One platform across every client. Their branding, your operations.
Astrari is multi-tenant from day one. Group every server and site under a named client. Invite a scoped login that sees only their estate. Send a polished monthly report on the 1st of every month — automatically, in your branding, under your sender name. All of it is shipped and in production today: client grouping from the Professional plan; client logins and automatic monthly reports on Agency.
01 · Multi-tenant
Group every asset under a named client
Every server and every site can be assigned to a client. The Client is a first-class object in the platform — it has its own contacts, its own integrations, its own monthly report cadence. Engineers in your agency see everything; the client sees their own assets in their own scoped login.
When you invite a CLIENT_OWNER, the API enforces that they can only read and act on assets attached to their client. The same role can invite their own team members to view alongside them — useful for a hand-off to an in-house IT lead at the client.
What that means in the code
Client / ClientServer / ClientSite models · CLIENT_OWNER role enforced at every API endpoint · per-finding alert routing reads clientId.
What you get out of the box
- Named client groupings — unlimited clients, no per-client fee
- Scoped CLIENT_OWNER login per client
- Client team-member invitations (the client invites their own people)
- Per-client notes, contacts, integrations
- Per-client monthly report opt-in toggle
02 · Branding
Your brand on the report your clients actually read
Set your logo, brand colour and sender name, and every monthly report your clients receive carries your brand — the PDF itself, the email it arrives in, and the reply-to it answers to. Astrari is the engine; the relationship stays yours.
We're precise about the boundary: the dashboard and instant alert emails are Astrari-branded today. A white-label dashboard on your own domain is in development — the data model already carries the custom-domain field — and we'll claim it on this page the day you can click it.
What that means in the code
Organization.logoUrl · primaryColor · brandName · emailSenderName · emailReplyTo — applied by the report renderer and monthly report emails.
What branding covers today
- Your logo + brand colour on every monthly report PDF
- Sender name + reply-to on monthly report emails
- “Sent on behalf of [your agency]” band on monthly reports
- Included on the Agency plan — no separate branding fee
- Roadmap, clearly labelled: white-label dashboard on your own domain
03 · Reporting
Polished monthly reports, sent automatically
On the 1st of every month, every client with monthly reports enabled receives a polished PDF — automatic on the Agency plan. Findings rolled up by severity, month-on-month trend, plain-English explanations written for the client rather than the engineer who'll act on them.
The cron is idempotent — re-running the trigger in the same calendar month is a no-op for clients who've already received their report. You don't have to remember to send it; we don't have to remember either.
What that means in the code
MonthlyStatusReport schema · Client.monthlyReportEnabled toggle · scheduler cron with calendar-month-aware idempotency.
What lands in their inbox
- Branded PDF — your logo, your colour, your sender
- Severity-rolled-up findings with month-on-month trend chart
- Plain-English remediation summaries (not raw CVE IDs)
- Per-asset score change since last month
- Per-client opt-in — pause for individual clients without affecting others
04 · Routing
Per-client alert contacts and integrations
Each client gets its own contacts and integrations. Their team's Slack, their NOC's webhook, their on-call rota — wired to alerts only on assets that belong to them. Your agency's existing contacts continue working alongside, picking up findings on assets in your own estate.
When a HIGH lands on a client's server, it routes to their contacts. When the same HIGH lands on your own server, it routes to your agency contacts. The platform enforces this automatically based on the asset's client assignment.
What that means in the code
AlertContact and AlertIntegration both carry an optional clientId · per-finding routing query joins on it · ServerAlertRecipient + SiteAlertRecipient explicitly wire which contacts get which assets.
What you can wire up
- Email contacts per client, with test-send
- Slack webhook per client
- Generic webhooks per client (with HMAC signature)
- Asset-level overrides (one server → different routing than the rest of its client)
- Severity threshold per recipient — separate noise from real
Pricing for agencies
No client-count multiplier. No branding upcharge. No annual lock-in.
Small agencies start on Professional at £65 / month — 5 servers, 25 sites, client grouping and on-demand PDF reports. When you need separate client logins, per-client API keys and automatic branded monthly reports, the Agency plan (£149 / month) adds them for 125 sites and 25 servers. No per-client multiplier; no annual lock-in.
Astrari is a service of Incus Technologies Limited, registered in England & Wales (no. 09253791). The team is small enough that the engineer who built the multi-tenant model is the same one who replies to your email.