Built for MSPs
Built the way you actually deliver service
You run one platform across every client, deploy through the RMM you already own, and bill by the handful of people who log in — not the workforce you monitor. SnitchOS starts from the MSP: isolation enforced at the database and storage layers, per-tenant white-labeling, a support desk, and automatic monthly invoicing built for resale.
RMM deployment
Push it through the RMM you already run.
Download a per-customer install script with the tenant ID and fleet key already baked in, then deploy it silently through your fleet tooling. No per-machine arguments to template, no manual wiring.
Download the per-tenant bundle
The dashboard generates a signed .ps1 or .cmd install script for the customer, with the tenant ID and fleet enrollment key already embedded. Nothing to hand-edit before it ships.
Deploy silently to the fleet
Push it through NinjaOne, Datto RMM, ConnectWise, Kaseya, N-able, or Microsoft Intune and Group Policy. The signed MSI installs quietly, so Windows SmartScreen stays out of the way.
Devices report within a minute
Each endpoint enrolls itself and appears in the right tenant in about 60 seconds, reporting its OS edition and build. No touching the machine again.
Signed MSI, quiet installs
The MSI and all three agent executables are code-signed by Azure Trusted Signing as CN=Shield Management Inc and RFC3161-timestamped, so SmartScreen and enterprise AV stay quiet on rollout.
Fleet-key rotation
Rotate a customer's enrollment key whenever you need to, guarded by a row-lock and a partial unique index so keys never collide. Old bundles stop enrolling, new ones take over.
Signed auto-update
Agents self-update only when no interactive session is present, verify the Authenticode publisher, SHA-256, and a signed manifest before touching SYSTEM, and refuse downgrades.
Multi-tenant
One login across every client, isolation you can prove.
Sign in once as super-admin and move between every client tenant from the sidebar. Give each Manager the customers they own and nothing more. Isolation is enforced at three layers, so a cross-tenant request returns a 404, not someone else's data.
- One super-admin login across every client tenant, with an organization overview on top
- Manager seats scoped to one or more tenants — they see only what you grant
- Isolation at the database row, the object-store key, and the API scope check
- A single Microsoft Entra SSO identity that carries across the tenant fence
- Users & Groups that roll up into every report and the live board
Manage Tenants
A single console lists every customer with a three-step onboarding wizard: create the tenant, provision its SSO admins, and mint its first enrollment key.
Users & Groups
Build named cohorts inside a tenant that roll up across reports, the Right Now board, and Team views without re-tagging anyone twice.
Type-the-slug deletion
Offboarding a customer purges its endpoint data once you type the tenant slug to confirm, while audit and financial records are deliberately retained.
White-label
Your customer sees their brand, not ours.
Set a display name, accent color, and logo per tenant, and they carry across the tenant dashboard, the suspended-account page, and the invoice PDFs your customer receives. Announcements and the weekly digest email go out under the same brand, on your schedule.
- Per-tenant display name, accent color, and sanitized logo across the dashboard shell
- The same brand on the suspended page and on invoice PDFs
- A weekly digest email you can preview and send on demand
- Announcements you can brand, target per tenant, and schedule to an active window
Roles & team
Give the right people the right reach.
Seats and roles are separate levers. A seat decides how many tenants someone can touch; a role decides whether they can change anything. Both are enforced server-side, at the authentication chokepoint.
Admin vs Manager seats
An Admin seat reaches every tenant; a Manager seat is scoped to one or more customers. Both are billed the same and cost nothing to reassign.
Manage vs View-only
View-only users can read every report but write nothing — the attempt is rejected at the auth chokepoint, not hidden in the UI. Manage users can change rules and settings.
Per-admin timezone
Each admin sets their own display timezone, so a report reads correctly whether the person opening it sits with the customer or three zones away.
Support desk
A ticket desk your customers can reach, and a queue your staff can run.
Every tenant gets a customer-facing ticket portal, and your team gets a super-admin staff queue behind it. Needs-reply highlighting keeps the aging tickets from slipping, and NotifyBell pings you when something new lands.
- A per-tenant, customer-facing portal for raising and tracking tickets
- A super-admin staff queue with needs-reply highlighting across every tenant
- Assignment, internal notes, and priorities on each ticket
- NotifyBell alerts so a new ticket reaches you without watching the queue
Beyond the desktop
See the work that never touches a monitored PC.
Not every hour happens on a company laptop. Microsoft 365 off-device analytics reads the customer's own Graph data, so phone and tablet activity shows up next to the endpoint picture.
Entra sign-ins
See Entra sign-ins with device, OS, and location, so a login from an unmanaged phone is visible even though no agent runs there.
Teams & Outlook by device
Teams and Outlook usage is broken out by device class, with a mobile-versus-computer split that tells you where the collaboration actually happens.
Consent your way
Connect via a self-service admin-consent link the customer's Global Admin approves, or through GDAP when you manage their tenant. App-only Graph access, no user passwords.
Billing that fits resale
One number to price against, and it never tracks the workforce.
SnitchOS is $100 per active admin or manager seat, per month. Monitored endpoints, users, and client tenants are unlimited and never billed, so the cost you resell against is the count of people who log in — a number you control.
Invoicing runs itself: an idempotent monthly invoice on your signup day-of-month, numbered SN-YYYY-NNNNNN, with Stripe card-on-file and off-session auto-pay. The card never touches the server, and paying the last overdue invoice reactivates a suspended account on its own.
Billed automatically each month on your signup day. Add or deactivate seats anytime.
- Unlimited monitored endpoints and users
- Unlimited client tenants, never billed
- Automatic monthly invoicing with branded PDFs
- Stripe card-on-file and off-session auto-pay
See it on your own fleet
Bring the platform to your book of business.
Tell us about your MSP and we'll cut a per-tenant installer with a 30-day pilot key. One endpoint, one hour — you'll know whether it fits how you deliver.
Prefer email? sales@snitchos.com