A credit cooperative focused on healthcare professionals, Unicred needed to keep its transactional systems as available as those of a major bank. With per-product observability, Elven's 24x7 Command Center and an Incident Commander process, crises became the exception and the operation began acting before impact.
+
The Challenge
Unicred is a credit cooperative whose members are mostly physicians and healthcare professionals. As a financial institution, it operates under Central Bank of Brazil regulation and faces increasingly sophisticated cybercrime. Members can also use other banks, so the digital experience has to compete with them.
The operation, however, grew faster than its structure. Until recently, the company went through at least one war room a week, lasting 4 to 8 hours and involving 50 to 80 people from several areas, executives included. There were good professionals, but scattered, disconnected tools: finding the root cause meant bringing together someone from database, network, infrastructure, logs and each application, navigating dozens of dashboards.
"We were very lucky. Some things worked and we didn't know how. Today we are much better structured." — Cristiano Nes, Unicred
The Solution
The first step was to see the environment. In a 2024 task force, Unicred instrumented production with APM in about one week, bringing infrastructure, platform and product into the same room. From there, it worked with the teams to build a per-product observability model, with dashboards, indicators and SLOs replicated for each vertical.
Next, observability also reached the test and staging environments, collecting logs, metrics and traces without requiring any changes from the product teams. Problems started showing up before reaching production.
Operations and incident response
With Elven, Unicred set up the Command Center, a 24x7 operation that watches the environment around the clock. On top of that foundation, the two companies introduced the Incident Commander role: when something goes off track, the Incident Commander opens the war room, pages the people responsible, escalates and drives the incident to closure — including overnight, when fewer people are available.
As a result, the operation stopped depending on a specific person and started depending on a process. Whoever is investigating the problem stays focused on solving it, while command, communication and documentation are handled by defined roles, as a regulated environment requires.
"Besides the Command Center, the 24x7 operation that Elven runs, we implemented the Incident Commander. The person who reports can't be the person who fixes." — Cristiano Nes, Unicred
From a server room to a data center at Equinix, from support running on goodwill alone to an operation with clear roles: the evolution was built in stages, with mistakes, adjustments and consistency.
A data center in a server room, with no integrated monitoring. Support was handled on call, with one team helping another.
In March 2020, the 24x7 monitoring and NOC operation began, still with another partner.
Two years of exchanging ideas before the decision. What tipped the scale was mindset alignment: a partnership relationship, not a vendor one.
Production instrumented in one week, a per-product observability model and the 24x7 operation with Elven.
DevOps embedded in the product teams, a reliability engineering team focused on observability and a dedicated platform engineering team.
A standardized pipeline for all services, observability in staging and preventive rituals that anticipate problems before they become a crisis.
Fewer crises, smaller and shorter war rooms, and an operation that acts on the environment's behavior before the impact reaches members.
Incidents that brought the company to a halt fell significantly in the very first year, and the goal is to keep reducing what remains.
Instead of 50 to 80 people for hours, each incident brings together only those who actually solve it, with the root cause identified and an action defined.
Command Center and Incident Commander ensure a response at any hour, backed by process and roles, not by one person's availability.
Behavior changes after a change window are spotted early, and the team acts before they become a crisis. Preventive war rooms replaced the hunt for someone to blame.
Test and staging instrumented with logs, metrics and traces, with no extra work for the product teams.
Pipelines that used to have around 100 lines now have 10, with quality, security and GitOps built in. The migration reached 100% of services in half the planned time.
The deal has to be good for both sides. We don't treat them as a vendor but as a partner, and Elven's mindset was very much in line with how we thought.
The Partnership
Elven has supported Unicred from building its SRE and cloud teams to day-to-day operations. The work went beyond tooling: it involved defining incident response roles, creating preventive rituals and bringing SRE practices such as blameless culture, launch checklists and shift left into the operation.
The result is a culture in which tool adoption spreads organically to other teams, and in which availability stops being "infrastructure's problem" and becomes a shared responsibility.
Why it works
No stage was perfect on the first try. Team names changed, strategies were reworked and some models didn't work. What made the difference was consistency: moving forward a little each week and looking back after a year to see how much had changed.
"Sometimes it feels like you make little progress each week. Then you look back, a year later, and the difference is huge." — Bruno, Elven
Just like Unicred, count on Elven for observability, a 24x7 Command Center and incident response, with clear processes and roles.
