SecurityRMM
Remote access done safely
Remote access is the most powerful tool an MSP has and a favourite target for attackers. Practical habits to keep it safe, and how we handle it in Tenvara.
6 min read
Built for managed service providers
Run your whole MSP from one place.
Tickets, devices, backup, Microsoft 365 and security in a single app your technicians will actually want to open. One login, one agent, one bill. Hosted by us or on your own server.
- One agent for Windows, macOS and Linux
- Self-hosted or hosted, same product
- Single sign-on with Entra ID or Google
- AI only with your own key
Why Tenvara
Most MSPs pay for a PSA, an RMM, a backup portal, a documentation tool and a password manager, then spend their day copying between them. Tenvara is all of it, built as one app.
For your technicians
The device, the customer, the contract and the history on one screen, with Remote in one click away.
For you as the owner
Fewer subscriptions to pay for and fewer places for things to slip. Every seat you buy ends up on an invoice.
For your customers
Faster answers, a portal they can use, chat from their own machine, and monthly reports that show the work.
Platform tour
Everything your MSP runs on, finally in one app.
Every part adds to the same customer and device records, so nothing needs syncing and nobody needs six tabs open.
Tickets that already know the customer, the device and the contract
Email becomes a ticket, the SLA clock starts against the right contract and calendar, and the linked device sits next to the conversation. Customers ask for what they need from a service catalogue in their portal and approve requests with one click from the email.
- SLA policies per contract, department or VIP, with escalations
- Information requests and sign-offs your customers complete in the portal
- Screen recordings with every step, straight from the user's tray
Onboardings and migrations planned, tracked and billed in one place
Phases, tasks and dependencies on a timeline you can drag, templates for the projects you run every month, time against tasks and budgets that warn you early. Customers sign off milestones in their portal.
- Projects straight from an accepted quote or proposal
- Board, timeline, sprints and release notes
- Time and materials or fixed price billing
One agent on every machine, and everything you need to fix it
Monitoring, patching, software, scripts and remote control from a single signed agent for Windows, macOS and Linux. Features switch on by policy, not by installing something else, and every alert says what raised it and offers the fix.
- Remote control with file transfer and recording
- Device web pages through the agent, with no VPN
- Patch policies, with server sets that keep pairs and clusters up
- A Lite agent for Windows 7 to Server 2012 R2
Find it in every backup, and bring it back from anywhere
Endpoints, servers, whole Macs, Hyper-V and Proxmox virtual machines, Microsoft 365 and Google Workspace. Immutable copies, test restores and boot checks prove it will come back, and a missed backup raises an alert in the same list as everything else.
- One search across every backup you hold
- Backups carry on after a restart or an update
- Bare metal recovery and instant recovery
Every customer tenant checked, and starters and leavers done properly
Connect each tenant once. Tenvara checks it against CIS, SCuBA, NIST and Essential Eight, deploys your own baselines and puts drift right, manages Intune, and runs new starters and leavers the same way every time.
- Your own baselines with drift and auto-fix
- Intune, Autopilot and the OpenIntuneBaseline as templates
- Starter templates and leaver checklists
Detections from endpoints and Microsoft 365 in one queue
The agent ships the logs, the tenants send sign-in signals, and rules raise detections with the device, the user and the evidence attached. The critical ones can wake whoever is on call.
- Encoded PowerShell, new local admins, password spray
- Vulnerabilities grouped by the one update that fixes them
- Other remote access tools found, allowed or removed
ISO 27001, Cyber Essentials and hardening, run from real data
Programmes for each customer show readiness per framework, with evidence that collects itself from devices, Microsoft 365 and backups. Device hardening audits first, enforces in rings and rolls back in one click, and AI readiness shows how safe a customer is to switch AI on.
- ISO 27001, ISO 9001, UK GDPR and Cyber Essentials
- Phishing simulations and awareness training
- More than 400 hardening settings with drift alerts
- AI readiness scores with fixes you can undo
Every hour, seat, call and milestone on an invoice
Invoice runs gather contracts, licences, resold services, calls, ticket and project time, expenses and quotes, in any currency with the right tax. Payments and accounting sync use your own Stripe, GoCardless, Xero or QuickBooks accounts.
- Invoice runs, autopay and billable units counted every day
- Supplier contracts with notice dates and price rises you pass on
- Call billing with rate cards, bundles and itemised bills
- A CRM with your own mailbox on every timeline
Customer docs and passwords, right where the work happens
Structured documentation and an encrypted credentials vault that live with the customer, and an internal knowledge base for your own processes. The device page shows its docs, and tickets suggest the right articles.
