The thirteen alerts
Earn the channel's attention with specifics. Each alert should name a project, a provider, and a likely cause — not just 'spend went up.'
- Project over 80% of monthly budget — catches blow-ups while the month can still be changed.
- Day-over-day spend change > 25% on a single project — filters noise from small-account swings.
- New service contributing to a project for the first time — surfaces accidental adoption.
- A managed database scaled up automatically — auto-scaling silently raises baseline cost.
- Cross-region data transfer above a project's normal band — often a misconfigured replica or backup.
- A Kubernetes namespace's pod count doubled vs 7-day average — catches runaway deploys.
- An idle GPU or large instance over 24h — one of the highest-dollar wins per fix.
- A Load Balancer with zero traffic for 7 days — pure fixed-cost waste.
- Untagged spend percentage above your team's target — keeps allocation hygiene visible.
- Forecast month-end exceeds last month by > 15% — slope-based, not just threshold-based.
- A DigitalOcean Droplet running > 72 hours past its tagged lifecycle — spot the abandoned preview environment.
- Anomaly on a single service line vs project history — lower noise than account-wide anomalies.
- Budget alerts deduplicated per project per month — prevents the same threshold firing five times.
Who tovin.io is for
Frequently asked
How many alerts is too many?
If engineers mute the channel, you've crossed the line. Bias toward fewer, higher-signal alerts with project and likely-cause context attached.
What's the difference between threshold and slope alerts?
Threshold fires when MTD crosses a number — catches blow-ups. Slope fires when the forecast trajectory drifts — catches gradual problems before the threshold.