Every customer’s certificates. One control plane.
Run trstctl for the customers you manage, from a shared control plane or dedicated deployments. Each tenant is isolated by construction, and every issuance, renewal and revocation is on a record you can hand to the customer.
One certificate is a chore. A book of business is a capacity problem.
TLS certificates go to 47 days in March 2029. Set the size of your estate and see the renewal rate you would have to staff by hand.
- Certificates
- 10,000
- Renewals a week today (200 days)
- 351
- Renewals a week at 47 days
- 1,493
Counts assume renewal at expiry; real policy renews earlier, so the true rate is higher. trstctl renews on policy, ahead of the deadline, with idempotent retries.
What you get, in the product’s own terms.
Every Enterprise feature, plus the operations an MSP needs to run many customers from one place. Each is a licensed feature in the offline-signed Provider license.
| Provider plane | One control plane for many customer tenants, gated by per-customer delegation; dedicated deployments where a customer’s posture requires them. |
|---|---|
| Siloed isolation | A tenant-silo mode on top of the row-level-security floor: each customer’s identities, secrets and audit trail stay behind their own tenant line. |
| Customer lifecycle, quotas and break-glass | Onboard and retire customers, delegate operators, set quotas and grant break-glass access, all recorded in one immutable authority history. |
| Metering as invoice evidence | Durable per-customer usage metering you can pull for your own billing; certificates, identities and rotations are never automatic billing units. |
| Evidence per customer | Approvals, policy and audit controls, and a replayable audit trail per customer: what was issued, rotated and revoked, by whom. |
| Managed-service and resale rights | Operate trstctl for customers and resell it; the core license expressly permits running it inside a customer’s own deployment as their service provider. |
A missed condition is a test failure, not a cross-customer incident.
The tenant line is enforced where it cannot be forgotten, and the record of every action is the product’s own state.
Storage isolation at the floor
Every tenant-scoped query is backed by PostgreSQL row-level security, not a best-effort application filter.
Keys behind a hard boundary
The control plane orchestrates; a separate signer process holds the keys and signs over a constrained channel.
An audit trail per customer
Events are immutable and projections can be rebuilt, so a customer’s history is replayable, not reconstructed.
Metering that fails closed
Usage is recorded under the same tenant floor; a period the metering store cannot vouch for is reported as unknown, never as zero.
Agreed per partner.
Provider terms are not published; they are agreed with each partner. The design-partner program is open to MSPs now: early releases, a direct line to the team, and a say in the roadmap.