Multi-tenant CMDB and IT documentation for managed service providers
One workspace per client, shared technician seats, unified network scanning and endpoint inventory across the fleet, and per-tenant workflows. The MSP CMDB and documentation platform that consolidates IT Glue, Hudu, Liongard, and your tickets into one product.
For: Managed service providers of every size - from solo MSPs running a handful of clients to established providers managing hundreds of tenants. Technicians shared across every client workspace; tenants isolated by design.
Why Kovira fits
Most MSP tooling assumes you will buy three products and stitch them together: a documentation platform (IT Glue, Hudu), a discovery / audit tool (Liongard, Network Glue), and a PSA / help desk (ConnectWise, Autotask, HaloPSA, Atera, Syncro). The integration tax is paid in CSV exports, brittle webhooks, and "which tool is the source of truth this week."
Kovira is one product that covers the documentation, the CMDB, the discovery, and the ITSM workflow surface. The MSP plan ships unlimited multi-tenant workspaces - one per client, with full row-level isolation between them - shared technician seats that move freely between tenants, and unified VECTOR scanning and ATLAS endpoint inventory across every workspace.
Add a workspace, deploy ATLAS to the client's endpoints, point VECTOR at their network, and the CMDB starts populating itself. Your runbooks, password vaults, and workflows live with the tenant they belong to, never spilling across clients.
What you get
What's in the MSP plan
Multi-tenant infrastructure with the highest throughput and unlimited everything.
- Unlimited technician seats
- Unlimited multi-tenant workspaces (one per client)
- Unlimited configuration items across every tenant
- Unlimited ATLAS endpoint agents
- VECTOR network scanning across every client network
- Microsoft 365 sync (Entra ID + Intune) per tenant
- 1,000 MiB of structured document storage
- 1,500 API calls per hour, 1,500 workflow executions per hour
One workspace per client, full isolation
Triple-layer tenant isolation - by design, not by convention.
Every client gets their own workspace with full row-level security between tenants. Database-level compound foreign keys enforce the tenant boundary, RLS policies make it impossible to read across tenants accidentally, and the application layer requires an explicit tenant context on every query. There is no "unscoped" path.
From the technician's seat, switching between client workspaces is one click. The CMDB, documents, password vault, incidents, changes, and workflows all scope automatically to the tenant you have selected. From the client's perspective (when you grant them access), they only ever see their own workspace.
Highlights
- Unlimited tenant workspaces
- Triple-layer tenant isolation (schema + RLS + app)
- One-click tenant switcher for technicians
- Per-tenant audit log and reporting
Shared technician seats across every client
One seat per technician - works across every workspace they touch.
Technician seats are shared across every client workspace. The same technician can work in 50 client tenants on the same seat, with permissions managed per workspace. Hire one new tech, give them one new seat - regardless of how many clients you have.
Permissions are scoped per workspace. A technician can be Owner in one tenant, Editor in another, and have no access to a third - all from the same identity. Switching tenants is one click; the surrounding context (CMDB, documents, vault, workflows) re-scopes automatically.
Highlights
- One technician seat covers every client workspace
- Per-workspace roles (Owner / Admin / Editor / Viewer)
- Per-workspace permission grants
- One-click tenant switcher with full re-scoping
Unified discovery across every client
VECTOR scans and ATLAS agents per tenant - one console.
Each client workspace has its own VECTOR scans and its own fleet of ATLAS endpoint agents. Scan results land in that tenant's CMDB and stay there. From the technician's perspective, you see all of your clients in one console; from each client's perspective, only their data is ever visible.
Each tenant's CMDB stays in step through scheduled VECTOR scans (the network's heartbeat). VECTOR LIVE (a paid add-on) layers a reflex on top, so scan results land in that tenant's CMDB the moment a scan finishes. Microsoft 365 sync runs per tenant in the background, pulling each client's Entra ID directory and Intune managed devices in turn.
Highlights
- VECTOR network scanning per tenant
- Unlimited ATLAS endpoint agents per tenant
- Microsoft 365 sync per client (Entra + Intune)
- VECTOR LIVE for instant CMDB updates (paid add-on)
Documentation and password vault per client
The IT Glue / Hudu workflow, integrated with the CMDB.
Each tenant gets its own structured documentation surface and its own password vault. Runbooks, SOPs, network diagrams, post-mortems, onboarding checklists, and the SSL-cert-renewal-process-that-only-Steve-knows live next to the CIs they describe, with audit trail on every read and write.
Documents support 10 structured card types (heading, text, image, checklist, table, code, quote, link list, callout, divider) and live collaborative editing - so two technicians can update a runbook together during an incident without overwriting each other.
Highlights
- Per-tenant document workspace with linked CIs
- Built-in password vault with per-access audit
- 10 structured card types for runbooks and SOPs
- Live collaborative editing with author-locked free-text cards
Per-tenant workflows, SLAs, and mailbox-driven tickets
1,500 workflow executions per hour, per-customer SLAs, and 5 monitored mailboxes per workspace.
Workflows scope to the tenant they live in. A change-approval workflow in one client's tenant has no visibility of another client's CIs or incidents. The MSP plan lifts the workflow throughput to 1,500 executions per hour and the API throughput to 1,500 calls per hour, so cross-tenant fleet automation does not bump into rate caps.
Per-customer SLAs do the right thing on the MSP plan: each client can have their own response and resolution targets, coverage windows, and holiday calendars, and incidents pick up the right policy by customer link. SLA at-risk and breach events are workflow triggers, so escalation paths and management notifications wire in cleanly. Built-in system workflows already cover ticket-created, ticket-assigned, and SLA at-risk and breach notifications out of the box.
