# For MSSPs & MDR providers

> Threat intelligence platform for MSSPs: every client from one console on your infrastructure, a database per tenant, branded reports, unlimited analysts.

Source: https://wahukeza.com/solutions/mssp

Solutions · MSSPs & MDR providers

## Every client from one console. A database for each.

Deliver threat intelligence to every client without running a separate platform per tenant, from your own infrastructure, with the isolation a compliance reviewer expects and the deliverable your retainer is priced on.

[Request a technical isolation review](https://wahukeza.com/contact?intent=isolation-review)

[Partner programme](https://wahukeza.com/partners)

The provider problem

## Four things that decide the deal, in the order providers raise them.

-   ### One instance per client destroys margin
    
    Every client on its own OpenCTI or MISP is another upgrade cycle, another backup, another set of credentials; and the overhead scales linearly with the thing you are trying to grow.
    
-   ### Isolation that survives a compliance review
    
    A shared schema with a tenant column is a filter, and a reviewer knows it. A database per tenant is an answer.
    
-   ### The deliverable your retainer is priced on
    
    Clients pay for evidence. A scheduled, branded, per-client intelligence report (what hit them, what was blocked, what was unique to their sensors) is the artefact that renews the contract.
    
-   ### Seats should not be the meter
    
    Per-analyst licensing punishes the provider that grows its team. Every package covers unlimited analysts, with MFA, scoped API keys and a hash-chained audit log; SSO and SCIM are the Enterprise Identity module.
    

One console, every client

## A database per tenant. Not a shared schema with a filter on it.

Every client gets its own database, its own background jobs and its own branded report on a schedule. The operator control plane sits above them and never queries across them: roll-ups go through the API, by design. Provider licensing is by arrangement, through the partner programme.

-   Tenant isolation
    
    Database-per-tenant, tenant-resolution middleware, unknown tenant is a 403.
    
-   Unlimited analysts
    
    No per-seat charge. MFA, scoped API keys and a hash-chained audit log in every package.
    
-   Per-client deliverables
    
    Scheduled, branded reports e-mailed as PDF or pushed by webhook; attribution and targeting reports with Advanced AI Intelligence.
    
-   Collective immunity
    
    One sensor meets the attacker; every tenant gets the block.
    

[For MSSPs & MDR providers](https://wahukeza.com/solutions/mssp)

Operator control planePlatformOperator

-   client-01
    
    db · jobs · report
    
-   client-02
    
    db · jobs · report
    
-   client-03
    
    db · jobs · report
    
-   client-04
    
    db · jobs · report
    
-   client-05
    
    db · jobs · report
    
-   client-06
    
    db · jobs · report
    

Roll-ups aggregate through the API and shared intelligence moves through the exchange, never through cross-database queries.

The MSSP console

## What multi-tenant means when it is architecture, not a filter.

-   PlatformOperator
    
    ### A real control plane
    
    Operators provision tenants, licences and exchange instances from a role that customer-tenant admins cannot reach. Cross-tenant data never flows through ad-hoc queries, only the exchange.
    
-   per-tenant jobs
    
    ### Fan-out with isolation
    
    Feed jobs fetch a source once and ingest into every tenant database; one tenant failing never stops the rest. Each tenant has its own schema version and degraded state.
    
-   ReportSchedules
    
    ### Branded, scheduled, per client
    
    Attribution, targeting-by-country and exclusive-intelligence reports rendered to PDF and delivered by e-mail or webhook on a cron you set.
    
-   ProtectedAssetGroups
    
    ### Client assets as first-class objects
    
    Sensors, brands and CIDRs grouped per client, so targeting and sightings roll up to the entity that pays the invoice.
    
-   Exchange
    
    ### Collective immunity across your book
    
    One client’s sensor meets an attacker; every client gets the block. Give-to-get keys, sector scoping and poisoning counters keep it honest.
    
-   Limits.\*
    
    ### Metering that matches your offer
    
    Sensors, mailboxes, endpoints, Android devices and attack-surface seeds are counted per tenant, so the service you sell each client can follow the licence file.
    

Onboarding a client

## Four steps from signed contract to first report.

1.  01
    
    ### Provision the tenant
    
    One call creates the database, runs migrations and issues the tenant’s admin. Your operator role never becomes a member.
    
2.  02
    
    ### Point a sensor
    
    A Pi, a container or an appliance, wearing the persona that fits the client’s estate, or a clone of the client’s own device. Two keys: ingest and config.
    
3.  03
    
    ### Wire enforcement
    
    The client’s firewall pulls an EDL, a Fortinet list or RPZ with ETag polling; sightings come back on the same key.
    
4.  04
    
    ### Schedule the report
    
    Monthly, branded, per client. The first one is the moment the retainer makes sense to them.
    

The second tenant

## The moment it pays for itself.

A provider’s first tenant proves the platform works. The second proves the model: same operator, same infrastructure, one more database, and no new instance to patch. Everything after that is margin.

[Provider licensing & partner programme](https://wahukeza.com/partners)

operator effort per clientillustrative

Clients →. Per-instance effort grows with every client; per-tenant effort is one migration job.

## Bring your hardest isolation question.

A technical isolation review walks a compliance reviewer through the tenancy model, the control plane and the identity stack on a live deployment.

[Book a demo](https://wahukeza.com/contact?intent=demo)

[Why Wahukeza](https://wahukeza.com/why)