We didn’t hire an ops team. We wrote one.

Verifies every privileged action across the platform lands in the canonical audit_logs table. The agent that feeds the Sprinto Q3 2026 evidence binder.

Watches

Clerk webhook events, Paddle webhook events, api_keys table, tenant_impersonation_sessions

On finding

Findings into agent_runs + agent_findings. P0 on any gap between source-row count and audit_logs count in the 24h window. Slack page to ops-alerts.

Verifies every Clerk superadmin has MFA, every GCP service account role matches inventory, every GitHub collaborator is active within 90 days, every Vercel team member has 2FA.

Watches

Clerk user records (MFA enrollment), GCP IAM bindings, GitHub org collaborators, Vercel team members

On finding

Weekly evidence summary + per-control findings stored to agent_runs. The legal evidence trail for SOC 2 access-review controls.

Verifies every expected backup ran within the last 30 hours, with tolerance. Daily SOC 2 control CC7.1.

Watches

Supabase PITR timestamps, Google Cloud Storage snapshot timestamps, Postgres replica lag

On finding

P0 on missing backup (RPO violation), P1 on stale. Slack alert + agent_runs row proves CC7.1 compliance.

Signed-up / cancelled / refunded / upgrade-delta MRR from Paddle, with trend-line context. No page unless something material moved.

Watches

Paddle subscription events from the last 24 hours

On finding

Daily MRR digest in Slack. P0 on ≥5% net drop, P1 on ≥1% drop, info on quiet days.

Chronic overages flag upsell candidates. Spikes are usually a customer bug. Downgrade-then-spike is denial-of-service abuse and pages immediately.

Watches

BigQuery event volume per workspace (24h), plan_tiers table

On finding

P0 on downgrade abuse (80%+ usage post tier-drop), P1 on chronic overage (≥3 days >120%), P2 on spike (>200%). Slack pings on P0/P1. Dashboard for upsell candidates.

Scores trial tenants in their final 7 days. High-intent cohort gets warm outreach. At-risk gets a retention offer suggestion. M5 will add the LLM classifier.

Watches

Workspace signup_date + trial_ends_at; BigQuery event volume + Clerk login sessions (7-day window)

On finding

Info findings bucketed into high-intent (score ≥60) or at-risk (≤30) cohorts. No Slack noise — feeds the founder dashboard for warm outreach.

Weighted churn-risk score: event drop 30%+ in 7d, stale login 14d+, recent downgrade 7d. Surfaces the at-risk account before it cancels.

Watches

BigQuery usage + Clerk login activity (7/14 day windows), Paddle downgrade events

On finding

P0 (score ≥80), P1 (50–79), P2 (25–49). Slack ping with tenant email + dollar weight for founder outreach.

Weekly scan of 7–30 day-old signups. Detects cohorts that didn't cross the activation threshold (1K events in first 7d, site connected in 14d, first alert rule in 14d).

Watches

Workspace created_at, tag_events ingest API, workspace_sites table, alert_rules

On finding

P1 on activation window closed without threshold. Slack digest (no spam on healthy weeks). Info digest with cohort ratio.

Detects stuck onboarding: no events sent, no second login, no workspace created. Buckets by hours-since-signup so the right intervention runs at the right time.

Watches

Workspace signup activity, Clerk session history, workspace_sites table

On finding

P2 <48h stuck (founder emails), P1 <7d stuck (suggest call), info 7d+ (no Slack).

Post-deploy regression watcher. Validates the deploy didn't break the four production regions before the next push lands.

Watches

Cloud Run /health endpoint (all 4 regions), Sentry error count, BigQuery row ingestion rate

On finding

P0 on 5xx spike (3%+ in 5 min) → Slack page with the pre-filled rollback `gcloud` command. P1 on BQ ingest drop >50%.

Weekly `npm audit` + `npm outdated` sweep. Ignores allowlisted pins, evaluates upgrades, runs tests, proposes the PR.

Watches

`package.json` + `package-lock.json` across frontend, backend, admin, dashboard, e2e

On finding

Slack pings per advisory. Opens a draft PR with the npm update + test results. agent_findings track high-risk deps.

Catches backend cron callbacks missing the `isControlPlaneRegion()` gate. Prevents the bug class where four regions all fire the same cron and produce duplicate Paddle charges.

Watches

`backend/server.js` + `backend/routes/*.js` for setInterval / setTimeout / cron patterns

On finding

P0 on write-global cron without guard (Paddle charges, Supabase writes that could fire 4× in parallel). Slack page + proposed fix PR.

Blocks shipping false ads. The agent that should have caught the $49 → $99 pricing drift before it shipped.

Watches

Frontend pricing copy (`frontend/app/page.tsx`, `pricing/PricingContent.tsx`) vs `backend/lib/pricing.js` + `trial-lifecycle.js`

On finding

P1 on mismatch (e.g. "$49" in homepage copy vs "$99" in backend pricing). Slack alert with line-number context.

Prevents a Starter-tier user from accessing a Pro-tier feature because a developer forgot the auth gate. Static analysis, not runtime.

Watches

`backend/routes/*.js` + `backend/server.js` for routes guarded by `requireFeature()`

On finding

P1 on route missing the gate. Slack alert + suggested fix PR.

Content-hash monitor on seven competitor pricing + changelog pages. We know when ObservePoint changes a tier before our sales team does.

Watches

Datadog docs, Sentry changelog, Amplitude pricing, TrackingPlan, ObservePoint, FullStory, New Relic — 7 competitor URLs

On finding

P2 on content-hash change → Slack digest with diff context. LLM-classified for materiality (e.g. pricing drop = P1).

Tracks the regulatory floor under the product. DPDP Act updates land in Slack the same week the gazette publishes them.

Watches

DPDP India, GDPR EDPB, CCPA, EU AI Act, AICPA SOC 2, Anthropic API, Google Cloud, Paddle, Clerk — 9 regulatory + product changelogs

On finding

P1 on regulatory change, P2 on vendor product change. Slack digest reviewed for compliance and product impact.

Surfaces which features nobody uses (kill candidates) and which features get disproportionate usage from a lower tier than expected (tier-elevation candidates).

Watches

feature_usage_telemetry table (28d window), tier expectations from backend/lib/pricing.js

On finding

P2 on zero-usage features (removal candidates). P1 on elevation candidates (5×+ baseline usage on a lower tier — upsell signal).