Your on-call shouldn't be
a human alert filter.
Reduce alert noise by ~80% by grouping related alerts into incidents and auto-generating root-cause summaries — so your L1 stops clicking acknowledge at 3 AM and starts fixing things that matter.
AIOps platform for alert correlation, deduplication, and LLM-drafted RCAs · Self-hosted PagerDuty alternative for DevOps & SRE teams.
1,000 alerts/month free · No card · Sign in to app.saneops.in · or self-host the Docker image
> Root cause likely: missing index on users.email following migration 2026-05-15-a3f; query p99 ↑ 14× since 02:41 UTC.
800 alerts a day. 90% are noise. The other 10% are five real incidents fired six times each.
If your team runs a 24/7 NOC or on-call rotation, you already know the pattern. Your L1 spends the night clicking acknowledge instead of fixing anything. Your seniors get paged for the same outage from four monitoring tools. By morning, nobody trusts the pager.
What Saneops compresses for you.
Real numbers from beta tenants — the same dashboard above, summarised three ways.
Related symptoms across services collapse into a single incident.
Auto-gathered context means engineers start fixing immediately.
Only actionable incidents page humans — nothing else.
AIOps in three steps: ingest, correlate, explain.
Ingest
Point any alert source at Saneops via webhook. Grafana, Datadog, PagerDuty, Prometheus, custom JSON. No agents, no SDK, no data leaving your network.
Correlate & dedupe
Time-window grouping + content-hash dedup + CEL-based custom rules collapse 800 alerts into a handful of incidents. The first 50 lines of the runbook become unnecessary.
Explain & route
A first-draft RCA is generated for every incident — what changed, what's affected, what to check first. Then it's routed to the right channel via a visual workflow builder.
Alert correlation, deduplication, and LLM RCA — built for SREs.
Every feature exists because a real on-call engineer wished it did at 3 AM.
Alert correlation
Time-window + label-similarity grouping with tunable thresholds per tenant.
Content-hash dedup
Same payload arriving from four monitoring tools? One alert, four sources attached.
CEL-based drop rules
Filter known-noise alerts with the same expression language Kubernetes uses.
LLM root-cause analysis
First-draft RCA written for every incident. Bring your own Claude / OpenAI / Ollama key.
Visual workflow builder
8-tab workflow editor — overview, builder, canvas, YAML, inputs, secrets, versions, runs.
Encrypted secrets vault
Webhook tokens, API keys, SMTP passwords — encrypted at rest with your session key.
Cloud or self-hosted. Same product. Your choice.
Most beta customers start with cloud — sign up, ingest your first alert in minutes. Security-sensitive teams prefer to run the Docker image on their own infra. Both get the same Saneops.
Saneops Cloud
app.saneops.inWe host it. You sign in, paste your webhook URL into Grafana / Datadog, alerts flow. Zero infra to set up.
- Live in 5 minutes — no Docker, no Postgres setup
- Always on the latest version
- Auto backups, HTTPS, SSO-ready
- Free during the 60-day beta
Self-hosted
docker compose up -dSingle Docker image (~108 MB). Runs on your infrastructure. Alert payloads, incident history, secrets — none of it leaves your network.
- Air-gap capable — works with no outbound internet
-
Encrypted secrets via your own
SESSION_SECRET - DPDP Act 2023 + GDPR aligned
- ~10 min to first alert via Docker Compose
Both options share the exact same codebase, same features, same beta agreement. Switch between them anytime.
Where Saneops fits in your stack.
Saneops sits between your monitoring tools and your humans. It doesn't replace Grafana, Datadog, or PagerDuty — it absorbs the alerts they generate so fewer reach a human.
| Saneops | PagerDuty | Datadog | |
|---|---|---|---|
| Alert correlation | ●●● | ●○○ | ●●○ |
| LLM-authored RCA | ●●● | — | ●○○ |
| Self-hosted option | ✓ | — | — |
| Pricing model | flat / tenant | $/user/mo | $/host/mo |
| Time to first alert | 5–10 min | ~30 min | hours |
| Aimed at | 50–500 eng | enterprise | enterprise |
●●● strong · ●●○ partial · ●○○ basic · — not offered. Comparison reflects publicly documented features as of April 2026.
Free for 60 days. Ten companies. No catch.
I'm taking on ten design partners through the closed beta. You get the full product, free, self-hosted. In exchange: honest feedback, a 30-minute weekly sync, and a chance to shape what Saneops becomes.
- • Full product, no feature gates
- • Direct line to the founder
- • 50% off year 1 if you convert
- • Real production deployment
- • Bug reports + feedback
- • 30-min weekly check-in
- • 60-day free beta
- • Self-hosted, your data
- • Walk away anytime
Or email support@saneops.in directly.
Built by one engineer, in public.
Saneops is built by Omprakash Kumar. No VC, no marketing team — just one engineer who got tired of watching on-call rotations burn out good people.
The bet: most alert-fatigue isn't a tooling-volume problem. It's a correlation problem. Once a system can group, dedupe, and explain alerts the way a senior SRE does in their head, the L1 layer mostly disappears.
If that bet's wrong, the beta will tell us in 60 days. If it's right, Saneops becomes the layer between your monitoring and your humans.
Questions we keep getting.
Is this open source?
Cloud or self-hosted — which should I pick?
Does any of my alert data leave my network?
Cloud: data is hosted by Saneops in Singapore on managed Postgres. Full DPA available, signed before any deploy. If your team can't put alert payloads on a vendor's infra (regardless of vendor), use self-hosted instead.
What does it cost after the beta?
How is this different from Keep / FireHydrant / PagerDuty?
What if I find a critical bug at 2 AM?
Where can we deploy and what's the data-residency story?
Stop reading alerts.
Start fixing things.
Ten beta slots. First-come, first-served.
Apply for the beta