One HQ console, hard tenant walls: running every client from one place without flattening the boundaries between them

An MSP running twenty client organizations has two needs that sound like they pull in opposite directions: a single operational view across every client so a dispatcher isn't logging into twenty different consoles, and a hard guarantee that client A's techs, tickets, and data never leak into client B's. A lot of platforms pick one and compromise on the other.

Nexus's HQ console rolls up tickets, projects, alerts, and devices from every tenant into one set of boards for the MSP's own operations team — the same kind of cross-client visibility a dispatcher actually needs to triage a busy morning. Underneath that view, isolation is unchanged: it is enforced at the database with row-level security, not loosened at the application layer to make the rollup easier to build.

How the pieces fit together

• HQ boards aggregate across tenants for the MSP's own internal team — a read-and-triage view, not a bypass of tenant boundaries.
• Each tenant keeps its own encrypted secrets, its own backup destination, its own job cadence — nothing shared implicitly because it happens to be aggregated in one dashboard.
• One-step tenant provisioning creates a new client's isolated space and first-admin account together, instead of a multi-step manual setup that's easy to get half-right.
• Support access into a specific tenant goes through a secure, audited, mirrored "switch into tenant" session — not a shared login or a support engineer with standing access to every client's data.
• Nexus resolves which tenant you're in by header, cookie, path, subdomain, or custom domain — one platform serving many front doors without the tenant boundary ever becoming ambiguous.

A unified console is a view. Tenant isolation is a guarantee. Nexus was built so building the first never requires weakening the second.

This is the same design principle behind the rest of the platform: convenience for the MSP's own team should never come at the cost of the isolation guarantee a client is trusting you with. See the platform page for how unified tenant management fits alongside every other module.