Skip to content
Start free

Solutions · Industry

One workspace per customer, one place to run them all

Each customer gets a workspace with its own Kubernetes namespace and ClickHouse database. Your engineers run them all from one organization, with MSP roles mapped from your identity provider, and the console shows each workspace's health and ingest.

Talk to our teamRead about workspaces

What changes

Four problems service providers bring to us

  • Customers who won't share a database

    Every customer gets a workspace with its own Kubernetes namespace, ClickHouse database and address. No database or storage bucket is shared between customers.

  • A separate login for every customer

    One organization holds your people and every customer workspace. MSP admin and MSP viewer roles come from your identity provider, and each person gets admin, editor or viewer access workspace by workspace.

  • Every customer set up differently

    Keep monitors, dashboards and detection rules in Git, review a plan and apply the same bundle to each customer's workspace. Collector policies keep the agents inside each one consistent.

  • Onboarding that eats engineering time

    Create a workspace from the console, install collectors with a policy's enrollment token, and let discovery sweep the customer's address ranges for network devices.

Products

What you run them with

Your setup travels from one customer workspace to the next as code and collector policies.

Audit readiness

Evidence for each customer's audits

Each customer workspace builds its own evidence packs from the data it keeps. Packs are hash-chained and mapped to selected PCI DSS v4.0, SOC 2 and ISO 27001:2022 controls.

Tracix supports your compliance program. It does not make your organization compliant on its own, and evidence packs say nothing about Tracix's own certifications.

How evidence packs workOur own compliance status
Log retention and coverage
Which security log sources send data, which retention policies meet the 12-month bar, and what is under legal hold.PCI DSS 10.2, 10.3, 10.5SOC 2 CC7.2ISO 27001 A.8.15
Detection coverage
Which detection rules are enabled, the ATT&CK techniques they cover, and the detection gaps you track.PCI DSS 10.4, 11.5SOC 2 CC7.1, CC7.2ISO 27001 A.8.8, A.8.16
Alert handling
Triage verdicts, time to triage and to resolve, the cases opened and the response actions proposed.PCI DSS 10.4, 10.7, 11.5SOC 2 CC7.3 to CC7.5ISO 27001 A.8.16
Access review
API keys that are active, expired or unused for 90 days, and who performed privileged actions.PCI DSS 10.3SOC 2 CC6.3ISO 27001 A.8.2

MITRE ATT&CK® is a registered trademark of The MITRE Corporation.

Rollout

Onboard one customer, then standardize

Our solutions engineers plan each phase with your service delivery team.

  1. 01Onboard one customerCreate a workspace, install collectors with a policy's enrollment token, and map your identity provider's groups to MSP roles.
  2. 02Standardize your setupPut monitors, dashboards and detection rules in Git, and apply them to each customer's workspace from CI.
  3. 03Scale outAdd a workspace for each new customer, give their people access to their own workspace, and watch every workspace's health from the console.

Resources

FAQ

Questions service providers ask first

Ask a solutions engineer
Can we bill each customer through Tracix?
Not today. An organization has one plan and one bill, so per-customer invoicing stays in your own billing system.
Can we put our own brand on Tracix?
Not today. The console and workspaces carry Tracix branding. You can serve each workspace from a domain you own, and Tracix manages its certificate.
Can customers sign in to their own workspace?
Yes. Invite them to your organization and add them only to their workspace, as a viewer or editor. Everyone in your organization can see the list of workspace names in the console, but only people added to a workspace can open it.
Where are customer workspaces hosted?
In AWS us-east-1 (N. Virginia) today, each with its own namespace and database. A workspace can also limit its public endpoints to the networks you list.

Plan your first customer workspaces

Bring your customer list and your identity provider setup. We will map the first phase with you.

Partners and MSPs
Talk to our teamStart free