11. Managed Accounts

CertKit supports Managed Service Providers (MSPs) and enterprises managing multiple corporate entities or client organizations through a secure, multi-tenant architecture.

When MSP mode is enabled for your account, administrators can provision and manage isolated Client Accounts directly from a single central portal.

Multi-Tenant Isolation

Each Client Account operates as a completely independent tenant:

• Isolated Resources: Each client account has its own isolated certificate collections, agents, domain monitoring targets, and activity logs.
• Privacy and Security: Clients have no visibility or access to other client accounts or the parent MSP account.
• Managed Subscription: Client accounts are automatically provisioned under a specialized Managed plan. This allows the MSP to handle pricing, billing, and packaging directly with their clients.

Staff Delegation and Access Control

MSP accounts support granular access delegation for technicians and support staff:

• MSP Administrators: Automatically have full read/write access to all managed client accounts.
• MSP Staff (Non-Admins): Can be selectively assigned to specific client accounts. Staff members will only see and be able to switch into client accounts to which they have been explicitly granted access, preventing unauthorized internal access.

Account Context Switching

Authorized MSP users can seamlessly “switch context” into any of their client accounts from the dashboard:

• Direct Management: While managing a client account, your session acts as an administrator for that tenant, allowing you to configure agents, manage certificate collections, or troubleshoot issuances.
• Credential Safety: No separate logins, user accounts, or shared passwords are required for staff members.
• Audit Compliance: All context-switched sessions and actions are logged under both the client and MSP audit trails, ensuring complete visibility and accountability.

Custom Co-Branding

MSPs can customize client-facing portals to display their own branding and contact details instead of CertKit’s defaults:

• Brand Customization: Set a custom MSP Name and upload distinct logos for both Light and Dark themes.
• Integrated Support: Configure custom Support Emails, Support Phone Numbers, and Homepage URLs.
• Client Touchpoints: Client-specific screens—such as the contact form and subscription pages—will display the MSP’s branding, redirecting support inquiries and billing conversations directly to the provider.