Slack alerts: fraud verdicts in your own workspace

An alert email is a good record and a poor interrupt. The fraud desk, the NOC and the account manager are in Slack all day. A verdict that lands in the channel they watch gets a reaction in a minute, and a thread under it becomes the hand-off. So the alert now goes to the channel as well, and the email still carries the full card, the transcript and the attachments, for forwarding and filing.

Every customer connects their own Slack. There are two ways in, and both end in the same connected channel on your account:

Add to Slack

One button on the Connectors page. Slack opens its own screen, you pick the channel and confirm, and you are back in Open Voice Shield with the channel listed. The app asks for a single permission, posting to that channel. It cannot read messages, list channels or see members.

Paste a webhook URL

If you would rather run your own Slack app, or your deployment has not registered one, create an incoming webhook for the channel in Slack and paste its URL. The message and behaviour are the same, and no platform-level app is involved.

The Connectors page is where every integration will live: Slack today, the HTTP webhook and email beside it, Telegram and WhatsApp next. A connected channel can be tested, disabled, or disconnected from the same card. Disconnecting an Add to Slack channel also removes the installation from your workspace, so nothing is left behind on the Slack side.

Each alert rule now has a Deliver to section with two switches: Email and Slack. Turn Slack on and the rule posts to your connected channel. With more than one channel connected you pick which. Turn Email off for a Slack-only rule. A rule needs at least one of the two, and the throttle you set applies to each channel on its own, so a burst of calls does not become a burst of messages.

The Slack message is the alert card, trimmed to what a channel reads well. The headline is the verdict and probability with the analysis title, in the verdict's colour down the side. Under it: the summary, an Open the call button, then the facts (category, the entity the caller impersonated, the dialed number and caller ID, the estimated call quality, your customer reference if the call carried one), up to five red flags and the TCPA comment. A quality alert leads with the estimated MOS instead of a verdict.

The transcript and the attachments stay in the email. The chat message is the heads-up, and the button takes you to the call page, which holds the evidence.

• The webhook URL is the secret. It is stored encrypted and never returned by the API, not even to you. What you see is the workspace and channel name.
• Add to Slack uses Slack's OAuth with the single incoming-webhook scope. The customer picks the channel in Slack's screen, so we never list your channels and never hold a permission we do not use.
• Delivery is a separate job from analysis, as email always was. A Slack outage cannot delay a verdict, and a transient error is retried with backoff.
• A channel that refuses for good (the webhook was removed, the app uninstalled) is marked Failing on the Connectors page with the reason. Email delivery for the same rule is unaffected.
• Each delivery is written to the same ledger as email: which rule, which channel, sent or skipped and why, so a "we never got that alert" has an answer.

For platform operators: registering one Slack app under Email (SMTP) in the admin console turns on Add to Slack for every customer. Without it, customers still connect by pasting a webhook URL.

Slack is the first of several channels. The channel model is generic: a connection belongs to the customer, a rule lists the channels it delivers to, and the worker treats each channel the same way. Telegram and WhatsApp are next on the list and will slot into the same Deliver to section.

Related: three ways operators use Open Voice Shield, getting started, or start free with $5 credit.