MSP / provider access

See which client needs attention.

Monitor every client's Proxmox, backups, Docker, Kubernetes, TrueNAS and vSphere from one provider portal that shows which clients have alerts, then open that client's own workspace to investigate. Pulse MSP runs on your infrastructure, with dashboards, alerts and reports kept separate for each client.

Start the free evaluation Click through the portal

Two client workspaces free for 60 days, no card required. Setup needs your own host. To try it, you need no domain or DNS token. When you need a third client, buy from the Plan tab in your provider portal: from $69/mo for 3 clients.

Reading up first? See the multi-client architecture guide and the honest Checkmk comparison.

PROVIDER Your Pulse Account CLIENT A Workspace own dashboards own alerts own reports own agents ISOLATED RUNTIME CLIENT B Workspace own dashboards own alerts own reports own agents ISOLATED RUNTIME CLIENT C Workspace own dashboards own alerts own reports own agents ISOLATED RUNTIME
Isolation

A runtime per client

Each client workspace is its own isolated Pulse runtime with its own data directory, not a tag filter inside one shared install.

Hosting

On your infrastructure

You run the workspaces on your own infrastructure, next to your clients, so client monitoring data stays with you.

Accountability

Per-client reports

Scheduled reports from each client's own workspace, carrying your name and logo, so each client sees only their own data.

Every workspace is full Pulse

Client workspaces are not cut-down views. One client runs Proxmox, another runs Docker on Podman hosts, a third runs Kubernetes: each workspace monitors that client's whole stack, with the same Pulse the homelab community runs.

Pulse Docker overview in a client workspace showing container hosts and the containers underneath them with state, CPU, memory, and pending updates
A Docker-heavy client: hosts, containers, swarm roles.
Pulse Kubernetes overview in a client workspace showing a production cluster with its deployments and pods
A Kubernetes client: a production cluster with its deployments and pods.
The public demo is one ordinary Pulse instance, which is exactly what a single client workspace looks like from the inside. Open the demo and check that claim rather than take it. The provider portal above it is not part of the demo, but you can click through it with sample data.

What you run as the provider

Clients get full Pulse; you get the layer above it. Your Pulse Account portal holds the whole client fleet, and every workspace can produce client-ready reports.

Next: Review Hilltop Care Hilltop Care1 critical Meridian Dental2 warning Northbridge Legal0 active alerts Caldwell Engineering0 active alerts Fenwick Accountancy0 active alerts Brookvale Schools0 active alerts Click through the portal →
Sample clients. The preview runs the real portal, with nothing to install.

One portal for the whole fleet

Your Pulse Account lists every client workspace with its setup status, live alert rollup, and runtime health, and tells you which client to review next. Critical alerts surface at the fleet level, so the morning check is one screen, not ten logins.

  • Setup, alerts, and health per client at a glance.
  • A repeatable onboarding path for each new client.
  • Open any client workspace with one click when something needs attention.

Reports your clients actually see

Every workspace generates scheduled PDF performance reports covering uptime, resource usage, and fleet health over the period, ready to land in a client inbox, carrying your name and logo, not ours.

  • Per-client scheduled reports from each workspace.
  • Uptime and resource trends over 24h, 7d, or 30d periods.
  • Report branding with your name and logo, included in every plan and the evaluation.
Cover of a white-labelled Pulse client report titled Harbour Logistics Monthly Infrastructure Report, branded with a fictional provider logo and name
A client report cover carrying the provider's branding (example provider and client).

What you actually deploy

MSP ships as a supported deploy bundle, not a pile of containers you wire together. One Docker Compose stack on one host gives you Traefik ingress with wildcard TLS, a hardened Docker socket proxy, and the control plane that provisions client workspaces.

# Bring up the provider control plane $ ./setup.sh # Check a fresh install with two test workspaces $ ./run-install-proof.sh # Upgrades take a backup first, every time $ ./upgrade.sh

Day-two operations are part of the product

The things that decide whether a monitoring tool survives contact with a real client fleet are shipped and documented, not left to you.

  • Setup that validates its configuration and pulls digest-pinned images before it requests your evaluation license.
  • Upgrades that take a backup first, plus restore commands that bring workspaces back from backup or disk.
  • An install-proof script that provisions two test workspaces on a fresh deployment and checks them.
  • Portal sign-in by one-time link rather than another password to rotate when staff leave.
Network paths, port exposure, and per-client alert routing are covered in the questions below.
The full provider operations guide, including the firewall baseline and the post-setup validation checklist, is public: docs/MSP.md on GitHub.

