Palantir Senior Data Engineer: Anomaly Detection System Design

Swing Catalyst / Initial Force AS — Business Metric Anomaly Framework

Prepared in the style of a Palantir Foundry/AIP senior data engineer designing an anomaly detection pipeline for a B2B SaaS + hardware company. Covers baseline establishment, detection rules, root cause frameworks, seasonal adjustment, and historical anomaly audit.

1. Design Philosophy

Palantir approach to anomaly detection: Start with the business question, not the statistical method.

The purpose of anomaly detection at Swing Catalyst is not to flag unusual numbers. It is to answer three business questions:

1. Is something wrong that requires immediate action? (Cash position, critical churn spike)
2. Is something going unexpectedly right that we should amplify? (Tucker Nathans closing $120K+ despite $16K weighted forecast) [source: business-kpis.md]
3. Is there a signal we are systematically missing that predicts future outcomes? (Churn prediction from engagement patterns)

The detection system must differentiate between: noise (random variation), interesting (worth a Monday morning conversation), and critical (requires action today).

2. Baseline Establishment

Metric Baselines (as of April 2026)

Baseline Methodology

For each metric, establish a 3-layer baseline:

Layer 1: Rolling 90-day average — The recent trend. Used for detecting sudden deviations from current operating level.

Layer 2: Year-over-year same-period comparison — Used for detecting seasonal drift. January 2026 vs January 2025, not January 2026 vs December 2025.

Layer 3: Cohort baseline — For churn specifically, track per-cohort (month of acquisition) churn curves. A January 2026 cohort behaving differently from January 2025 cohort is a signal, even if aggregate churn looks stable.

[DATA GAP]: Monthly historical data for most metrics is not available in KB for Layer 1 or Layer 2 calculation. The baselines above are point-in-time snapshots. Full anomaly detection requires continuous time-series data piped from Stripe, HubSpot, and the backend systems.

3. Detection Rules: Specific Thresholds

Rule Set A: Revenue Anomalies

Rule Set B: Churn Anomalies

Rule Set C: Product Engagement Anomalies

Rule Set D: Financial / Cash Anomalies

4. Anomaly Classification: Noise vs. Interesting vs. Critical

Classification Framework

Noise (auto-dismiss):

• Single-week metric fluctuation within ±15% of 4-week rolling average [source: analyst estimate]
• Metric moves at year-end (Dec 31) where annual churn is structurally expected
• Hardware shipment gaps of 1–3 days (operational, not demand-side)
• Single-rep pipeline number fluctuating (e.g., Tucker's $16K weighted vs $120K won is not an anomaly — it is normal variation in enterprise deal timing) [source: business-kpis.md]

Interesting (brief investigation, Monday morning):

• Two consecutive weeks outside normal range
• Cross-metric correlation appears (see Multi-Variable Detection below)
• A specific customer segment's churn moves while others stay stable
• Free trial conversion rate deviating from trend for 2+ weeks

Critical (same-day action required):

• Cash position falls below 3 months runway
• Pro monthly churn > 8% in any month [source: analyst estimate]
• US invoiced revenue tracking to miss month target by >25% [source: analyst estimate]
• Zero hardware shipments for 7+ days
• Pro+ churn > 4% (structural loyalty break) [source: analyst estimate]
• Net negative subscriber growth for 2+ consecutive months

Existential (immediate CEO/board escalation):

• Cash position < 6 weeks runway
• ARR declining >5% month-over-month [source: analyst estimate]
• MLB account count falls below 20
• Stripe payment processor blocks or suspends the account

5. Root Cause Analysis Framework

For each Critical anomaly, a structured 3-step RCA:

Step 1: Isolation — Is this affecting one segment or all segments? One geography or all geographies? One time period or sustained?

Step 2: External vs. Internal — Is there an external cause (competitor launch, seasonal shift, macroeconomic) or internal cause (product issue, sales team change, pricing change)?

Step 3: Reversibility — Is this a one-time event (contract signed, comp plan changed) or a structural shift (fundamental product gap)?

Root Cause Lookup Table

6. Seasonal Adjustment

Golf Seasonality Calendar

Golf is meaningfully seasonal in North America (SC's 73% revenue region). [source: canonical-facts.yaml] The anomaly detection system must adjust thresholds by season to prevent false alarms.

