MSSP multi-tenancy

kymeer models managed services directly: the platform sits above each MSSP, and each MSSP's clients are tenants beneath it. Every client tenant has its own service model and its own share of the MSSP's ingest.

How is the hierarchy organised?

Platform → MSSP → client. The server enforces the tenant boundary on every query.

Platform administrators work on MSSPs, not inside client tenants. Reaching a client's data from the platform needs a break-glass grant that has a fixed expiry.

Which service models are there?

Service model	What the MSSP can do
SOCaaS	Operates the SOC for the client and can switch into the client's tenant to work
PaaS	Hosts a client that runs its own SOC; manages only the tenant's lifecycle and limits, and cannot see its data
Proof of concept	Runs a trial tenant that behaves as SOCaaS or PaaS, chosen when it is created

An MSSP admin cannot switch into a PaaS tenant, or into a proof of concept that behaves as PaaS.

How is ingest allocated?

1. The licence sets the total daily ingest for the installation.
2. The platform sets an envelope for each MSSP.
3. The MSSP divides its envelope between its clients. The MSSP's own tenant counts against the envelope too.

An allocation that would take an MSSP over its envelope is refused, and the refusal states both numbers. Reducing a client's retention needs a second person to approve it.

Which roles are there?

Analyst, Senior Analyst, Tenant Admin, MSSP Admin, Platform Admin and Auditor. MSSP admins manage tenants and users within their own MSSP. See Roles.

How does support work for MSSP clients?

Client → MSSP → kymeer. A client of an MSSP raises tickets with that MSSP, and the MSSP escalates to kymeer. kymeer does not contact an MSSP's clients.

Can my clients see my brand?

Quotes can carry your logo.

How do I become a kymeer MSSP?

Read about the MSSP track, then apply.