Grovia Vault was built with MSPs in mind from day one. Multi-tenant isolation, enrollment tokens for zero-touch deployment, and a unified threat console — everything you need to deliver world-class cyber resilience to your clients.
Traditional backup tools treat every client as a separate deployment — separate logins, separate dashboards, separate configurations. Grovia Vault gives you a single pane of glass across your entire client portfolio.
Each client exists in a completely isolated tenant. PostgreSQL Row-Level Security (RLS) policies enforce isolation at the database layer — it is architecturally impossible for one client's data to appear in another client's view, even in the event of an application bug. Client A cannot see, modify, or delete Client B's backups, policies, or alerts.
Generate a unique enrollment token for each client from the MSP console. Embed the token in your deployment script or RMM tool. When the Grovia Vault agent installs, it automatically authenticates with the token, associates itself with the correct client tenant, and pulls the configured backup policy — zero manual configuration required.
All threat events across every client surface in a single, time-ordered alert feed in your MSP console. Each alert includes the client name, device name, threat score, detection layers triggered, and the specific file that raised the flag. No more checking each client dashboard individually — incidents find you.
Create a standard backup policy template once — backup paths, schedule, retention, bandwidth limit, threat-response action — and apply it to all new clients instantly. Customise individual clients as needed without affecting the template. Bulk policy updates propagate to all enrolled agents within 60 seconds of the next poll cycle.
Drill into any client to see device-level backup health, storage consumption, threat score history, restore history, and compliance status. Generate white-label reports for monthly business reviews. Track backup success rates, missed backup windows, and data growth trends per client over time.
Enforce TOTP-based multi-factor authentication for all users within a client tenant from the MSP console — without requiring client cooperation. Revoke sessions, force MFA re-enrollment, and audit login history for any client from your single MSP dashboard. Essential for clients in regulated industries.
Grovia Vault's multi-tenant architecture isn't just a naming convention — it's enforced at every layer of the stack.
Every table in PostgreSQL has a tenant_id column. Row-Level Security (RLS) policies are attached to every table, filtering all queries to the current session's tenant_id. No SELECT, UPDATE, INSERT, or DELETE query can cross tenant boundaries — even if the application code contains a bug.
Backup chunks in Wasabi, B2, and S3 are stored under a per-tenant path prefix: tenants/{tenant_id}/. Presigned URLs are scoped to that prefix. An agent from Tenant A cannot generate a valid URL pointing to Tenant B's storage path — the API validates tenant context on every presign request.
JWT tokens include a tenant_id claim signed with HS256. Every API endpoint validates the claim before executing any query. MSP users can use impersonation tokens — short-lived JWTs scoped to a specific client tenant — to provide support without sharing client credentials.
When a client needs support, MSP admins can generate a short-lived impersonation token from the MSP console. This creates a temporary JWT scoped to that client's tenant, with a 30-minute expiry and full audit logging. The MSP engineer sees exactly what the client sees — without the client sharing their credentials, and with a complete audit trail.
Add a new client in the MSP console. Fill in the client's name, industry, and compliance requirements. Grovia Vault automatically provisions an isolated tenant with its own storage namespace and RLS policies.
Apply a policy template (or create a custom policy) for the client. Generate an enrollment token. The token contains the tenant ID and policy reference — everything the agent needs to self-configure.
Push the one-liner install script via your RMM tool (ConnectWise, Datto, NinjaRMM, etc.) with the enrollment token embedded. The agent installs, self-configures, and registers — zero user interaction required.
All client devices appear in your MSP console within minutes of installation. Monitor backup health, respond to threats, and generate compliance reports — all from one place.
Enterprise/MSP plan includes unlimited clients, unlimited devices, white-label options, and a dedicated account manager. Let's talk.