Plans

Choose a plan by the number of clients you manage. Each plan covers unlimited monitored systems inside each client workspace, so you are charged by client, not by endpoint. Start with the free evaluation. When you are ready to buy, open Plan in your provider portal, choose monthly or annual billing and pay through Stripe. Your deployment fetches and applies its licence by itself, and Manage billing in the same place changes plan or cancels renewal. Annual is two months free.

Evaluation

Free for 60 days, two client workspaces

Setup issues its own evaluation licence, so there is no form, card or approval between you and the first two client workspaces.

  • A fresh Ubuntu 24.04 hostSSH with sudo. Tested on 2 vCPU, 4 GB RAM, 40 GB disk.
  • Ports 80 and 443 openFrom the internet. Your clients' agents reach it on 443.
  • A domain is optionalWithout one, setup builds a trial address from the host's IP.
Start the evaluation

  1. Point a domain at the host, or skip this

    Skip this step to use a trial address. With your own domain, add both as A records to the host's public IP; on Cloudflare, set proxy status to DNS only. Use any subdomain you like; it becomes your portal address.

    pulse.example.comPortal *.pulse.example.comOne address per client

  2. Download and verify the signed bundle

    On the host, in Bash. It stops before extracting anything if the signature or checksum fails. A minimal image may need sudo apt install -y curl openssh-client first. This is the v6.8.0 release candidate, so client workspaces show a Preview badge. When v6.8.0 ships, upgrade with its bundle.

    V=v6.8.0-rc.1; B=pulse-provider-msp-$V.tar.gz
U=https://github.com/rcourtman/Pulse/releases/download/$V
curl -fsSLO "$U/$B" && curl -fsSLO "$U/$B.sha256" && curl -fsSLO "$U/$B.sshsig" &&
ssh-keygen -Y verify -I pulse-installer -n pulse-install -s "$B.sshsig" \
  -f <(echo 'pulse-installer namespaces="pulse-install" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZd/DaH+BldzOkq1A8KVTcFk73nAyrE8aJOyf7i00jm pulse-installer') < "$B" &&
sha256sum -c "$B.sha256" && tar -xzf "$B" && cd "pulse-provider-msp-$V"

  3. Run setup

    It installs Docker and asks for a domain, an email for certificate notices and, for your own domain, a Cloudflare API token with Zone · Read and DNS · Edit. Press Enter at the domain prompt for a trial address, or at the token prompt to issue certificates over port 80 instead. A trial address is for evaluation only: moving to your own domain later means reinstalling every agent. It ends with Pulse Provider MSP is running.

    sudo bash ./setup.sh

  4. Sign in to your portal

    No email service is set up yet, so this prints your sign-in link instead of sending it. Run it again any time you need a new link.

    cd /opt/pulse-provider-msp && sudo docker compose run --rm control-plane \
  provider-msp bootstrap --account-name "Your MSP" --owner-email [email protected]

  5. Add your first client

    In the portal choose Add client, then Install agents and run the command it gives you on one of your own machines first. You are done when that machine appears in the client's workspace. Open client takes you into it, where Alerts sets where its alerts go. Polling a client's Proxmox or PBS also needs a route from this host to that client's network; see connecting over your VPN.

Another DNS provider, an air-gapped host, alert routing, reports and upgrades are in the full operations guide. Stuck on a step? Tell us where.

Solo

$69/mo or $690/yr

Up to 3 client workspaces.

Starter

$149/mo or $1,490/yr

Up to 5 client workspaces.

Growth

$249/mo or $2,490/yr

Up to 15 client workspaces.

Scale

$399/mo or $3,990/yr

Up to 40 client workspaces.

Prices are in US dollars. Already evaluating? Open Plan in your provider portal to buy. Plan sells from the v6.5.0 provider bundle onwards; an evaluation installed from an older bundle upgrades in place and keeps its clients.
Run it free before you buy
30-day money-back guarantee
No card required for evaluation
Cancel renewal anytime, no notice period
Client limits block, they never bill extra
Client data stays on your infrastructure
Scale is the largest plan today. If you need more than 40 clients, or want Pulse to host the platform, neither is available yet; tell us so we know it is wanted. Not a provider? See self-hosted pricing for single environments.

Choose MSP when

  • You want a provider-owned Pulse entitlement across isolated client workspaces.
  • Clients need their own dashboards, alert routing, and reports.
  • You want one commercial relationship covering the whole client fleet.