Each client workspace can connect up to five Microsoft 365 mailboxes for incident triage. Email landing in a connected support@ inbox raises an incident within seconds, replies thread back as comments, and the incoming-mail workflow trigger handles routing, acknowledgements, and chaining into your PSA. Per-mailbox OAuth means you never need a tenant-wide admin grant to set it up.
Highlights
- Workflows scoped per tenant (no cross-tenant leakage)
- 1,500 workflow executions per hour, 1,500 API calls per hour
- Per-customer SLAs with coverage windows and holiday calendars
- 5 monitored Microsoft 365 mailboxes per client workspace
- Built-in email automations for ticket-created, assigned, SLA at risk, and SLA breach
- Triggers: CI changes, incidents, SLA events, schedules, incoming email
- Actions: send email, update CI, webhook, SLA pause/start/stop/reset, regex/string/JSON transforms
Switching from another tool?
Switching from your current MSP stack
MSPs typically arrive at Kovira after stitching together two or three of these tools and tiring of the integration tax. Here is how Kovira lines up with the platforms you have probably evaluated.
Coming from IT Glue
IT Glue is the legacy MSP documentation incumbent. Kovira covers IT Glue's documentation and password-vault use cases and adds a typed CMDB, dependency mapping, ITSM (incidents, changes, workflows), VECTOR network scanning, and ATLAS endpoint agents - all in one product.
Coming from Hudu
Hudu is the modern documentation alternative to IT Glue. Kovira gives you the same clean documentation surface and adds a real CMDB, ITSM workflows, network scanning, and endpoint inventory - so you replace one tool with one tool, not one tool with three.
Coming from Liongard
Liongard is an MSP audit and inspection platform. Kovira's VECTOR scanner plus ATLAS agents plus Microsoft 365 sync cover the discovery and audit ground for most MSPs, with the CMDB and documentation already underneath.
Coming from SuperOps
SuperOps bundles PSA + RMM for emerging MSPs. Kovira is the CMDB / documentation / ITSM half of the stack and pairs cleanly with whichever RMM you already use - or sits underneath your PSA as the source of truth for asset and dependency data.
Coming from Atera
Atera bundles RMM and a help desk for small MSPs. Kovira focuses on the CMDB, documentation, and ITSM workflow surface that Atera leaves shallow, with multi-tenant isolation that scales past Atera's reach.
Coming from Syncro
Syncro bundles PSA and RMM for small MSPs. Kovira is the documentation, CMDB, and ITSM workflow layer underneath - the place your runbooks, dependency maps, and change records live, regardless of which RMM you ship.
Coming from HaloPSA
HaloPSA is a strong PSA. Kovira sits as the multi-tenant CMDB and documentation source of truth that a PSA points at - per-client workspaces, per-tenant CIs, and discovery that keeps the inventory honest.
Coming from ConnectWise PSA + ITBoost
ConnectWise gives you PSA and documentation across two products. Kovira consolidates the documentation, CMDB, ITSM, and discovery surface into one product - one console, one data model, one audit trail.
Coming from N-able N-central + Passportal
N-able pairs RMM with documentation and password management across separate products. Kovira covers the documentation, CMDB, and ITSM surface in one product and pairs with whichever RMM you prefer.
Coming from Desk365
Desk365 is a Microsoft Teams help desk. Kovira sits one layer underneath as the multi-tenant CMDB and asset documentation source of truth - the place the records and runbooks live.
Common questions
Is Kovira a real IT Glue or Hudu alternative for MSPs?
Yes. Kovira ships per-tenant documentation, password vaulting, and asset records - the core of what MSPs use IT Glue and Hudu for - and adds a typed CMDB with dependency mapping, ITSM incidents and changes, workflow automation, VECTOR network scanning, and ATLAS endpoint agents in one product. Most MSPs that switch end up replacing two or three tools, not one.
How are tenant workspaces structured?
Each client gets its own workspace with full row-level isolation. Workspaces are unlimited - add as many client tenants as you need. A single technician identity can access any workspace they have been granted permission to, so onboarding a new client is purely operational work (deploy ATLAS, point VECTOR, import documents) rather than account provisioning across separate platforms.
How is tenant isolation enforced?
Three layers. The database schema uses compound foreign keys to enforce tenant_id consistency on every related row. Row-level security policies prevent cross-tenant reads at the database layer. The application layer requires an explicit tenant context on every query - there is no unscoped code path. Cross-tenant leakage is structurally prevented, not just policy-prevented.
Can I run discovery (VECTOR + ATLAS) across all my clients from one console?
Yes. Each tenant has its own VECTOR scans and its own fleet of ATLAS agents, but you administer all of it from one technician console. Scan results and agent inventory stay scoped to the tenant they came from, while you get the operational efficiency of one platform.
How does Kovira fit alongside my PSA and RMM?
Kovira covers the CMDB, documentation, ITSM workflow, password vault, and discovery layer. It pairs cleanly with whichever PSA (HaloPSA, ConnectWise, Autotask, Atera, Syncro) and RMM (NinjaOne, N-able, Datto) you already use - typically as the source of truth for asset and dependency data, with workflows that push events into the PSA and pull context back.
Is there a migration path from IT Glue, Hudu, or Liongard?
Yes. Data from each of those platforms can be exported and imported into Kovira's corresponding CI types and document structures. VECTOR and ATLAS then keep the inventory current automatically, so the migration ends rather than turning into a permanent CSV pipeline.
Be ready on launch day
Kovira is launching soon. The free tier will include the full CMDB, VECTOR network scanning, and ATLAS endpoint agents. Leave your email and be first in line.