Seasonal adjustment implementation:

For each monthly metric target, multiply by the seasonal adjustment factor:

Seasonally Adjusted Threshold = Annual_Average_Target × Monthly_Factor

# Example: Pro monthly churn alarm threshold
# base rate: 5.1% [source: customer-segments.md]
# May threshold: 5.1% x 1.15 = 5.9% (slightly higher tolerance in renewal month) [source: analyst estimate]
# August threshold: 5.1% x 0.90 = 4.6% (lower tolerance in sticky season) [source: analyst estimate]

Baseball Seasonality

Baseball has a counter-seasonal pattern vs. golf:

• MLB Opening Day (April) → high engagement
• All-Star Break (July) → slight dip
• Playoff push (September) → re-engagement
• Hot Stove / offseason (November–February) → equipment buying decisions

Tucker Nathans' pipeline should be evaluated with baseball calendar seasonality in mind. A Q4 pipeline dip is expected; Q1 hardware purchases (before Opening Day) are the baseball equivalent of the golf spring hardware cycle.

7. Multi-Variable Detection

Anomalies only visible when combining metrics

Pattern 1: Churn + Engagement Divergence

• Symptom: Monthly subscriber count stable, but takes/week declining
• What it means: Subscribers are staying but not using the product — "zombie subscriptions"
• Why it matters: Zombie subscriptions look fine in ARR metrics but are pre-churned; they will fall off at renewal
• Detection rule: (Takes_per_active_subscriber < 2/week) AND (Active_subscriber_count > 0) → flag as zombie risk
• Action: Proactive outreach, winback before renewal date

Pattern 2: Revenue + Churn Contradiction

• Symptom: Revenue growing MoM, but gross churn rate also rising
• What it means: New customer acquisition is masking an accelerating retention problem
• Why it matters: Leaky bucket — spending to fill a bucket that leaks faster; unsustainable CAC:LTV
• Detection rule: (MoM ARR growth > 0) AND (Gross churn rate > trailing 3-month average + 1.5pp) → flag as growth-masking-retention-problem
• Action: Investigate which cohort is churning; test whether new acquisition quality is degrading

Pattern 3: Hardware Volume + Software ARR Lag

• Symptom: Hardware units shipped spike, but software ARR flat for 60 days afterward
• What it means: Hardware customers are not activating software subscriptions (not converting to paid)
• Why it matters: Hardware margin is ~50%; software is ~100% — missing the software attach is a revenue miss [source: canonical-facts.yaml; industry benchmark]
• Detection rule: (Hardware_units_shipped > 1.5 × prior_30d_average) AND (Net_new_ARR_t+60 < expected_attach_rate × units × $600) → flag [source: analyst estimate; customer-segments.md]
• Action: Check onboarding completion rates for that hardware cohort; trigger automated email sequences

Pattern 4: Cash + Revenue Contradiction

• Symptom: Monthly invoiced revenue on target, but cash position declining
• What it means: Accounts receivable building up — customers invoiced but not paying
• Why it matters: Revenue looks fine; cash is the reality
• Detection rule: (Revenue MTD on target) AND (Cash_position declining > 15% MoM) → flag AR aging [source: analyst estimate]
• Action: Run AR aging report; follow up on invoices >30 days past due

Pattern 5: MLB Count + Support Ticket Volume

• Symptom: MLB account count stable, but support tickets from baseball accounts up >50% [source: analyst estimate]
• What it means: Product quality or reliability issue at enterprise level; pre-churn signal
• Why it matters: Losing an MLB account is a -$60K hardware + $3K ARR hit AND a reputation hit [source: analyst estimate]
• Detection rule: (MLB_account_count unchanged) AND (Support_tickets_from_MLB_accounts > 2× prior_30d_average) → flag
• Action: Tucker + Travis review all open MLB support tickets; proactive outreach to biomechanists

8. Alert Priority Scoring

Business Impact Score (BIS)

Each anomaly is scored on three dimensions: financial impact, reversibility, and time to harm.

BIS = (Financial_Impact_Score × 0.5) + (Reversibility_Score × 0.3) + (Time_to_Harm_Score × 0.2)

# Financial Impact scale [source: analyst estimate]
# 1 = <$10K impact
# 2 = $10–50K
# 3 = $50–200K
# 4 = $200K–$1M
# 5 = >$1M or existential

# Reversibility (1–5):
#   1 = Easily fixed in <1 day
#   3 = Requires 1–4 weeks
#   5 = Structural (6+ months to fix)

# Time to Harm (1–5):
#   1 = Harm in >6 months
#   3 = Harm in 1–3 months
#   5 = Harm already occurring

Priority Matrix for Key Anomalies

9. Investigation Playbook by Anomaly Type

Playbook: Pro Churn Spike (Rule C-001)

Trigger: Pro monthly churn > 8% [source: analyst estimate]

Step 1 (within 24 hours): Pull Stripe cancellation data for the alert period. Segment by: subscription type (monthly vs annual), acquisition channel, cohort month.

