Frequently Asked Questions

OaaS (Operator as a Service) is an automated alarm response system that integrates with your CMS software. When an alarm triggers, OaaS engages your contacts on your behalf — via phone, SMS, email, or chatbot — captures their response, and takes action. This includes extending Late to Close alarms, allowing Out-of-Hours openings, and completing alarm events based on contact requests. OaaS also writes all significant updates and outcomes back into your CMS activation for a full audit trail.

Typical pickup is under 5 seconds from the moment the alarm reaches our server. Engagement — placing the call or sending the SMS — follows within seconds of pickup, subject to any configured delays in your plan such as sleeping activations.

Any alarm or event type you want managed automatically — Late to Close, Open Out of Hours, Low Battery, environmental, system, intruder, fire, or anything your CMS raises. You decide which event types OaaS picks up and which it leaves to your operators.

OaaS also supports engage-only actions — one-off engagements an operator can trigger from inside an existing activation. With one click, the operator can have OaaS make an IVR call or open a chatbot session with a chosen contact and record the response back as a Response Note. Useful for ad-hoc verifications, callbacks, or contacts you don't want hard-wired into a plan.

Yes. Operators can claim an activation at any time, even mid-engagement. When an operator claims an activation OaaS owns, OaaS gracefully stands down — any in-flight call, chatbot session, SMS, or email is cancelled cleanly, the contact is notified where the channel supports it, the plan position is held, and ownership transfers to the operator. If the operator later releases without resolving, OaaS resumes from where it stood down — the customer doesn't have to start over.

OaaS exhausts the full contact list per your plan — trying different channels and contacts in sequence. If the list is exhausted without resolution, the activation escalates to your operator queue or a configured fallback. Nothing silently disappears.

OaaS uses one of two engagement modes per customer. Response Plan mode follows a preset step-by-step contact sequence you define. DAIOS mode reads the alarm context, contact list, and response plan details to choose the best contact and channel automatically. Both modes honour contact schedules, verification policies, and resolution groups. Full AI mode is coming soon.

Yes. Each contact can have multiple channels with priorities, and your plan defines the order OaaS works through the contact list. If contact A does not answer on any channel, OaaS moves to contact B, and so on until the list is exhausted or the activation is resolved.

Yes. Parallel (broadcast) engagement is supported — useful for duress or critical events where you want every nominated contact notified simultaneously rather than sequentially. The first to respond drives the resolution; the rest are notified that the event has been handled.

Yes. Every Resolution Group can include a "transfer to operator" option — on the IVR the contact presses the matching key, on the chatbot they tap a button or simply ask, and on SMS they reply with the keyword. OaaS captures the request, marks the activation for operator handover, and posts a Response Note with full context. Your operator picks it up from their normal queue.

OaaS detects voicemail and treats the attempt as unanswered. It does not leave sensitive alarm details on a voicemail unless you specifically configure it to. It then falls through to the next channel or contact per your plan, with the attempt logged in the activation.

Yes. When a contact responds to a Late-to-Close or Out-of-Hours alarm with an extend, cancel, or open-early request, OaaS posts that change straight to the CMS schedule via the CMS API — no operator action required. Supported actions include LTC extensions (15, 30, 60 min), LTC cancellation, OOH extensions (15, 30, 60 min), and OOH open early.

If the change cannot be applied — CMS unreachable, schedule in an unexpected state — OaaS retries briefly then escalates to an operator with full context explaining what the contact requested. The contact's intent is never lost. Auto-apply is enabled per company and configured during onboarding.

Two-way on every channel that supports it — IVR (key presses and spoken responses), SMS (reply-to conversations), and chatbot (full AI dialogue). Email is one-way notification only. The contact's reply is always recorded against the activation and posted back to your CMS.

Yes. The chatbot uses a full AI model to converse naturally with the contact, understand their intent, and confirm resolution in plain language. If the AI is unavailable or the contact prefers not to chat, they can tap one of the Resolution Group buttons to choose their response directly. The chatbot can be branded with your monitoring centre's logo and colour — contacts see a familiar interface, not a third-party screen.

A chatbot engagement is delivered by SMS or email. The message contains a secure link — the contact taps it and a chatbot interface opens directly in their browser. No app download required.

Yes. Voice scripts, SMS templates, email templates, and chatbot system prompts are all configurable per plan. You can use dynamic placeholders for site name, alarm type, time, contact name, and more. The voice provider and persona can be selected per company.

