I looked into this and really like the idea of the service, but found there was one shortcoming that I couldn't get around. Perhaps I missed something, but I needed a much shorter escalation window than 15 minutes. If my site is down, I cannot wait for 15 minutes for the next person to be notified if the original person doesn't respond. It needs to be within 3-5 minutes, maximum. Perhaps this was configurable and I just missed it.
I really like this service and should the escalation change I would sign up in a heartbeat, it's exactly what I was looking for.
We left a comment on UserVoice, but I thought it couldn't hurt discuss here.
Yes, we do support custom escalation times. You can set the amount of time that the Primary on-call has to respond to an alert (after which it is escalated to the secondary). Likewise, you can set the time that the Secondary on-call has to respond to an alert, before it is escalated to the tertiary.
One of the Spreedly cofounders is a PCI expert, and we're building the application with PCI compliance in mind. Security's a big deal for us, and for now we're focused on the practicalities of being secure rather than the (expensive, time-consuming) trappings of being certified as secure. We'll definitely get our gold sticker eventually, but not quite yet. In the meantime, we have a constant focus on security and spend regular time looking at the platform through that lens.