text. Recording a submission freezes text, stage, timestamp and BSI reference; nothing can be changed afterwards. GET /api/im/reports/nis2-management.pdf delivers the management report for a quarter or up to 366 days in de or en, and every generated PDF is written to the organization audit log. Access is limited to organization admins and listed reporting officers with a session login.
Numbers instead of gut feeling.
How long does it take your team from the first alert to an acknowledgement, and how long to a resolution? The incident report shows it per team, severity, category, service or month. The on-call report shows who carried how many hours. Both back your response promise to clients with real figures.
- MTTA and MTTR per team and severity, so you see where response stalls instead of guessing.
- On-call minutes per person as CSV, so on-call duty is shared fairly and paid correctly.
- Noise per day: incoming alerts, grouped duplicates and the incidents they became, so you see whether your team works on signal or on noise.
GET /api/im/analytics returns volume, MTTA and MTTR per local day, daily alert load and on-call minutes per person in one call, for up to 400 days. MTTA and MTTR only average incidents that were actually acknowledged or resolved, open ones do not count as zero. Test incidents are excluded.
GET /api/im/reports/incidents groups by month, team, severity, category or service and returns JSON or CSV with the columns <groupBy>,count,mttaMinutes,mttrMinutes. The on-call report comes as userId,userName,minutes,hours. Incidents are kept in full for twelve months, after which a daily aggregate carries the metrics up to 24 months.
Who changed the escalation? It's in the log.
When an alert reached nobody at night, you want to know why. The incident management audit log records every change to teams, members, schedules, overrides, escalation tiers, sources, routing, channels and settings: who, when and exactly what applied before and after.
- Every change with before and after, so you find a wrong setting in minutes rather than hours.
- Filters by area, person and time range, so a question from a client meeting gets a documented answer fast.
- Organization log as CSV, sign-ins included, up to 366 days per export and unchangeable in the application, so auditors and clients get a clean, NIS2-ready record.
GET /api/im/audit-log returns entries newest first, each with action (create, update, delete), a diff in the form {field:{from,to}} and the actor. Secrets never enter the log, and rotations show as "rotated" or "set". Filter by entityType, actor and time range, paginated by cursor with up to 200 entries per page. Access is limited to organization admins.
The organization log export (GET /api/organization/audit/export) delivers administrative actions and sign-in events as a CSV with eleven columns, up to 366 days and 100,000 entries per export. Entries are kept for twelve months and cannot be changed or deleted in the application. Every export is itself logged.
Resolved is not the end.
The outage is fixed, but why did it happen, and what will you change? The postmortem captures summary, impact and root cause, picks the cause from a shared catalog and assigns action items with an owner and a due date. The follow-up view shows what is still open.
- Postmortems with a cause catalog, so the same cause always has the same name and patterns become visible.
- Action items with owner and date, so "we should really fix that" becomes a task someone closes.
- Follow-up at a glance: incidents without a postmortem, open and overdue actions and repeated causes, so nothing fades after the incident.
A postmortem belongs to exactly one resolved incident: summary, impact, rootCause, causeId and lessonsLearned, up to 10,000 characters each. Completing it requires summary, root cause and a catalog entry, after which the content is locked. Causes are never deleted, only archived. Action items carry ownerUserId, dueOn and the status open, done or dropped.
With NIS2 mode on, a postmortem is due from postmortemMinSeverity (default sev2), for the security category or with a linked report case. A cause found in at least two completed postmortems within six months counts as repeated. Uptimeify only counts, and the judgement stays with you. A quarterly review freezes the figures and is kept for three years.
We don't just monitor. We help you sell.
Every Uptimeify account includes access to our Success Kit, a collection of battle-tested resources to turn your monitoring into a profit center.
Service Level Agreement templates to define professional boundaries with your clients.
Find the sweet spot for your care plans. Calculate margins based on check frequency and support hours.
Powerpoint Templates that explain 24/7 monitoring to non-technical clients. Close more retainers.
Use automated reports to proactively communicate value, so clients never ask what they're paying for.
Ready to turn monitoring into a profit center?
Claim your Success Kit and start scaling today.
Frequently Asked Questions
MTTA (mean time to acknowledge) is the average time from an incident being triggered to a person acknowledging it. MTTR (mean time to resolve) is the average time to resolution. Uptimeify calculates both per day, team and severity and only averages incidents that were actually acknowledged or resolved, so open cases do not distort the figure.
Yes. The on-call report returns minutes and hours per person for any date range, as JSON or CSV. Shifts are cut cleanly at the edges of the range, and overrides are included. That gives you a solid basis for on-call allowances and a fair split across the team.
Report drafts for every stage in German or English, as Markdown or plain text for the BSI portal, the frozen submission evidence with BSI reference, and a quarterly management report as PDF. On top of that come the audit log, sign-ins included, and the incident and on-call reports as CSV. Uptimeify submits nothing itself, so every export supports your reporting without replacing your own assessment.
No. You submit every report yourself in the BSI portal. Uptimeify transmits nothing and never classifies an incident on its own. It supports you with criteria, deadlines from the moment of awareness, report drafts and a log that records which text you submitted, when and under which reference.
Incidents with their timeline are kept in full for twelve months, and daily metrics for up to 24 months. Postmortems, closed report cases and quarterly reviews are kept for three years, the organization audit log for twelve months. Raw payloads of incoming alerts are cleared after 90 days.
For the technical stakeholder
Ready to document every incident end to end?
Switch on NIS2 report cases, set your reporting officers and write your first postmortem. Your team sees where it gets faster. Your auditors see that you can prove it.