Yes. Every OaaS engagement and significant action is written back into the CMS as a Response Note on the activation — including contacts being engaged, the contact's response, channel fallbacks, and operator overrides. OaaS also posts a secure link back to the CMS that opens a full detail view of the engagement including the chatbot conversation, IVR keypress flow, notification content, timestamps, and outcome.

Yes. When OaaS receives an alarm, only a Ticket ID is sent — OaaS retrieves what it needs through a secure, token-authenticated CMS REST API. OaaS runs on dedicated, hardened Linux servers with encrypted-in-transit traffic (TLS) for every external connection, per-customer database isolation, and disk-level encryption at rest. Every meaningful action is recorded in a tamper-evident, hash-chained audit log.

You — every user you authorise on your side, scoped by role. Us — only authorised OaaS staff, only when needed for support or troubleshooting, and only under your instruction. All staff access is logged in the audit trail. Nobody else. We do not sell, share, or use your data for any purpose outside of running the service.

Yes. OaaS supports per-contact PINs or verification codes. On an IVR call the contact must enter their PIN before any site information or alarm details are disclosed. For SMS and chatbot the same code challenge applies. Failed attempts are limited and logged. If a contact fails verification OaaS treats it as unanswered and falls through to the next contact or channel. You decide which contacts and channels require verification and what happens on failure.

Live operational data is retained based on a custom data retention period — you can request deletion at any time. Audit logs are held for 90 days online and archived for 2 years. On termination, a full data export is provided and your data is purged within 30 days unless you request earlier removal.

Voice AI is a completely separate channel from the standard IVR. Where IVR uses a fixed key-press menu, Voice AI uses an AI agent that speaks to the contact in natural language and listens to their spoken response. The contact does not need to press any keys — they can say their answer aloud.

Both IVR and Voice AI are available as channel options — you can use both side by side or pick whichever suits each customer's preference.

No. The options the AI offers come directly from the Resolution Group configured for that engagement. If the contact asks for something off-list, the AI refuses politely and re-states what they can choose from. This guardrail is enforced on both the chatbot and the AI voice agent — a contact can never receive a confirmation for an action that wasn't actually logged.

Voice AI handles the "wrong person answers" case cleanly. If the person who picks up says something like "no, this is Matt" or "you have the wrong number," the AI politely acknowledges and resolves the engagement as NEXTSTEP_WRONG_PERSON. OaaS records "Reached a Different Person" on the CMS activation and advances to the next viable contact, instead of escalating as "voice unclear."

Yes. If a Call Back Number is configured for the company, OaaS bridges the live call to it the moment the contact asks. When the operator answers, Twilio plays a short private whisper — announcing the contact's name, number, and the alarm type — so the operator knows who and what they're being joined to. The dial outcome (connected, voicemail, or no-message) is posted back to the CMS as a follow-up note.

Yes, where call recording is enabled. The AI voice transcript and call recording are saved alongside the engagement detail and linked back to the CMS activation. CMS staff can open the link directly from the activation notes to review the full conversation, listen to the recording, and see the outcome.

Yes. The following are configurable per company: the legal disclosure preamble (required in many jurisdictions when AI handles a call or it's being recorded), the verification prompt wording, the message played after a failed verification, the maximum verification-attempt count, and the AI voice persona. Eight OpenAI voices are available: alloy, ash, ballad, coral, echo, sage, shimmer, and verse. PIN entry accepts either spoken digits or keypad (DTMF) — whichever the contact prefers.

OaaS supports two client-level alternates that are always accepted on every channel: an OK Password ("I'm fine" alternate) and a Hold-Up (Duress) Password. A Hold-Up match looks identical to a normal verified response to the contact — they see no behavioural difference — but OaaS silently logs an AUDIT_SECURITY event, posts a DURESS CMS note, and escalates the activation to the operator queue. No log or transcript ever names which credential matched, so the covert path stays covert.

The OaaS Task Plugin will automatically try the backup OaaS connection path and queue activations for retry. Your OaaS Heartbeat Account will stop receiving heartbeats, generating an alarm in your CMS so control room staff are immediately aware. Nothing is silently lost — queued activations are sent through once OaaS is reachable again.

OaaS runs on professionally managed cloud infrastructure with automated daily backups retained for 30 days, containerised deployment for fast restore, off-host backup storage, and a 99.5% monthly uptime target as standard. Enhanced options — including managed database failover, hot standby servers, multi-region backup replication, and higher SLA targets — are available at additional cost.