Stick with self-hosted plans when

  • Each customer runs an independent Community installation.
  • Each customer owns a separate Pro subscription for their own environment, with your company providing administration and support.

Contractor administration alone does not require MSP. Read the customer-owned licensing FAQ.

Questions providers ask first

How does Pulse reach my clients' networks? +
Two directions, and you control both. Agents on client hosts push out over HTTPS to that client's workspace address, so client sites need no inbound holes. Proxmox and PBS are polled the other way, from your side through the VPN or tunnel you already run to that client. Each client's addresses stay in its own workspace, so identical private IPs and hostnames across clients never mix in Pulse. If two clients use the same subnet, give each a distinct address from your side, for example a NAT mapping on each tunnel.
Does any client data reach Pulse? +
No client inventory, credentials, or monitoring data. Every client runtime runs on your infrastructure and leases its entitlements from your own control plane, and metrics, logs, alerts, and reports stay on your host. Two kinds of traffic do leave it. Licensing: the first run requests your evaluation license with the public half of a signing key generated on your host, a setup-stage marker, and an email address only if you choose to give one, never inventory or credentials, and you can skip it on an air-gapped host; after that the control plane checks its license with Pulse two minutes after startup and every six hours, and Plan talks to Pulse when you buy or manage billing. For platforms with an evaluation licence or paid binding, we retain the first and last check-in times and a check-in count against that public signing key to measure whether evaluations start and keep running. These are platform-linked licensing records, not anonymous aggregate telemetry; switching workspace telemetry off does not stop licence checks. The seven-day running measure is not a retention limit, and these records have no automatic expiry. See our privacy policy for access or deletion requests. Telemetry: each workspace sends Pulse's pseudonymous usage telemetry by default, like any Pulse install: version, aggregate counts, and feature flags, never hostnames, IPs, or names. Switch it off per workspace in Settings, General. The core is MIT-licensed and on GitHub if you want to check that claim rather than take it.
Is the management UI on the same port as the agents? +
Not in the provider bundle yet. Each client workspace serves its UI and agent check-in on one HTTPS address behind the bundle's Traefik ingress, so limit who can reach those addresses: your staff network plus each client's VPN or egress range. Agent tokens carry report-only scopes and cannot sign in or manage the workspace. The dedicated agent-only port exists for single-instance Pulse and is not yet wired into the provider bundle.
Can each client's alerts go to their own Slack, Gotify, or PSA? +
Yes. Each client's Gotify server, Slack channel, or PSA endpoint only ever sees that client's alerts. Webhook payloads carry the firing client's ID and name, so one central PSA endpoint can route by client. Deliveries can be HMAC-signed with a per-webhook secret and carry an event ID that stays the same across retries, so a ticket bridge can drop repeated deliveries.
What happens when I hit the client limit? +
Creating the next workspace is blocked. You are never silently billed for going over, and nothing stops monitoring for the clients you already have. Move up a tier when you actually need the room, and the existing workspaces carry on untouched.
What happens to my clients if I stop paying? +
Nothing gets deleted and nothing goes dark. A paid licence runs 14 days past the end of the paid period, then a 7-day grace period follows. After that, client runtimes fall back to Community behaviour, so core monitoring keeps running without the paid capabilities, and no new clients can be added. The provider portal stays up, and renewing from Plan restores everything without any change on the host.
Can a client log in and see only their own workspace? +
Not yet. A workspace opens from your provider portal, and that portal's Access list is for your own staff, because everyone on it can see every client. Keep clients informed with scheduled reports from each workspace.
What do I need to run this? +
One Docker host you control and network paths to your clients. To keep it, a domain with a wildcard DNS record, plus an API token for your DNS provider if you want one wildcard certificate. To try it, setup can use a trial address built from the host's IP. The bundle brings its own Traefik ingress and TLS, and an install-proof script provisions two test workspaces on a fresh deployment and checks them before your first client.
Is this the same Pulse the homelab crowd runs? +
The same, with a provider layer above it. Every client workspace is ordinary Pulse monitoring Proxmox, Docker, Kubernetes, TrueNAS, and vSphere, which means the thing watching your clients is the thing several thousand people already run against their own infrastructure every day.
Why a 30-day guarantee rather than 14? +
Standing up a provider deployment and onboarding a couple of clients takes longer than installing Pulse once. If you walk away, client workspaces drop back to Community rather than going dark, so nobody's monitoring stops while you decide. Full detail in the terms.