Solutions · MSSPs & MDR providers
Every client from one console. A database for each.
Deliver threat intelligence to every client without running a separate platform per tenant, from your own infrastructure, with the isolation a compliance reviewer expects and the deliverable your retainer is priced on.
The provider problem
Four things that decide the deal, in the order providers raise them.
One instance per client destroys margin
Every client on its own OpenCTI or MISP is another upgrade cycle, another backup, another set of credentials; and the overhead scales linearly with the thing you are trying to grow.
Isolation that survives a compliance review
A shared schema with a tenant column is a filter, and a reviewer knows it. A database per tenant is an answer.
The deliverable your retainer is priced on
Clients pay for evidence. A scheduled, branded, per-client intelligence report (what hit them, what was blocked, what was unique to their sensors) is the artefact that renews the contract.
Seats should not be the meter
Per-analyst licensing punishes the provider that grows its team. Every package covers unlimited analysts, with MFA, scoped API keys and a hash-chained audit log; SSO and SCIM are the Enterprise Identity module.
One console, every client
A database per tenant. Not a shared schema with a filter on it.
Every client gets its own database, its own background jobs and its own branded report on a schedule. The operator control plane sits above them and never queries across them: roll-ups go through the API, by design. Provider licensing is by arrangement, through the partner programme.
Tenant isolation
Database-per-tenant, tenant-resolution middleware, unknown tenant is a 403.
Unlimited analysts
No per-seat charge. MFA, scoped API keys and a hash-chained audit log in every package.
Per-client deliverables
Scheduled, branded reports e-mailed as PDF or pushed by webhook; attribution and targeting reports with Advanced AI Intelligence.
Collective immunity
One sensor meets the attacker; every tenant gets the block.
client-01
db · jobs · report
client-02
db · jobs · report
client-03
db · jobs · report
client-04
db · jobs · report
client-05
db · jobs · report
client-06
db · jobs · report
The MSSP console
What multi-tenant means when it is architecture, not a filter.
PlatformOperator
A real control plane
Operators provision tenants, licences and exchange instances from a role that customer-tenant admins cannot reach. Cross-tenant data never flows through ad-hoc queries, only the exchange.
per-tenant jobs
Fan-out with isolation
Feed jobs fetch a source once and ingest into every tenant database; one tenant failing never stops the rest. Each tenant has its own schema version and degraded state.
ReportSchedules
Branded, scheduled, per client
Attribution, targeting-by-country and exclusive-intelligence reports rendered to PDF and delivered by e-mail or webhook on a cron you set.
ProtectedAssetGroups
Client assets as first-class objects
Sensors, brands and CIDRs grouped per client, so targeting and sightings roll up to the entity that pays the invoice.
Exchange
Collective immunity across your book
One client’s sensor meets an attacker; every client gets the block. Give-to-get keys, sector scoping and poisoning counters keep it honest.
Limits.*
Metering that matches your offer
Sensors, mailboxes, endpoints, Android devices and attack-surface seeds are counted per tenant, so the service you sell each client can follow the licence file.
Onboarding a client
Four steps from signed contract to first report.
01
Provision the tenant
One call creates the database, runs migrations and issues the tenant’s admin. Your operator role never becomes a member.
02
Point a sensor
A Pi, a container or an appliance, wearing the persona that fits the client’s estate, or a clone of the client’s own device. Two keys: ingest and config.
03
Wire enforcement
The client’s firewall pulls an EDL, a Fortinet list or RPZ with ETag polling; sightings come back on the same key.
04
Schedule the report
Monthly, branded, per client. The first one is the moment the retainer makes sense to them.
The second tenant
The moment it pays for itself.
A provider’s first tenant proves the platform works. The second proves the model: same operator, same infrastructure, one more database, and no new instance to patch. Everything after that is margin.
Bring your hardest isolation question.
A technical isolation review walks a compliance reviewer through the tenancy model, the control plane and the identity stack on a live deployment.