The Alert Went to an Employee Who Left

Why this matters

Every alert a monitoring system sends goes to a list of phone numbers and email addresses that somebody typed in once and nobody has looked at since. People leave. Their accounts in your field software get switched off, their keys come back, and their phone number stays on the alert list of every house they ever set up. This case is reconstructed backwards from the record a plumbing shop pulled together after a burst pipe, and what it shows is that the system worked exactly as configured. The configuration was the fault.

The letter that started it

A plumbing shop of 14 people ran a monitoring add-on for 38 homes, mostly seasonal and second homes. Each had leak sensors, an automatic water shutoff, an indoor temperature sensor and a connected furnace. In late January the shop received a letter from a homeowner's insurer asking for its records on an alert sequence at one of those homes, where a supply line in an exterior wall had frozen and split.

Nobody at the shop had known anything was wrong until a tech was sent out late in the morning. The owner's first assumption was that the devices had failed to alert. The record said otherwise.

The alert log

The monitoring platform keeps a delivery log for each home. This is the excerpt for the night in question, as the owner exported it:

DATE   TIME   EVENT                     SENT TO
Jan14  21:50  Furnace fault code        D.Mora SMS
                                        office@ email
Jan15  03:15  Temp 44 F (confirmed)     D.Mora SMS
                                        office@ email
                                        owner app push
Jan15  07:30  Temp 36 F                 D.Mora SMS
                                        office@ email
                                        owner app push
Jan15  13:05  Water detected, bsmt      D.Mora SMS
                                        office@ email
                                        owner app push
Jan15  13:05  Shutoff valve CLOSED      same three

1. Mora was the service coordinator who set up every one of the 38 homes. She had left the shop in October, three months earlier.

Reading the log against the agreement

Before anyone talked about blame, the owner read the log against what the shop had actually promised. The monitoring agreement said the shop would review critical alerts within 1 hour of opening on business days, with business hours starting at 07:30, and that the customer would continue to receive all alerts directly.

That one line decided which events were the shop's to answer for.

• The 21:50 furnace fault was an equipment fault code, which the agreement classed as "reviewed same business day." It arrived after hours. Under the agreement, it was due for review during the next business day, which was the morning of Jan 15.
• The 03:15 low-temperature alert arrived outside business hours. Under the agreement it was due for review by 08:30, one hour after opening.
• The 07:30 alert at 36 F arrived at opening and was due for review by 08:30 as well.

So by the shop's own written terms, two critical alerts were due for review by 08:30, and the furnace fault some time that business day. The shared inbox's read receipts showed all three emails marked unread until 14:10, an hour after the water alert. The shop had missed its own commitment by more than five hours. That was the honest starting point, and it is the point at which the owner called the shop's attorney and insurance agent rather than answering the insurer's letter directly. This is not legal advice, and an incident like this one is exactly the fork where a shop stops reasoning from an article: walk in with the agreement, the website copy describing the service, the export above and the inbox read history.

Where the alerts actually went

The log lists three recipients. Each one was supposed to be a safety net and each one failed for a different reason.

D. Mora's phone. Her personal mobile number had been entered as the shop's "primary contact" on all 38 homes, because she set them up from her own phone during commissioning. She still received every alert. At 08:15 on Jan 15, after the second freeze alert, she texted the owner's personal number: "Still getting alerts for the lake house on Birch, temp is 36, not sure who to tell." That text was the only human action in the whole sequence before the water reached the floor. The owner saw it at 11:40, between jobs, and sent a tech at 11:50. The tech arrived at 13:30, 25 minutes after the water alert.

The office@ inbox. It was a shared address with no single owner. Everyone assumed someone else read it before 08:30. In practice the first person in each morning read the scheduling emails and left the platform's alert emails for "whoever handles monitoring," which had been D. Mora.

The homeowner's app. The homeowner had turned off notifications for the app the previous autumn, after weeks of low-battery messages from the sensors. The pushes were delivered, and silenced. This is alert fatigue arriving one layer down, on the customer's phone instead of the shop's.

Why the damage was smaller than it could have been. The automatic shutoff closed at 13:05, the moment the basement leak sensor saw water. Water had already been running inside the wall cavity, but the valve stopped it there. The device side of the system did its job.

Why offboarding missed it

The shop had an offboarding checklist, and it had been followed. D. Mora's login to the field software was disabled the day she left, her truck keys and tablet came back, and her email was forwarded to the owner for 30 days.

What the checklist did not contain was the monitoring platform, because it was a vendor portal set up after the checklist was written. Her access to it as a user had in fact been removed. What was not removed was her phone number sitting in 38 homes' alert-recipient lists, because recipients are a setting on each home, not a property of a user account. Disabling the user removed her ability to log in. It did nothing to the 38 places her number had been typed.

That distinction is the finding. A user account and a recipient entry look like the same thing and are stored as two different things. Most offboarding processes remove the first and never know the second exists.

The routing audit

The owner exported the recipient list for all 38 homes into a spreadsheet and sorted it by recipient. It took about an hour. What it found:

Not one of the 38 homes had a recipient who was a current employee assigned to read alerts. The tech who left in summer had set up the 11 homes he commissioned the same way D. Mora had, from his own phone. And on 6 of the 31 homes where a homeowner number or address had been entered, it was no longer valid, so for those homes the customer's own second channel was dead too.

The fix and how it was proven

The owner made four changes, each aimed at one failure in the record:

1. Recipients became roles, not people. Every home's shop recipients were replaced with two entries: an on-call forwarding number that rings whoever holds the rotation that week, and a monitoring email address assigned to one named person each week. When staff change, the rotation changes; the 38 homes do not. Personal numbers came off every home.
2. The vendor portals joined the offboarding checklist, with a specific line: "export recipients from each monitoring and app portal; remove the leaver's number and email from every entry." Removing a user and removing a recipient are listed as two separate tasks.
3. A quarterly recipient audit, the same export and sort that found the problem, with the result filed. The owner set a rule that any recipient who is not a current employee, a rotation number or a verified customer contact gets removed the same day.
4. A monthly off-hours test alert. On the first Tuesday of each month at 22:00, a staff member triggers a test water alert on a sensor at the shop and the on-call person logs the minutes from alert to acknowledgment.

How they confirmed it. The first test alert, a week after the changes, was acknowledged in 6 minutes. The second, a month later, took 41 minutes: the on-call tech's phone had the forwarding number saved but set to silent overnight. That second result is the reason the test exists. The fix was a single setting on one phone, and it would never have been found by reading the configuration, only by firing an alert at night and timing it.

The owner also called each homeowner whose own contact had bounced and asked them to confirm a working number and to turn app notifications back on for water and temperature alerts at least. The low-battery messages that drove the Birch Street homeowner to silence everything were moved off the live feed and into a weekly list the office works through. See related: Battery-Powered Sensors and the Maintenance They Create.

What would have changed the reconstruction. Had the agreement promised around-the-clock response, the 03:15 alert would have been the shop's to answer immediately rather than by 08:30, and the gap the owner had to explain would have run from about 03:15 rather than from 08:30. Had there been no written agreement at all, the shop's website copy, which said "we keep watch over your home all winter," would have been the nearest thing to a promise, and it promises more than the agreement did.

References

• See related: Remote Monitoring as a Service
• See related: Setting Up Freeze and Power-Loss Alerts for a Vacant Home
• See related: Who Owns the App Account on a Connected Device
• See related: Leak Sensors and Automatic Water Shutoffs
• Your attorney and insurance agent, for any claim or demand arising from a monitored home