> ## Documentation Index
> Fetch the complete documentation index at: https://docs.certgovernance.app/llms.txt
> Use this file to discover all available pages before exploring further.

# MSP / Partner Mode

> Manage multiple customer organizations from a single CertForge instance — designed for Managed Service Providers and IT partners.

# MSP / Partner Mode

MSP mode turns your CertForge instance into a multi-tenant certificate governance platform. Instead of managing one organization's certificates, you manage a portfolio of customer organizations — each isolated from the others — from a single dashboard.

## Who it's for

* **Managed Service Providers (MSPs)** who handle PKI and certificate renewal for multiple clients
* **IT consultancies** managing certificates across multiple client environments
* **Internal platform teams** running CertForge as a shared service for business units or subsidiaries

## Requirements

MSP mode requires an **MSP or Partner license**. It is not available on trial or standard commercial licenses. Contact [sales@certforge.xyz](mailto:sales@certforge.xyz) to enable it.

Once enabled, the **MSP Dashboard** appears in the left navigation for org admins and superusers.

## The customer relationship model

```
Your MSP Org (CertForge instance)
├── Customer Org A  ← you have guest access with your chosen role
├── Customer Org B
├── Customer Org C  ← individual staff members can have per-DTP access
└── ...
```

Each customer organization is a fully isolated org with its own users, Domain Trust Profiles, certificates, and audit trail. Your MSP org has **guest access** — you can view and manage based on the role you've been granted, but customers can also independently manage their own org without going through you.

There are two ways a customer org appears in your MSP dashboard:

| Path                     | How it works                                                                          |
| ------------------------ | ------------------------------------------------------------------------------------- |
| **You provision it**     | You create the org via **+ Add Customer**. You're immediately added as a guest admin. |
| **Customer invites you** | The customer admin invites your org via their **Organization → Guest Members** page.  |

## Capabilities

### Customer dashboard

A consolidated view of all customer orgs: active certificates, expiring (7-day, 30-day), certificate requests in the past 30 days, user count, DTP count, and license plan. Suspended or archived orgs are flagged visually.

### Staff access control

Grant your team members access to specific customer orgs, optionally scoped to individual Domain Trust Profiles. A staff member with DTP-scoped access can only see and act on the DTPs you assign — they cannot view other DTPs or org-level settings. You can also enable **masked identity** for a staff member on a given org, which hides their email from the customer's audit trail.

### Compliance report

A cross-org certificate compliance summary — which orgs have expired certificates, which are expiring soon, and which are clean. Available as a CSV export for use in client reports.

### Onboarding templates

Define reusable configuration templates (Domain Trust Profiles, issuance profiles, alert rules, approval policies) and apply them to new or existing customer orgs in one action. Keeps your standard of care consistent across the portfolio.

### Usage & billing

Monthly usage snapshots per customer org — certificates managed, certificates issued, renewals, approvals, API requests, active users, and cert limit status. Billing API tokens let external billing systems pull usage data programmatically. Historical snapshots are retained so you can report on any past month.

## Multi-region

If you run federated CertForge nodes in different regions (e.g., US and EU), you can provision customer orgs onto a specific regional node at creation time. Customer orgs on remote nodes appear in your dashboard alongside local orgs, with live data pulled from the remote node. Orgs on unavailable nodes are flagged rather than dropped from the view.