SolutionsFinancial services vendors
Incident facts your financial customers can use.
If EU payment firms, fintechs or other regulated financial customers use your software, DORA reaches you through their contracts and their reporting deadlines. Observer gives you measured facts, signed records and a way to tell the affected customers first.
What DORA asks
What your financial customers are held to.
A short summary for SaaS teams. The regulation and your customer's contract decide the exact obligations.
Who it regulates
Your customers, and through them, you.
The Digital Operational Resilience Act (Regulation (EU) 2022/2554) has applied since 17 January 2025 to EU financial entities, from payment and e-money institutions to investment firms and other regulated firms. A SaaS vendor to them is an ICT third-party service provider. The financial entity stays fully responsible for its own compliance (Article 28(1)), so the requirements reach you through its contract and its questions.
The register
They have to record what they buy from you.
Each financial entity keeps a register of information on every contract for ICT services (Article 28(3)). Expect requests for your legal entity, the services you provide, where they run and who your subcontractors are.
The contract
Service levels they can monitor.
Article 30(2) requires a description of the services, where they run and where data is processed, service level descriptions, and your assistance when an incident related to your service occurs, at no extra cost or at a cost agreed in advance. When your service supports a critical or important function, Article 30(3) adds precise quantitative and qualitative performance targets the customer can monitor, and notice and reporting obligations.
The clock
Hours, not days.
Once a financial entity classifies an incident as major, its initial notification is due within 4 hours, and no later than 24 hours after it became aware of the incident. An intermediate report follows within 72 hours and a final report within one month (Delegated Regulation (EU) 2025/301, Article 5). The classification criteria include clients affected, duration, service downtime and the services affected (Delegated Regulation (EU) 2024/1772).
Their clients
They have to tell their own clients.
When a major incident affects clients' financial interests, the financial entity informs them without undue delay, with the measures taken (Article 19(3)). If the incident started in your service, the facts they need start with you.
The first hour
What they need from you, fast.
A customer deciding whether your outage is their major incident needs specific, timestamped facts. A generic status line does not let anyone classify an incident.
| They need | Where it comes from in Observer |
|---|---|
| When it started | The time the metric's status changed, after a short confirmation window, not when someone noticed. |
| Which services | The services whose checks changed status, as the status page shows them. |
| Which customers | The customers you attach to the incident; only their pages and subscribers get it. |
| What is being done | Your incident updates, each timestamped, in the order they were published. |
| When it ended | The time the metric recovered, and the update that resolved the incident. |
Where Observer fits
The evidence and the communication.
Observer covers the reliability evidence and the customer communication in the middle of a DORA readiness plan. The contract, the register, continuity testing and exit planning stay with you.
Measured impact
Start and end come from data.
Status comes from your own metrics, read by an agent inside your network. Every change of status is timestamped once it has held for a short confirmation window, so an incident's window is measured, not remembered.
Incident timeline
Every update, timestamped.
Each incident keeps its updates in order on the status page and in its history, with a postmortem link when you publish one. Planned maintenance has its own schedule and notices.
Subscriber notifications
The affected customers hear it first.
Status page subscribers confirm by email. From the Pro plan, an incident scoped to some customers reaches only their subscribers. The all clear goes to everyone who was told.
Your own channels
A record of every alert sent.
Alerts to Slack, Microsoft Teams, PagerDuty, Jira, email and signed webhooks are logged per attempt, with the payload, so you can show what went out and when.
Signed records
Service levels you can prove.
BusinessPer-customer SLA terms and monthly statements with the working shown, hashed and signed so your customer can verify them on the verify page without trusting you or us.
Data location
Held in the EEA and the UK.
Customer data at rest, including backups, is held in the European Economic Area and the United Kingdom. Subprocessors are listed with where they process data.
What it is not
Observer does not make you DORA compliant.
It does not classify incidents for your customers and it does not file reports with supervisors. Your customer remains responsible for its own compliance, and you for your contract with it. This page is a summary, not legal advice.
Design partners
Selling to payment firms and other regulated customers?
We are looking for a small number of vendors to financial services to shape this with us. Three months free, then 50% off the first year on an annual plan.
Keep reading