An alarm that stays on until somebody clears it
A one-shot chime can be missed by a worker whose phone was in a pocket. An emergency here is a state, not a message.
Raise, acknowledge, clear
Raising an alert opens a session. Every member sees a banner that persists. Acknowledging says "I have seen this" — it does not clear it. Only the raiser, a moderator or an org admin resolves it.
- Acknowledgement and resolution are deliberately different actions, because "someone noticed" is not "someone dealt with it"
- A phone that reboots mid-alarm still sees the alert when it reconnects
- Every raise, acknowledgement and clear is written to the audit log
It overrides the things that would hide it
An emergency reaches people who have muted the channel, set themselves busy, or gone Solo. That override is the entire point, and it is why the rest of the design is conservative.
- Takes the floor from whoever is speaking, so a worker in distress never gets a busy signal
- The displaced speaker is told, and their partial recording is still saved
- Bypasses Do Not Disturb on Android, which requires a permission the user grants explicitly
Hold, do not tap
The control requires a deliberate hold of about two seconds. A single tap in a pocket would raise a false alarm, and this alert overrides other people's Do Not Disturb.
- Each behaviour — alert, DND override, location, auto-open mic, hold-to-confirm — is individually configurable
- Rate limited per user, with a cooldown after clearing and an hourly cap per organisation
- Organisations can disable it entirely rather than having it half-work
The honest limitation
On an end-to-end encrypted channel, the alert body is sealed under that channel's key. So an org admin watching the console cannot see the location unless the client also seals a copy to the org key.
- That is a visible, consent-gated setting — never something we do silently
- For the same reason an alert targets one channel rather than broadcasting to many
- The channel it targets is stated in the interface, so it is known before it is needed
A button that silently fails is worse than no button
This is a safety feature, so it is built as real state with real delivery guarantees rather than a notification that hopes for the best.