Parachute
Parachute automates incident response by running configured runbooks when alerts match.
What Parachute is
Parachute automates incident response by running configured runbooks when alerts match. Teams can write runbooks in YAML or use a visual editor, version them in Git, and test them with simulated alerts. The service can isolate hosts through AWS, GCP, and Azure APIs, and collect logs, process lists, network flow captures, and memory snapshots into packaged, hashed evidence. Listed integrations include PagerDuty, Opsgenie, Datadog, Splunk, cloud providers, collaboration tools, ticketing systems, and Elastic/Kibana. Webhook-capable tools can trigger a runbook, while the REST API accepts custom alert ingestion. The maker says data in transit uses TLS 1.3 and stored data uses AES-256-GCM; inbound webhooks are checked with HMAC-SHA256 and a five-minute timestamp tolerance. It says customer incident data is not used to train AI models and evidence is removed after the configured retention period. The maker says SOC 2 Type II certification is planned but not yet achieved, and ISO 27001 is on its roadmap.
Good
- Runbooks can be written in YAML or a visual editor.
- Supports host isolation through AWS, GCP, and Azure.
- Collects and hashes incident evidence.
- Offers webhook triggers and custom alert ingestion through an API.
Watch out
- Developer alerts above 20 per month are queued, not run automatically.
- SOC 2 Type II certification is not yet achieved.
Who it suits
Parachute is aimed at lean security teams that want to automate alert-driven response and evidence collection. Its Developer plan has a 20-alert monthly limit for automatic execution.
Verdict
Parachute combines alert-triggered runbooks with host isolation and evidence collection. The free Developer plan limits automatic execution to 20 alerts per month; paid plans start at $49/mo.
Plans and prices
From Parachute's own pricing page, checked 5 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Starter | $49 a month | 1 workspace · 15 runbooks · Unlimited alerts · 3 users · 30-day evidence retention · Email support · Monthly |
| Professional | $149 a month | 3 workspaces · Unlimited runbooks · Unlimited alerts · 10 users · 90-day evidence retention · Priority email + Slack support · Monthly |
| Developer | — | 1 workspace · 3 runbooks · 20 alerts/month · 1 user · Community support · 7-day evidence retention · Monthly |
| Enterprise | Priced on request | Unlimited workspaces · Unlimited runbooks · Unlimited alerts · Unlimited users · Custom evidence retention · On-call SLA · Custom |
The facts
Each one read from Parachute's own pages, with the date it was checked.
What it does
- Compliance status
- The maker says SOC 2 Type II is planned but not yet certified, and ISO 27001 is a roadmap item.checked 5 Oct 2026
- Custom integrations
- Any tool that can send a webhook can trigger a runbook, and the REST API supports custom alert ingestion.checked 5 Oct 2026
- Data handling
- The maker says it does not use customer incident data to train AI models and deletes evidence after the configured retention period.checked 5 Oct 2026
- Encryption
- The security page states that data in transit uses TLS 1.3 and data at rest uses AES-256-GCM encryption.checked 5 Oct 2026
- Evidence collection
- It collects logs, process lists, network flow captures, and memory snapshots, then packages and hashes the evidence.checked 5 Oct 2026
- Host isolation
- Parachute supports automated host isolation through AWS, GCP, and Azure APIs.checked 5 Oct 2026
- Incident response automation
- Parachute automatically executes incident runbooks in response to matching alerts.checked 5 Oct 2026
- Integrations
- Listed integrations include PagerDuty, Opsgenie, Datadog, Splunk, AWS, GCP, Azure, Slack, Microsoft Teams, Jira, Linear, and Elastic/Kibana.checked 5 Oct 2026
- Intended users
- Parachute says it is built for lean security teams and describes its founders' experience supporting logistics and fintech teams across APAC.checked 5 Oct 2026
- Notable limit
- Developer plan alerts above 20 per month are queued but not automatically executed.checked 5 Oct 2026
- Runbook authoring
- Runbooks can be written in YAML or built with a visual editor, version controlled in Git, and tested with simulated alerts.checked 5 Oct 2026
- Support
- Support ranges from community support on Developer to email on Starter and priority email plus Slack on Professional.checked 5 Oct 2026
- Webhook protection
- Inbound webhooks are verified with HMAC-SHA256 signatures, with a five-minute timestamp tolerance to prevent replay attacks.checked 5 Oct 2026
The company
- Founded
- 2024checked 28 Sep 2026
- Headquarters
- Sydney, Australiachecked 28 Sep 2026
Alternatives to Parachute
- 1
7.2Free plan - 2

Tines
Free planWebAPILinuxSelf-hosted7.2Free plan - 3

Rundeck
Free planWebAPILinuxmacOS6.8Free plan - 4

StackStorm
Free planWebAPILinuxSelf-hosted6.4Free plan - 5
Shuffle
Free planWebAPILinuxSelf-hosted6.3Free plan - 6
Tracecat
Free planWebAPISelf-hosted6.3Free plan