Notifications
Every email Declara sends is logged with its type, recipient and the mail provider's id, so "did they get it" has an answer. The 15 most recent are listed under Settings → Notifications.
Who "the workspace" is
Most notifications go to the workspace's recipients:
- every address under Settings → Notifications → Where clock reminders go. These are not people, carry no preferences and always receive, and
- every owner, admin and member, unless that person muted the type.
Auditors receive none of them. A notification addressed to one person, such as an invitation, goes to that person only.
Muting
Each person mutes for themselves, under Settings → Notifications. Only the types marked mutable below can be muted. Clock reminders cannot: they can be re-routed by changing the addresses, but the reminder someone silences is the one that matters. Contractual customer notice reminders cannot be muted either. They are not Article 14 deadlines, but they are still deadlines.
Email types
| Type | Triggered by | Received by | Mutable | Also to integrations |
|---|---|---|---|---|
case.reminder | An Article 14 stage falls due: 12 hours, 4 hours and 1 hour before each deadline, at the deadline, and every 4 hours while it is overdue | The workspace, plus the escalation addresses once a stage is overdue by the margin set under Settings → Escalation | No | Yes, as case.reminder, or case.overdue once the stage is overdue |
alert.created | A new Tier A match opens an alert | The workspace | No | Yes, as alert.created |
alert.created (disclosure report) | Someone submits a report through your public disclosure page | The disclosure page's contact address and the workspace's notification addresses, not members | No | No |
alert.resurfaced | An alert you put on hold reaches the end of the hold and is open again for assessment | The workspace | No | No |
case.assigned | A colleague makes you the owner of a case. Not sent when you assign yourself | The new owner | No | No |
customer_notice.due | A contractual notice to a business customer is due in four hours, is due now, or is overdue. Not an Article 14 deadline. Nothing is sent to the customer | The workspace | No | No |
support.ending | A product's support period ends in 90, 30 or 7 days, or ends today | The workspace | No | No |
crypto.disallowed | A new SBOM declares an algorithm or protocol that NIST or BSI guidance says not to use, and the version did not already declare it. Not an exploited vulnerability, and no clock starts | The workspace | Yes | Yes, as crypto.disallowed |
supplier.sbom_received | A supplier uploads an SBOM you asked for. It is stored and scored, not matched | The workspace | Yes | No |
digest.weekly | The weekly summary: new Tier B matches, open alerts, and supported versions without an SBOM. Not sent when all three are zero | The workspace | Yes | No |
billing.event | Invoices, a failed payment, a stopped watch, and a notice before a trial ends | The workspace | Yes | No |
account.onboarding | A welcome when the workspace is created, and one reminder if nothing has been uploaded | The workspace | Yes | No |
member.invited | Someone invites a person to the workspace | The invited address | No | No |
A supplier request sends its own mail to the supplier you name. That is not a workspace notification and is not listed here. A shared SBOM link sends no mail: you pass it on yourself.
Events that are not emails
Three integration events have no email counterpart. They go to Slack, Teams, Jira and webhook integrations only:
case.created, when a case is openedcase.stage_submitted, when a stage is marked submittedcase.closed, when a case is closed
Drills send none of them. See the webhook event catalog for payloads and signing. Integrations need the Growth or Partner plan; email notifications are on every plan.