Home/For MSPs

Built for operators

One pane of glass.
Every customer you manage.

Orendyr's core hierarchy is MSP → Customer → Tenant. Rollups across a book of business aggregate metadata only, region-by-region. Raw identity data never leaves the region it was collected in. Bridge or Silo isolation — your pick per customer.

Talk to the MSP team Main demo

MSP-native

Built for the MSP → Customer → Tenant reality.

One MSP operating on behalf of many customers, each with one or more directory tenants. Rollups across a book of business are region-bounded. Raw identity data never leaves the region it was collected in.

Book of business

Northgate Managed IT

msp_nga

Acme Corp

cust_acme

acme.onmicrosoft.comus-east

acme-eu.onmicrosoft.comeu-west

Bluefin Labs

cust_bluefin

bluefin.okta.comus-west

Starlane Holdings

cust_starlane

starlane.onmicrosoft.comeu-central

acquired-co.okta.comeu-central

Bridge

Default · shared application tier

Per-tenant Postgres schema. Envelope encryption: each tenant gets its own DEK, wrapped by a shared KEK in KMS. The right balance of blast radius and unit economics for most customers.

per-tenant schemaper-tenant DEKshared app

Silo

Premium · dedicated storage

Dedicated Postgres cluster. Per-tenant KMS key. Nothing crosses tenant boundaries at rest or in flight. For customers with residency mandates that don't bend.

dedicated dbper-tenant KMSregional pin

Portfolio rollup

MSP operators see posture across every customer — as metadata. Raw identity data stays in-region. The rollup crosses customers; the data never does.

Stack

We're boring about what's underneath. On purpose.

No proprietary datastore. No homegrown event bus. Nothing here would surprise your platform team in a 30-minute architecture review. That's the point.

Next.js 16

React 19, App Router, Turbopack, streaming SSR.

Postgres 16

Per-tenant schemas. Tenant id as first-class partition key.

NATS JetStream

Durable subject streams. First-class replay for backfills.

Redis 7

Hot warehouse projections with write-through. TTL 300s.

LiteLLM

OpenAI-compatible gateway. Per-tenant model pinning.

Distroless Node 20

Non-root. No shell. Minimal CVE surface.

Kubernetes

Kustomize manifests ship in the repo. HPA 3→20. PDB. NetworkPolicy.

KMS + envelope encryption

Per-tenant DEK wrapped by shared or dedicated KEK.

Read the full architecture doc →

What MSPs get on day one

Portfolio posture

See violations, stale grants, and break-glass activity across every customer without switching tabs.

Runbooks

Publish a workflow once — roll it out to every customer tenant with per-customer overrides.

Billing rollups