Provider plane
One control plane for many customer tenants, gated by per-customer delegation, with dedicated deployments for the customers whose posture requires them.
For MSPs · Provider edition
Every customer’s certificates. One control plane.
Run trstctl for the customers you manage, from a shared control plane or dedicated deployments. Each tenant is isolated by construction, and every issuance, renewal and revocation is on a record you can hand to the customer.
01 The 47-day math
One certificate is a chore. A book of business is a capacity problem.
TLS certificates go to 47 days in March 2029. Set the size of your estate and see the renewal rate you would have to staff by hand.
- Certificates
- 10,000
- Renewals a week today (200 days)
- 351
- Renewals a week at 47 days
- 1,493
Counts assume renewal at expiry; real policy renews earlier, so the true rate is higher. trstctl renews on policy, ahead of the deadline, with idempotent retries.
02 The Provider edition
What you get, in the product’s own terms.
Every Enterprise feature, plus the operations an MSP needs to run many customers from one place. Each is a licensed feature in the offline-signed Provider license.
Siloed isolation
A tenant-silo operating mode on top of the row-level-security floor: each customer’s identities, secrets and audit trail stay behind their own tenant line, and the signer holds keys in a separate process.
Customer lifecycle, quotas and break-glass
Onboard and retire customers, delegate operators per customer, set quotas and grant break-glass access, all recorded in one immutable authority history; every change needs an idempotency key.
Metering as invoice evidence
Durable per-customer usage metering you can pull as invoice evidence for your own billing. Certificates, identities and rotations are never automatic billing units.
Evidence per customer
Advanced approvals, policy and audit controls, and an audit trail you can replay for each customer: what was issued, rotated and revoked, by whom, with the approvals.
Managed-service and resale rights
Operate trstctl for customers and resell it. The core license expressly permits running it inside a customer’s own deployment as that customer’s service provider.
03 Isolation you can prove
A missed condition is a test failure, not a cross-customer incident.
The tenant line is enforced where it cannot be forgotten, and the record of every action is the product’s own state.
→
Storage isolation at the floor
Every tenant-scoped query is backed by PostgreSQL row-level security, not a best-effort application filter.
→
Keys behind a hard boundary
The control plane orchestrates; a separate signer process holds the keys and signs over a constrained channel.
→
An audit trail per customer
Events are immutable and projections can be rebuilt, so a customer’s history is replayable, not reconstructed.
→
Metering that fails closed
Usage is recorded under the same tenant floor; a period the metering store cannot vouch for is reported as unknown, never as zero.
04 Terms
Agreed per partner.
Provider terms are not published; they are agreed with each partner. The design-partner program is open to MSPs now: early releases, a direct line to the team, and a say in the roadmap.