From alert to decision
No black box: this is exactly what happens between an incoming Sentry alert and the email you (might) get.
From webhook to inbox
One Sentry Internal Integration, no SDK changes You create an Internal Integration in your own Sentry organization and paste the webhook URL Tailon generates. No package to install, no code to change.
A whitelist, not a full copy Tailon only reads the title, level, culprit, and stacktrace summary from an alert. Cookies, IP addresses, and user data from the payload never touch our system.
Two models, one decision A fast/cheap model classifies first. Only when in doubt or urgent does a more thorough model kick in for the deeper diagnosis. That way you don't pay the high price for every noise alert.
Conservative when in doubt When uncertain, Tailon always rounds urgency up. Better an unnecessary email than a missed incident.
Likely cause, not a guarantee Every email is a starting point for your own investigation, not an automatic action. Tailon never acts on its own diagnosis.
Every alert ends up in one of three buckets
Most alerts. No likely user impact -- no email, no action needed.
Unclear from the fast pass alone -- the thorough model looks closer before deciding.
Likely real impact. You get an email with a summary and a likely cause.
For anyone who wants the details
- Verification
- HMAC-SHA256 over the raw body, verified against your own client secret. A mismatch gets a 401, before anything else happens.
- Whitelisted fields
- title, level, culprit, project, occurrence_count_last_24h, stacktrace excerpt (max ~2000 characters). Nothing else.
- Model output
- Fixed schema: urgency, summary, suggested_action, confidence. No free text, no surprises in the response.
What Tailon actually reads
A redacted example of the fields Tailon extracts from a Sentry webhook -- the whitelist from docs/openapi.yaml, nothing more.
{
"event_id": "a1b2c3d4",
"level": "error",
"title": "NullPointerException in checkout-service",
"culprit": "checkout.processPayment",
"platform": "java",
"datetime": "2026-09-14T23:14:02Z"
}
// -> whitelist applied, urgency decided:
{
"urgency": "urgent",
"summary": "Likely cause: missing null check after the payment provider callback.",
"confidence": 0.82
}What Tailon never does
- Never takes an action based on its own diagnosis
- Never stores the raw Sentry payload, only the whitelisted fields above
- Never trains models on your data
- Never sends anything to a language model before the signature is verified