- Encrypted vault with every reveal audited
- BitLocker recovery keys collected by the agent
- Password rotation and a browser extension
One record per device
Open a device. See everything. Fix it from there.
Health, patches, software, backups, alerts, security events, documentation and tickets for that machine, together. There is no backup tab from one vendor and an RMM tab from another. It is one record.
- Act where you are
- Remote in, run a script, back up now or raise a ticket from the device, the ticket, the alert or search.
- One search for everything
- Customers, devices, tickets, contacts, alerts and every page from one box, or Cmd+K from anywhere.
- One alert list
- Monitoring, backup, Microsoft 365, security and infrastructure all raise alerts into the same list. Your own work and planned shutdowns stay quiet, one cause is one alert, and each one says what raised it and offers the fix.
Replace your stack
Too many logins. Too many agents. One app.
Every separate tool is another bill, another agent on your customers' machines, another place for an alert to be missed and another integration to break. Tenvara does these jobs itself, on the same records.
What most MSPs run today
- PSA and ticketing
- RMM and monitoring
- Remote access
- Patch management
- Endpoint and server backup
- Microsoft 365 backup
- Microsoft 365 management
- Documentation
- Password manager
- Security log monitoring
- Live chat
- CRM and sales email
- Quoting and proposals
- E-signatures
- Project management
- Invoicing and procurement
- Licence reconciliation
- Vulnerability scanning
- Awareness training
- Compliance management
- Device hardening
- Call billing
- Customer forms and sign-offs
Tenvara
- One app and one login
- One agent on every machine
- One alert list and one search
- One customer record for everything
- One set of roles and permissions
- One subscription
Hosted on our servers or yours, with every feature either way.
Tenvara for IT teams
Run IT for your own organisation? It is a full ITSM platform too.
Schools and trusts, councils, charities, hospitals, law firms and manufacturers run their own IT. Tenvara gives an in-house team the same platform, shaped around its departments and employees instead of customers, with nothing to bill.
- Service management, properly
- Incidents, service requests from a catalogue, problems, major incidents and changes with a change calendar, under SLAs by priority, department or VIP.
- An employee portal with manager approvals
- Staff raise and follow tickets, ask for equipment, software and access, and find answers. Requests go to their manager first, then to IT.
- The rest of IT in the same app
- Device management, patching, remote support, backup, your Microsoft 365 tenant, security, documentation and IT spend by department.
Getting started
What getting started will look like.
-
1
Your own instance
We set up your own hosted instance at yourname.tenvara.app. Prefer your own server? Self-hosted is one Docker Compose file.
-
2
Follow the setup helper
Start with the service desk and switch the rest on one module at a time. Each step recommends settings with the reasons, previews them and can be undone.
-
3
Bring your data and team
Import from CSV, IT Glue, Hudu or your old PSA's exports, invite your team by role and connect each Microsoft 365 tenant.
-
4
Deploy the agent
Install the one agent on Windows, macOS and Linux machines. Devices appear under the right customer as they enrol, and a new customer's first scans arrive as one findings report.
Every step has a guide in the knowledge base. Tenvara is coming soon: apply for the beta to be one of the first.
Your server or ours
Self-host it, or let us run it for you.
The same Tenvara either way. Pick what suits your customers, your compliance and your team.
Hosted by us
Your own instance at yourname.tenvara.app. We handle updates, backups, certificates and monitoring, so your team only has to install the agent.
- Your own instance and database, not a shared tenant
- Updates applied for you
- Backups of your whole instance
Self-hosted
One Docker Compose install on your own server, in your data centre or your cloud, under a licence key from your account.
- Your data never leaves your network
- Postgres, Redis and S3 compatible storage you control
- Upgrade when it suits you
AI, on your terms
It checks the machine before it guesses.
On a "my computer is slow" ticket, the assistant finds the device, runs read-only checks and writes an internal note with the likely cause and the numbers behind it. Fixes wait for a technician to approve them.
- Off until you add your own Anthropic API key
- Triage, summaries and draft replies that a person sends
- Spend caps, per-customer opt-out and a log of every call
The Tenvara app
Your whole MSP, in your pocket.
Tickets, alerts, devices, remote control, credentials and today's visits on iPhone, iPad and Android, with offline working and a biometric lock. The same platform, built properly for the phone.
See the Tenvara app
iPhone, iPad and Android, for beta customers
Early access
Tenvara is coming soon.