Step 2 (within 48 hours): Identify the top 10 churning accounts by ARR value. Check last support ticket date. Check last login/engagement date. Did they log in within 30 days of cancellation?

Step 3 (within 72 hours): Cross-reference with any changes in the prior 30 days: new software version released? Price change communicated? Competitor product launch announced?

Step 4 (within 1 week): Send exit survey to churned accounts (automated via Stripe webhook + email). Key questions: (1) Why did you cancel? (2) What would bring you back? (3) Did you move to a competitor?

Step 5 (within 2 weeks): If root cause identified as product-related, escalate to CTO. If sales-related, escalate to Carl/Seath. If price-related, analyze with pricing model.

Playbook: Cash Position Alert (Rule F-001)

Trigger: Cash runway < 3 months

Step 1 (within 24 hours): Erlend Svendsen confirms exact cash balance and 30-day forward projections. TC notified immediately.

Step 2 (within 48 hours): Activate bridge revenue options in priority order:

1. Stripe Capital loan disbursement (if not yet drawn)
2. SkatteFUNN credit-backed bank loan (process with auditor)
3. Accelerate any outstanding invoices >30 days: personal follow-up by Erlend
4. Request early payment from any distributor with pending orders

Step 3 (within 1 week): Evaluate Scenario A headcount reduction (Lean Viable = cut 12 people, saves ~1.5 MNOK/month). [source: downsize-to-profitability-model.md, Scenario A]

Step 4 (ongoing): Update cash runway daily until resolved. Board notification required if runway falls below 6 weeks.

Playbook: US Revenue Miss (Rule R-001)

Trigger: MTD trajectory tracking to miss monthly target by >25% [source: analyst estimate]

Step 1: Check rep activity — Are Seath and Tucker working the pipeline? Any travel, illness, or PTO?

Step 2: Review CRM pipeline for MTD. Did any expected deals slip? Pull "Expected Close" dates from HubSpot.

Step 3: Check if the miss is hardware-only (large deal slippage) or software-only (churn outweighing new sales). Different root causes.

Step 4: If hardware miss: escalate to Carl; activate emergency demo outreach to warm pipeline. If software miss: check if churn is elevated (run Rule C-001 check simultaneously).

10. Historical Anomaly Audit

Applying the detection rules retrospectively to documented events:

Event 1: Q1 2026 Revenue Miss (Jan–Feb 2026)

Observed: Jan–Feb 2026 sales came in ~3 MNOK below budget. [source: financials.md, Week 10]

Rule triggered: R-001 (US invoiced revenue miss). If the system had been running, the Week 2 January run rate would have triggered the alert by January 10.

Root cause per records: Below-budget January; seasonal gap; slow start to the sales sprint. Not a structural churn issue — the sprint recovered performance to $182K/month by March. [source: business-kpis.md]

Classification: Interesting → escalated to Critical based on accumulated miss over 2 months.

System response that should have occurred: Activate 30-day revenue sprint earlier (the company did this in Week 10; should have been Week 5). The 5-week delay cost approximately 1–1.5 MNOK in foregone revenue based on the sprint's demonstrated effectiveness.

Event 2: Pro Churn at 47.7% Annual (Sep 2025 trailing) [source: canonical-facts.yaml]

Observed: Annual Pro churn at 47.7% as of September 2025. [source: canonical-facts.yaml]

Rule triggered: C-002 (sustained elevation) — 47.7% annual = 5.1% monthly, which has been above the 6% threshold at spike months and consistently above the "Yellow" zone. [source: canonical-facts.yaml; customer-segments.md; analyst estimate]

Root cause per records: May 2025 price adjustment caused temporary spike. Monthly subscribers churn at 2–3x annual subscribers. 2023 churn was reportedly ~30%, worsening through 2024. [source: customer-segments.md]

Classification: Critical — sustained structural problem.

What the system should have flagged: The cohort analysis (Rule C-007) should have identified the May 2025 price-adjustment cohort as particularly high-risk at acquisition. Monthly subscribers acquired in May 2025 likely had a significantly higher 90-day churn rate than annual subscribers acquired in the same month.

