Cloud security for agencies and MSPs
If you manage cloud accounts that belong to other people, you need to keep each client apart, give each one a view of their own results, and report on a schedule. This page says what Secorvia documents for that, and what it leaves for you to ask.
Who this fits
The reader here runs cloud for clients: a web agency that hosts its customers' sites, a managed service provider with a handful of accounts per client, or a consultancy that audits accounts it does not own. The work is the same across clients, and the risk is that the work leaks between them: one client's findings in another's report, or a contractor who can see more than they should.
Secorvia was not written for that case alone, and some of what an MSP wants is not described in its documentation. What follows separates what is documented from what is not, so you can test the fit before you connect anything.
Separation between clients
The boundary the product documents is the organization. Every organization is isolated from the others, and members join one by invitation, each with a role: Owner, Admin, Analyst or Read-Only. The guides repeatedly tell you to confirm which organization you are working in before you invite someone or connect an account, because an invitation to the wrong one grants access to the wrong environment.
Inside an organization, each connection is its own cloud account with a name you choose, such as the client's name and the environment. Inventory, findings and scan history can all be viewed scoped to one account, and scans and scan schedules are set per account. That gives you separation of views inside one organization. What the documentation does not describe is restricting a member to some of an organization's accounts, so do not assume it. If a client will log in themselves, ask sales how to set that up, because the boundary the documentation describes is the organization.
How many accounts you can connect depends on the plan, counted per provider: three on Starter, 25 on Growth and no fixed limit on Enterprise.
Access you can hand out and take back
The connection to each client's cloud is a read-only credential that the client, or you on their behalf, creates in their own account. It never asks for write access, so it cannot change their environment, and they can narrow, rotate or delete it whenever they like. For a client's security team that is a short conversation. The security page says what is stored and what is not.
Your own team's access follows roles. Invitations let people set their own password through a link, a member whose access should end can be removed, and a Read-Only member can look without changing anything. Tooling that you build against the product uses an API key, one per integration, with only the scopes it needs and its own expiry. Changes made through a key are attributed to the service identity it belongs to, so the activity trail shows which integration acted. Full API access is part of the Growth plan.
Reporting to a client
Reports are the part an MSP usually sells. You can generate executive, compliance or findings reports, choose the format and set the reporting period, and a scheduled report repeats that daily, weekly or monthly. Generation runs in the background and each job shows as pending, generating, completed or failed, so you can check it finished before it goes to anyone. Report generation starts on the Starter plan.
For a monthly leadership summary, the executive dashboard shows the risk score, critical exposure, open findings, remediation velocity and compliance score for a chosen period. It is part of the Growth plan, and the guide is careful to say that attack-path metrics count only resources with a current path, so say so when you share one. Notifications can go to email, Slack, Microsoft Teams or Discord, covering new critical or high findings, failed scans and failed account connections.
Within an organization, each finding carries an assignee, comments and a timeline, and the audit log keeps history for 30 days on Free, 90 days on Starter and a year on Growth.
What the documentation does not describe
Be clear about the gaps before you plan around the product. The documentation does not describe a single console that spans several organizations, white-label or co-branded reports, per-client billing, or reseller or partner pricing. It does not say that a client can be given a view of only their own accounts inside a shared organization.
If any of those decide whether this works for you, ask before you commit. Enterprise plans have no usage limits, dedicated support and contract terms sized to your estate, and you can reach sales at [email protected]. Oracle Cloud and Alibaba Cloud accounts cannot be connected, so a client on either needs another tool for those accounts.
Frequently asked questions
How do I keep one client's data separate from another's?
The documented boundary is the organization, and organizations are isolated from each other. Inside one organization you can scope inventory, findings and scans to a single cloud account, but the docs do not describe restricting a member to some accounts.
Can I connect many client accounts?
Yes, within the per-provider limit: three accounts on Starter, 25 on Growth and no fixed limit on Enterprise. Each account is connected on its own with a read-only credential.
Can I schedule reports for a client?
Yes, from the Starter plan. You pick the report type, the format and a daily, weekly or monthly cadence, and then check the report list to confirm each one completed.
Does Secorvia offer white-label reports or reseller pricing?
The documentation does not describe either. Ask sales before you plan around them.
Does the connection let me change a client's environment?
No. Secorvia never asks for write access. The credential is read-only, the client creates it in their own account, and they can rotate or delete it at any time.