For Managed Service Providers

Manage every client's
backup from one place

Grovia Vault was built with MSPs in mind from day one. Multi-tenant isolation, enrollment tokens for zero-touch deployment, and a unified threat console — everything you need to deliver world-class cyber resilience to your clients.

The MSP Advantage

Scale your protection practice without scaling your team

Traditional backup tools treat every client as a separate deployment — separate logins, separate dashboards, separate configurations. Grovia Vault gives you a single pane of glass across your entire client portfolio.

  • One dashboard for all clients — no context switching
  • Enrollment tokens for zero-touch agent deployment
  • Policy templates push to all client agents in 60 seconds
  • Unified threat alert feed — spot incidents across all clients instantly
  • Per-client analytics and monthly compliance reports
  • Impersonation mode for support without sharing credentials
  • PostgreSQL RLS guarantees complete data isolation between clients
MSP Console — Multi-Client View ● ALL SYSTEMS PROTECTED
Client 1 🏦 Kotak Finserv — 12 devices · Last backup 4m ago HEALTHY
Client 2 🏥 Apollo Clinics — 8 devices · Last backup 12m ago HEALTHY
Client 3 ⚠️ Mehta Exports — entropy spike on ACCOUNTS-PC WATCH
Client 4 🏭 Bharat Steel — 24 devices · Last backup 2m ago HEALTHY
Client 5 🛒 RetailMax — M365 sync complete · 3,421 items SYNCED

Six capabilities built for the MSP model

🏢

Multi-Tenant Isolation

Each client exists in a completely isolated tenant. PostgreSQL Row-Level Security (RLS) policies enforce isolation at the database layer — it is architecturally impossible for one client's data to appear in another client's view, even in the event of an application bug. Client A cannot see, modify, or delete Client B's backups, policies, or alerts.

🎟️

Enrollment Tokens

Generate a unique enrollment token for each client from the MSP console. Embed the token in your deployment script or RMM tool. When the Grovia Vault agent installs, it automatically authenticates with the token, associates itself with the correct client tenant, and pulls the configured backup policy — zero manual configuration required.

🔔

Unified Threat Alerts

All threat events across every client surface in a single, time-ordered alert feed in your MSP console. Each alert includes the client name, device name, threat score, detection layers triggered, and the specific file that raised the flag. No more checking each client dashboard individually — incidents find you.

📋

Policy Templates

Create a standard backup policy template once — backup paths, schedule, retention, bandwidth limit, threat-response action — and apply it to all new clients instantly. Customise individual clients as needed without affecting the template. Bulk policy updates propagate to all enrolled agents within 60 seconds of the next poll cycle.

📊

Per-Client Analytics

Drill into any client to see device-level backup health, storage consumption, threat score history, restore history, and compliance status. Generate white-label reports for monthly business reviews. Track backup success rates, missed backup windows, and data growth trends per client over time.

🔐

MFA Enforcement

Enforce TOTP-based multi-factor authentication for all users within a client tenant from the MSP console — without requiring client cooperation. Revoke sessions, force MFA re-enrollment, and audit login history for any client from your single MSP dashboard. Essential for clients in regulated industries.

Multi-tenant isolation, explained

Grovia Vault's multi-tenant architecture isn't just a naming convention — it's enforced at every layer of the stack.

🗄️ Database Layer

Every table in PostgreSQL has a tenant_id column. Row-Level Security (RLS) policies are attached to every table, filtering all queries to the current session's tenant_id. No SELECT, UPDATE, INSERT, or DELETE query can cross tenant boundaries — even if the application code contains a bug.

☁️ Storage Layer

Backup chunks in Wasabi, B2, and S3 are stored under a per-tenant path prefix: tenants/{tenant_id}/. Presigned URLs are scoped to that prefix. An agent from Tenant A cannot generate a valid URL pointing to Tenant B's storage path — the API validates tenant context on every presign request.

🔑 Auth Layer

JWT tokens include a tenant_id claim signed with HS256. Every API endpoint validates the claim before executing any query. MSP users can use impersonation tokens — short-lived JWTs scoped to a specific client tenant — to provide support without sharing client credentials.

Impersonation for Support

When a client needs support, MSP admins can generate a short-lived impersonation token from the MSP console. This creates a temporary JWT scoped to that client's tenant, with a 30-minute expiry and full audit logging. The MSP engineer sees exactly what the client sees — without the client sharing their credentials, and with a complete audit trail.

# MSP Admin generates impersonation token POST /api/v1/msp/impersonate Authorization: Bearer <msp_admin_jwt> { "target_tenant_id": "t_client_mehta_exports", "expires_in": 1800, // 30 minutes "reason": "Support ticket #4821 — restore investigation" } # Response { "impersonation_token": "eyJhbGciOiJIUzI1NiJ9...", "expires_at": "2025-07-24T15:30:00Z", "scoped_to": "t_client_mehta_exports", "audit_id": "aud_imp_xyz789" } # All actions taken with this token are logged: # audit_log: { actor: "msp_admin_jitu", # target_tenant: "mehta_exports", # action: "impersonation_session", # duration_min: 28, # actions_taken: ["view_backup_list", "initiate_restore"] }

How MSPs deploy Grovia Vault

1

Create Client Tenant

Add a new client in the MSP console. Fill in the client's name, industry, and compliance requirements. Grovia Vault automatically provisions an isolated tenant with its own storage namespace and RLS policies.

2

Configure & Generate Token

Apply a policy template (or create a custom policy) for the client. Generate an enrollment token. The token contains the tenant ID and policy reference — everything the agent needs to self-configure.

3

Deploy via RMM

Push the one-liner install script via your RMM tool (ConnectWise, Datto, NinjaRMM, etc.) with the enrollment token embedded. The agent installs, self-configures, and registers — zero user interaction required.

4

Monitor & Report

All client devices appear in your MSP console within minutes of installation. Monitor backup health, respond to threats, and generate compliance reports — all from one place.

RMM Integration: Grovia Vault's REST API allows deep integration with your RMM and PSA tools. Create clients, generate tokens, pull backup health status, and receive webhooks for threat events — all programmatically. Contact info@groviavault.com for API documentation.
MSP Partnership

Start your MSP partnership today

Enterprise/MSP plan includes unlimited clients, unlimited devices, white-label options, and a dedicated account manager. Let's talk.