Real-time alerts

The alert reaches the phone, not the bottom of an inbox

Push notifications in the app and in the browser for whatever cannot wait: a payslip published, a leave request awaiting approval, a non-conformity assigned or a certificate about to expire.

What a push is for, and when it gets in the way

Internal email stopped working for urgent matters a long time ago: it lands alongside forty others and gets read whenever it gets read. A push notification appears on screen the moment the event happens, and in Kimobox it is not fired off from a template but driven by rules: each event has a defined audience, urgency and channel. What is not urgent is grouped into a digest, and what is important and goes unopened escalates to email and then to the manager.

Content reviewed on 26 August 2026

Web standard: RFC 8030 Generic event delivery over HTTP: the basis of push in the browser
Content encryption: RFC 8291 The message travels encrypted end to end; the delivery service cannot read it
Sender identification: RFC 8292 (VAPID) The sending server identifies itself to the delivery service with its own key
User permission: Explicit and revocable Without browser or system permission nothing is sent, and it can be withdrawn at any time
Commercial alerts: Article 21 of the Spanish LSSI Commercial messages by electronic means require prior consent; a service alert is not one
Alert content: Article 5(1)(c) of the GDPR Minimisation: the push carries the headline, not the data
Safari on iPhone: Web Push from iOS 16.4 Requires the person to have added the site to their home screen

Mobile and browser

Alerts in the iOS and Android apps and in the desktop browser through Web Push, the standard defined in RFC 8030.

Rules per event

Who receives what is set by event and by role: the approver gets the request, the requester gets the answer, and nobody else finds out.

A digest instead of a drip

Low-urgency alerts are grouped into a daily summary. The inbox stops being noise and the urgent alert stands out again.

No sensitive data in the alert

The push carries the headline and the link; the content is read inside, once signed in. Anyone can read a notification on a lock screen.

+ info

Escalation to email

If an important alert goes unopened within its deadline, it is resent by email and, if still unread, escalates to the manager.

Delivery and reading recorded

When it was sent, when it was delivered and when it was opened. That is the difference between assuming someone knew and being able to prove it.

What gets flagged

Events notified out of the box

A payslip, contract or notice available in the employee portal
A leave request awaiting approval, and its outcome for the requester
A non-conformity assigned, a corrective action overdue or an internal audit coming up
A certificate, insurance policy, PPE item or training course about to expire
A document awaiting signature, with a reminder before the deadline
A clock-in left open at the end of the working day
An expense or invoice above policy that needs approval
Contractor paperwork rejected or expired in the contractor portal

Real examples

Alerts that arrive in time and alerts that arrive too late

HR · publishing payslips

The 28th of the month and the same forty phone calls

Before A mass email to the whole workforce saying the payslip is available. Whoever misses it calls the admin team, and the admin team spends the last week of the month repeating the same sentence.

After A push alert the moment the payslip lands in the portal, with a per-person read receipt. Anyone who has not opened it in three days gets a reminder, and only then appears on the outstanding list.

Quality · non-conformities

A corrective action that expires with nobody watching

Before The non-conformity is assigned in the system and sits there. The owner finds out at the monthly meeting, once the deadline has passed and the delay has to be explained to the auditor.

After An alert on assignment, a reminder three days before the deadline and escalation to the quality manager if it expires. The alert history travels with the non-conformity into the audit.

Contractor management · supplier paperwork

An expired insurance policy discovered at the gate

Before A contractor's certificate expired two weeks ago. It comes to light when their operator is already at the plant gate and cannot be authorised to enter.

After An alert thirty days before expiry to the contractor and the internal owner, with reminders at fifteen days and at five. Access stops failing by surprise.

Vocabulary

The vocabulary of notifications

Push notification: An alert the server sends to the device on its own initiative, without the application having to ask whether there is anything new.
Web Push: A set of IETF standards — RFC 8030, 8291 and 8292 — that lets a website send notifications to the browser even when the tab is closed.
VAPID: Voluntary identification of the sending server to the delivery service, defined in RFC 8292. It stops a third party sending alerts on someone else's behalf.
Device token: The identifier the operating system assigns to an app installation so alerts can be delivered to it. It is personal data whenever it allows the alert to be tied to a person.
Service worker: The browser component that runs in the background and receives the alert when the site's tab is not open. It is what makes push on the web possible.
Commercial communication: A message whose purpose is to promote a product or a service. It requires the recipient's prior consent and an easy way to object, unlike a service alert.
Read receipt: A record that the recipient opened the alert, with its date and time. For employment paperwork it is what evidences the document was made available.
Escalation: A rule that forwards an unattended alert through another channel or to another person once a deadline passes. It stops something important stalling in an inbox.

Frequently asked questions

What people ask us before getting started

What is a push notification?

An alert the server sends to the device without the person having to open anything. Unlike email, it does not wait for somebody to check an inbox: it appears on screen the moment the event that triggered it occurs.

Does it work in the browser or only in the app?

Both. In the browser it relies on Web Push, the standard defined in RFC 8030 and implemented by Chrome, Firefox, Edge and Safari. On mobile, it uses native iOS and Android notifications.

Does it work on an iPhone?

Yes. The mobile app receives native notifications, and browser push works in Safari from iOS 16.4 onwards, provided the person has added the site to their home screen.

Is consent needed?

To enable them, yes: the browser and the operating system ask for explicit permission, which can be withdrawn at any time. The content is a separate matter: a service alert — your payslip is available — is not advertising, whereas a commercial message by electronic means requires prior consent under article 21 of the Spanish LSSI.

What information travels in the alert?

The headline and the link, nothing more. The detail is read inside the platform, already signed in. It is a direct application of the minimisation principle in article 5 of the GDPR, and it also stops a lock-screen alert showing bystanders what it should not.

Can the delivery service read it?

No. The message content travels encrypted end to end under RFC 8291, so the browser's delivery service carries the alert without being able to read it.

Can you tell whether the alert was read?

Yes: the send, delivery and open times are all recorded. For employment paperwork, that trail is what evidences the document was made available.

How do you stop people muting them?

By sending fewer. Rules per event and per role avoid copying in half the company, low-urgency alerts are grouped into a digest, and each person sets the hours they want to receive them. A channel that flags everything ends up flagging nothing.

What about people without the app installed?

They get the same alert by email. The channel changes; the rule deciding who needs to know does not.

See in the demo how an alert is configured

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

RFC 8030: Generic Event Delivery Using HTTP Push IETF · December 2016
RFC 8291: Message Encryption for Web Push IETF · November 2017
RFC 8292: Voluntary Application Server Identification (VAPID) for Web Push IETF · November 2017
Spanish Law 34/2002 (LSSI), article 21: commercial communications by electronic means BOE-A-2002-13758 · 12 July 2002
Regulation (EU) 2016/679 (GDPR), article 5: principles relating to processing EUR-Lex · 27 April 2016

Push notifications on mobile and browser, with rules per event

Kimobox sends push notifications to the iOS and Android mobile apps and to the browser through Web Push, the IETF standard defined in RFC 8030, 8291 and 8292, with end-to-end encrypted content and identification of the sending server.

Alerts are configured by event and by role — payslip publication, leave approval, non-conformities, certificate expiry, documents awaiting signature — with grouping into digests, escalation to email, and a record of delivery and reading for every notification.