For MSPs

Every client's network, from one login.

ShadowLatch gives an IT provider a separate account for each client, one baseline you apply to all of them, installs from your RMM, and a monthly report with your name on it. Your clients see exactly who can reach their devices.

Request beta access See it working

All clients

Every client, the ones that need you first.

Each client is its own ShadowLatch account: its own devices, policies, users and protected data, with nothing from another client visible inside it. The Clients page puts them all on one screen, sorted by what needs a look: a contained device, devices that stopped checking in or fell behind on uploads, and open Review items. Everything else reads All good.

Devices, plan and seats for every client at a glance
Search and a Needs a look filter for a long client list
Open takes you straight into that client

ShadowLatch All clients for an IT provider, with example clients

Inbox

Everything that needs you, from every client.

One inbox across all your clients: contained devices first, then agents that stopped while the computer is on, devices a pattern is holding, and open Review items, by severity. Filter by client or kind, and act right there: release a device, end a pattern's hold, or dismiss a Review item with a reason, each in its own client and in its audit log.

Contained devices shown in red at the top
Release, end a hold or dismiss in place
Names open with each client's own key, as everywhere else

ShadowLatch Inbox for an IT provider, with example clients

Blocking across clients

Block it once. Block it everywhere.

When a threat shows up at one client, block it for all of them from the same sheet: tick Also in my clients, choose all of them or only the clients with a tag, and the block (or allow) lands in each one, in every profile there. Each client's copy is encrypted in your browser with that client's own key, so ShadowLatch can't read it. A client that already has it is left alone, and the confirmation names any client that was skipped and why.

One click from Activity, Network, Review or the Inbox
Every client, or only the clients with a tag
Encrypted per client, in your browser
Clients on Maximum privacy are skipped and named, never saved readable

ShadowLatch Blocking across clients for an IT provider, with example clients

All devices

Find any device in any client.

One list of every device across every client you can open, with contained and offline devices first. Search by device or client name, or show only what's offline or contained, and open a device straight in its client. Device names stay end-to-end encrypted: they open in your browser with each client's own key, and ShadowLatch can't read them.

Search every client at once
Contained and offline devices first
Change several devices at once: posture, profile, groups, updates, or the account they belong to
Each client's audit log records when its list is opened this way

ShadowLatch All devices for an IT provider, with example clients

Switching

One login. Every client one click away.

The box at the top of the menu shows whose devices you are looking at; click it or press Ctrl K to move to another client or back to your own account. Inside a client the box is highlighted and names your company, so nobody changes the wrong network by mistake. Each browser tab keeps its own client, and a copied link opens the same one.

Ctrl K from any page
A tab per client, side by side
Links that keep the client they were copied from

ShadowLatch Switching for an IT provider, with example clients

Profiles

Build the baseline once. Apply it to every client.

Set up a profile in Rules the way a client should run (threat blocking, categories, protocol controls, local-network privacy, policy folders, alerts) and apply it to as many clients as you like, as their Default or as an extra profile they assign to some devices. Change it later and every client following it updates. Inside the client your profile shows as Managed by your company: their staff can choose where it applies but not change it.

Apply to many clients at once
Every change you make reaches the clients that follow it
A client's own setup is kept as a snapshot when they join, and put back if they leave

ShadowLatch Profiles for an IT provider, with example clients

Deployment

Install from the tool you already use.

A deployment key gives you one line for Intune, NinjaOne, Datto RMM, ConnectWise or any tool that runs a command, and installs straight into the right client with the installer options you chose. The script checks that the installer is signed by ShadowLatch before it runs it. The key travels in a request header, never in an address, and is shown once.

Keys expire after 30, 90 or 365 days, or never
Install counts and last use for every key
Revoke a key the moment a project ends

ShadowLatch Deployment for an IT provider, with example clients

Monthly reports

Show clients what you did for them.

On the first of every month each client's report for the month before is emailed to you, and to the client's own administrators if you choose. Devices and how often they were online, connections and blocks, what blocked them by category, threat feed and protection, intruders, containment, Review handled, and agent versions. Open any of the last twelve months from the Clients page and print it.

Counts and categories only: no programs, sites, devices or addresses
Sent automatically, once per recipient
Turn it off per account in Rules, Alerts

ShadowLatch Monthly reports for an IT provider, with example clients

Your brand

Your name on every client email.

Alerts and monthly reports to your clients carry your company name and logo at the top, with a small Protected by ShadowLatch at the bottom. Upload a PNG or JPEG; we keep your current logo and the one before it so you can roll back, and delete anything older.

Off until you turn it on
One switch for alerts and reports
Roll back to the previous logo in one click

Existing customers

Bring customers who already use ShadowLatch.

Invite a business that already has its own account, or let them ask you from their Settings. Their owner always finishes the hand-over, after a plain warning that you will manage the account and see its data. Their devices move to your seats and your bill, and their own setup is saved first. When a client leaves, you hand the account back with its data, its old plan and any time they had already paid for. If a provider doesn't act within 14 days of a client asking, ShadowLatch support can complete the hand-back.

Invitations both ways; the customer always accepts
Every step in the client's audit log
Only the provider hands an account back

ShadowLatch Existing customers for an IT provider, with example clients

Tags and teams

Tag clients your way. Keep technicians to theirs.

Put your own labels on clients (schools, healthcare, priority) and filter the Clients list, All devices and the switcher by them. Then decide which clients each technician works in: every client, the clients with certain tags, or clients you pick. A technician can't open a client outside that, even by link, and a newly tagged client is included automatically. Owners and admins always reach every client.

Your labels, never shown to clients
Scopes by tag or by client, enforced by the server
Access shows when someone is outside their clients

ShadowLatch Tags and teams for an IT provider, with example clients

People

Your team, their team, each with the right access.

Give each of your technicians Viewer, Analyst or Admin in the clients they look after, and No access everywhere else. Invite the client's own staff into their account, where they only ever see their own devices. Clients see who on your side can reach their devices, and every change appears in their audit log under the name of the person who made it.

Per-client roles for your own team
Users for each client managed from one page
MFA and passkeys for everyone

ShadowLatch People for an IT provider, with example clients

Built for providers

The details that matter when it isn't your network.

Separate by design

Clients are separate accounts, not folders inside yours. One client's devices, names and history are never visible from another.

A key per client

Each client's protected data has its own encryption key. A technician reads it only after someone who already holds that key grants it.

A baseline they can't undo

Profiles you apply show as Managed by your company. The client's staff can choose which of their devices follow them, but can't change or delete them.

Alerts where you want them

Offline devices, containment, intruders and Review items come to you. Copy the client's own administrators when you want them to know too.

Technicians and clients apart

Your own people sit in your account; the client's people sit in theirs. Nobody gets more than the role you gave them.

One bill

Every client's devices use your seats on your account, so there is one invoice and one plan to manage. Clients can't cancel or change it.

Getting started

Turn on client management in Settings.

During the closed beta we approve each provider ourselves: ask from Settings in the console and we'll switch it on. Partner pricing grows with the total number of devices across all your clients; email us and we'll set it up with you.

Email support@shadowlatch.com

Bring your first client.

The closed beta begins on November 1, 2026. Tell us how many clients and devices you look after.

Request beta access See the whole product