Per-machine billing, RMM, PSA and delegated access
TechWatchAlert does not want to be one more console: it plugs into your tools (RMM to deploy the agent, PSA for tickets) and only bills what you monitor.
- For whom: owners and administrators of a partner organization; the annual commitment is reserved for the owner. On the client side, its owner decides your team’s access.
- Where: Partner space › Billing, Partner space › Integrations, a client’s page (Delegated access, Deployment through your RMM); at the client: Organization settings › Members.
Per-machine billing, in arrears, no minimum
Section titled “Per-machine billing, in arrears, no minimum”You pay every month, afterwards, for the machines actually monitored across all your clients, at the wholesale price per machine. No minimum, neither machines nor clients.
| Machines (total of your clients) | Price per machine per month, excl. VAT |
|---|---|
| 1 to 500 | €1.50 |
| 501 to 2,000 | €1.20 |
| beyond 2,000 | €0.90 |
Tiers are graduated: the first 500 machines at the first price, the next ones at the second, and so on. The page always shows the prices in force.
What counts for a month:
- a machine seen during the month, once per client, even if the agent, Intune and a cloud connector all see it;
- a machine absent for more than 30 days is not billed;
- 14-day grace period: a machine installed less than 14 days before the end of the month (test deployment) is only billed the following month, if it is still there;
- your internal tenant is free (NFR): your own partner organization’s machines are shown, never billed.
The Billing page shows the current month estimate (billable machines, in grace period, internal tenant, amount excl. VAT), the tier table, the breakdown by client (each one’s share pro rata to its machines, to rebill) and the monthly statements: each statement closes on the 1st of the following month, is charged to your saved payment method, and its breakdown downloads as CSV. One invoice per month, whatever the number of clients.
For a client of a partner billed per machine, there is no machine cap: each one is paid on the statement.
Annual commitment (optional)
Section titled “Annual commitment (optional)”Below the statements, Commit for one year offers a discount on the price per machine (−10% by default) for twelve months, starting the following month. Billing stays monthly, in arrears and with no minimum; the commitment is never renewed automatically. Nothing is saved before Confirm the commitment.
Deploy the agent through your RMM
Section titled “Deploy the agent through your RMM”On a client’s page, Deployment through your RMM guides you in two steps:
- Choose your tool (NinjaOne, Datto RMM, N-able, ConnectWise Automate, Atera, or PowerShell / shell), then Create the client’s token. Copy it right away: it is only shown once. Put it in the client’s variable in your RMM (for example the
TWA_JETONsite variable in Datto RMM, or thetwaJetonorganization field in NinjaOne). - Import your tool’s script once into its library: it is the same for all your clients and contains no token. Run it on the client’s machines.
A client’s token can only enroll a machine in that client. The script runs as SYSTEM (Windows) or root (Linux, macOS), without interaction; it checks the binary’s and the server’s fingerprints, and does nothing if the agent is already running. Exit codes: 0 installed or already present, 10 token missing, 20 download refused, 30 installation failed. The full script library is also in Partner space › Integrations.
Inventory through your RMM’s API
Section titled “Inventory through your RMM’s API”Without deploying the agent, TechWatchAlert can read the inventory your RMM already keeps: devices, software and missing patches. In Partner space › Integrations, section RMM: inventory by API:
- Choose NinjaOne, Datto RMM, N-able N-central or Atera, then enter the settings and secret of your account (minimum permissions are detailed in RMM connectors). Test and save shows the step-by-step test (tool reachable, account accepted, organizations read) and only saves a successful test. The secret is encrypted and never shown again.
- Under Linked organizations, choose for each organization of the tool (NinjaOne organization, Datto site, N-central or Atera customer) the customer project it feeds. A customer is suggested when your PSA links it to the Autotask company of the Datto site, or when it has the same name; nothing is linked without your choice.
- Each link syncs every night; the row button starts a sync right away, and the icon next to it opens the connector page at the customer’s (results, history).
Customer isolation. An organization is linked to a single project, and each read is limited to it: each device returned by the tool is checked again, and a device from another organization never enters that customer. At the customer’s, the connector is managed by you: they see and sync it, but cannot change it, test it with other settings or remove it. If the customer leaves you (detachment) or its organization is deleted, its linked connectors are removed at once, together with your account secret they carried; what they had added to its stack stays there, frozen.
Risk write-back. Turned on for the account (off by default), it writes to a single field of each linked device, and only when it changes: TechWatchAlert: score 72/100 · 3 critical vulnerabilities · <link>, in the customer’s language. The field to create and the write permission for each tool are in RMM connectors.
Plan. Connectors linked from the partner space work as long as your partner program is active, whatever the customer’s plan; their machines enter your monthly statement like those of the agent (a machine seen by both the agent and the RMM is counted once). Removing a tool account removes all its links.
Tickets in your PSA
Section titled “Tickets in your PSA”In Partner space › Integrations, PSA section:
- Choose ConnectWise Manage, Autotask or HaloPSA, enter the API address and the tool’s credentials, then Save and Test the connection. Credentials are encrypted and never shown again.
- In Clients and companies, link each TechWatchAlert client to its company in the PSA.
- Choose automatic tickets: never, exploited flaws, or critical and exploited flaws.
In the Partner space Alerts queue, a column named after your PSA offers Ticket on each alert, then shows the key of the ticket created. One ticket per alert, never two, whether created manually or automatically. The ticket contains the severity, exploitation, component, fixed version and the link to the alert.
Delegated access: role and duration chosen by the client
Section titled “Delegated access: role and duration chosen by the client”Your team’s access at each client follows the model MSPs know (GDAP):
- a role, chosen by the client: Read (see alerts, CVEs, fleet and reports), Manage (handle cases, manage the stack, fleet and agent) or Administer (everything, members and settings included);
- a limited duration, two years at most (3, 6, 12 or 24 months); no automatic renewal: at expiry, your team loses access (nothing is deleted). The client and you are notified 30 and 7 days before;
- revocation at any time by the client, reversible by them;
- a log: the client sees each grant, renewal, revocation and each action of your team in their organization.
The owner who hands over their organization through an attachment link chooses the role and duration on the acceptance page. They always keep their own access (break-glass access): it never depends on yours. As long as a client you created has no owner of its own, your team administers it; as soon as it has one, they decide.
At the client: Organization settings › Members, Your provider’s access box: role, expiry, members of your team, Save and renew, Revoke access (confirmed in the page), and the log. On your client page, the Delegated access section shows these choices; the client list flags access cut off by the client.
Mandatory two-factor authentication
Section titled “Mandatory two-factor authentication”A member of your team only enters your clients with two-factor authentication (app or passkey). The Team page lists those who have none; they turn it on in their profile, Security, and regain access to your clients.
Emails under your brand
Section titled “Emails under your brand”Alert emails received by your clients’ members carry your logo in the header (your name as text if the logo is an SVG or WebP, which email clients display poorly; provide a version readable on a white background) and your name as the sender, with “via TechWatchAlert” until full white label is reached (same threshold as PDF reports). The sending address remains the platform’s. The Alert emails under my brand switch on the Branding page lets you return to the platform’s brand.