We're inviting MSPs to the beta in small groups. Apply to be one of them, or get launch updates by email.
- The full productEvery area, from the service desk and RMM to backup and Microsoft 365. Beta is about the stage Tenvara is at, not a cut-down version.
- Hosted or on your serverBeta members get their own instance at yourname.tenvara.app, set up by us, or run Tenvara on their own server.
- You help shape itWhat beta members tell us decides what we build next.
- A direct line to the teamQuestions and ideas go straight to the people building Tenvara.
- Pricing before launchPricing is announced before launch, so you know where you stand before you commit.
- The app as wellBeta members get the Tenvara app for iPhone, iPad and Android alongside the web app.
Questions
The things MSP owners ask us first.
Anything else, ask us directly. A person who runs an MSP will answer.
Yes. Self-hosted Tenvara is one Docker Compose install on a server you control, in your own rack or your own cloud. You get a licence key with your account, and you upgrade when it suits you. It is the same product as hosted, with the same features.
No. Every hosted customer gets their own instance and their own database at yourname.tenvara.app. We look after updates, backups of the instance, certificates and monitoring.
No. One signed agent for Windows, macOS and Linux does inventory, monitoring, patching, software, scripts, remote control, backup and log collection. Each feature is switched on or off by policy from the server. Older Windows, from Windows 7 to Server 2012 R2, gets a Lite agent in the same device list.
Tenvara is coming soon. We are inviting MSPs to the beta in small groups: apply on the early access page and we will be in touch, or get launch updates by email. Beta members get the full product, talk directly to the team building it and help decide what comes next.
Tenvara is one product with every feature included, hosted or self-hosted. It is new and in beta, and we are working out pricing with our beta members, so it is announced before launch. Get updates on the early access page and you will hear first, with no obligation.
AI is off until you add your own Anthropic API key. Calls go to Anthropic under your account, you can turn AI off per customer, cap the spend, and every call is logged. Suggested fixes and replies always wait for a technician.
Yes. Customer contacts get a portal to raise and follow tickets, approve requests, fill in the forms you send, sign off decisions, pay invoices and find answers in the Help centre, and managers get a company view of their devices, licences and security. Their users can also chat, report a problem or record their screen from the tray icon on their own machine.
Yes. Brand profiles set the name, logos and colours your customers see in the portal, emails, invoices, status pages and on the agent's tray icon and installer, per customer if you like, on your own domain once your DNS points at it.
Yes. Tenvara is available in English, French, German, Spanish and Dutch, bills in any currency with daily exchange rates, and handles UK and EU VAT, US sales tax, GST and Canadian taxes, with each country's public holidays in your SLAs.
Yes. Import customers, sites, contacts, devices, assets and credentials from CSV with a dry run first, from IT Glue and Hudu with a choice of what to sync and where articles land, or from HaloPSA, ConnectWise Manage, Autotask and Syncro exports. Re-running an import updates what is there rather than duplicating it. A customer you take over from another provider can start in takeover mode, where Tenvara watches and changes nothing until you say so.
It is a fair question. Hosted, every MSP gets its own instance and database, and self-hosted runs on your own server. Your data exports from every list and through the API, the vault has an offline break-glass copy, and modules switch on one at a time, so you can keep the specialist tools you trust and move at your own pace.
Yes. The Telephony and connectivity module keeps every site's lines and phone services with their contract dates, measures outages against the SLA, and rates call records onto your invoices with an itemised call bill.
Yes. Tenvara for IT teams is a full ITSM platform for an organisation that runs its own IT: incidents, service requests, problems and changes, an employee portal with manager approvals, purchasing and IT spend by department, and the same device management, backup, Microsoft 365 and security tools, in the edition built for one organisation.
Local accounts with two-factor authentication or passkeys, or single sign-on with Microsoft Entra ID, Google Workspace, any OpenID Connect provider or SAML 2.0, with groups mapped to roles.
From the blog
Latest from the blog.
HostingMSP
Self-hosted or hosted: how to choose
Self-hosting your MSP platform or letting someone host it for you: control, compliance, effort and the real cost of running a server yourself.
5 min read
Microsoft 365Security
Cyber Security Awareness Month: checking every client tenant's Microsoft 365 security
October is Cyber Security Awareness Month. A practical checklist for MSPs to review MFA, admin roles, legacy sign-ins and risky settings in every client tenant.
6 min read
Tenvara is coming soon.
We're inviting MSPs to the beta in small groups. Apply to join, or get launch updates by email and hear first when pricing is announced.