January 2026 recovery signal: Churn in January 2026 was 62% lower than January 2025 in revenue terms ($10.1K vs $26.5K). [source: business-kpis.md] This is a genuine anomaly — a positive anomaly. The system should have flagged this as Interesting (positive) and prompted the team to investigate which specific interventions drove the improvement.

Event 3: Tucker Nathans: $16K Weighted → $120K+ Won (March 2026) [source: business-kpis.md]

Observed: Tucker had $16K weighted pipeline entering March; closed $120K+. [source: business-kpis.md]

Rule triggered: R-006 (revenue spike). Not a problem anomaly — a positive one.

Classification: Interesting (positive). This signals that enterprise deal timing (CRM pipeline weighting) is systematically underestimating Tucker's effectiveness. The weighted pipeline model for enterprise sales is unreliable when a single deal can be 7–8x the weighted estimate. [source: business-kpis.md; analyst estimate]

Insight: For Tucker's baseball pipeline, use unweighted pipeline count and deal size as the leading indicator, not CRM probability-weighted ARR. Enterprise baseball deals have high variance and should be modeled differently from Seath's golf Tier 2 pipeline.

Event 4: Bertec Sales Conflict (Q1 2026)

Observed: Bertec quoted directly to an SC customer, resulting in loss of ~$150K deal (Week 8). [source: competitive-landscape.md]

Rule triggered: This is not a standard metric anomaly but fits the MLB count anomaly rule — it represents potential loss of enterprise accounts due to supplier conflict.

Multi-variable detection: If the system had been tracking (a) MLB account count AND (b) support tickets mentioning "Bertec" OR "pricing comparison," it would have flagged the Bertec conflict cluster in Week 7–8 before the deal was lost.

Recommended rule addition: Create a keyword-based CRM alert: any HubSpot deal note mentioning "Bertec," "AMTI," "Smart2Move," or "competitor pricing" triggers a Tier 1 alert for immediate rep + Carl review.

11. Continuous Improvement — Tuning as the Business Evolves

When to retune thresholds

Feedback loop design

Every anomaly investigation should close with a structured record:

1. What triggered the alert? (Rule ID + threshold exceeded)
2. What was the root cause? (Internal / External / Noise)
3. What action was taken? (Within 24h, 1 week, 1 month)
4. Was the rule too sensitive / not sensitive enough? (Threshold calibration feedback)
5. Did the action work? (Post-action outcome)

This feedback loop enables the threshold parameters to be updated quarterly based on observed true-positive and false-positive rates, converging over time to a low-noise, high-signal system.

12. Implementation Roadmap

Phase 1: Now (Week 1–2) — Manual Monitoring

Given current resource constraints (no dedicated data engineer), implement a manual weekly monitoring sheet:

Google Sheet: "Anomaly Monitor — Weekly"
Tabs:
  - Revenue: US invoiced MTD, software ARR MoM
  - Churn: Monthly churn by tier (from Stripe)
  - Engagement: Takes/week (from backend)
  - Cash: Current balance, 30-day projection
  - MLB: Active account count

Owned by: Erlend (financial tabs) + Marcus (Stripe tabs) + Tucker (MLB)
Reviewed: Every Monday morning in 15-min standup

Phase 2: Month 2–3 — Stripe Automation

Marcus Guedes builds Stripe webhook → Google Sheet automation:

• Auto-populate churn events in real time
• Net subscriber change auto-calculated
• MoM ARR delta auto-calculated
• Alert email if any Rule Set B threshold crossed

Phase 3: Post-Bridge (Month 4–6) — Full Dashboard + Alerting

Implement Metabase or Looker Studio with:

• All 10 Deloitte Dashboard KPIs (see Analysis 05)
• Automated rule checks via scheduled queries
• Slack integration for Critical alerts
• Weekly email digest for Interesting patterns

Phase 4: Post-Series A — Palantir AIP or Equivalent

With Series A capital, invest in:

• Cohort survival curves (churn prediction)
• Per-subscriber engagement scoring (identifies zombie subscriptions 60 days before churn)
• Multi-variable detection pipelines
• A/B testing infrastructure (needed for pricing experiments, Rule Set A)

Note: This system is only as good as the data inputs. The most critical immediate investment is not in the detection system — it is in instrumenting the data gaps flagged throughout this analysis: free trial conversion rate, per-subscriber takes/engagement, monthly historical churn by cohort, and segmented CAC. Without this data, anomaly detection is operating on incomplete signals.