Key concepts

Revo is a multi-tenant platform for managed service providers (MSPs). Customers, contacts, devices, the team and integrations belong to RevoCore, the shared layer, so every module uses the same ones. On top of it come the modules your workspace has: RevoRMM for device management and patching, RevoPSA for tickets, contracts and billing, RevoDocs for IT documentation, RevoCloud for Microsoft 365 management and RevoSecure for security posture. Each works on its own or with the others (see Modules). You manage many customers from one workspace, and every number you see is about either all of them or exactly one of them.

Workspace

Your workspace is your MSP's account. It holds your team, your customers, your integrations, your branding and your plan. Nothing in a workspace is visible to another workspace: data is separated in the application and again by the database itself (see How your data is protected).

Workspace-wide settings live in Settings: team and roles, branding, endpoint policy, agent updates, integrations, notifications, API keys, webhooks and the audit log.

Customers

A customer is an organisation you look after or are selling to. Each customer has:

• one or more domains (the primary domain is entered when you add it);
• contacts, optionally imported from your PSA or synced from Microsoft 365;
• devices: computers running RevoAgent;
• connections such as a Microsoft 365 tenant, GitHub repositories or a ThreatLocker organization;
• whatever its modules add: tickets and contracts (RevoPSA), monitoring and patching (RevoRMM), documentation (RevoDocs), Microsoft 365 users and licences (RevoCloud), findings and an ideal state (RevoSecure).

Every customer has a relationship:

See Add and manage customers.

Portfolio and customer mode

Revo has two modes in one interface.

• All customers (the portfolio) is where you start. Pages such as Home, Findings, Devices, Patching, Identity, Compliance and Reports cover every customer, with a customer column where it helps.
• A customer's workspace lives at /c/<customer>/…. Every page, list, chart and action in it is about that customer only. A coloured band under the top bar shows which customer you're in.

Most areas exist in both modes at the same relative path: /devices lists every device, /c/<customer>/devices lists one customer's. Switching customer keeps you in the same area, and leaving a customer returns you to the portfolio version of that area. Some areas only exist inside a customer: the Overview, Action plan, Attack surface, Code & apps, Assessments and Customer settings.

Findings, alerts and vulnerabilities

Three kinds of "something to look at" come from different sources:

• Findings are lasting problems with a severity and a fix, such as DMARC not enforced or BitLocker off. They come from assessments, agent reports, Microsoft 365, code scanning and vulnerability matching, and resolve themselves when a later check passes. See Triage workflow.
• Alerts (security events) are things that just happened: malware detected, someone added to Administrators, a risky sign-in. See Alerts.
• Vulnerabilities are known CVEs in software your customers run, grouped by vulnerability. Serious ones also become findings. See Vulnerability management.

Scores and the ideal state

Each customer gets a security score (0–100) and an A–F grade from its open findings, measured against its ideal state: the controls that count for that customer, with thresholds. Leaving a control out of the ideal state (for example disk encryption for office-only desktops) stops its findings counting towards the score, compliance and reports. See Severity, risk and the security score and Ideal state.

Who can see what

Your team members have a role (owner, admin, technician or analyst) that decides what they can change. Customers can optionally get read-only portal access to their own organisation only. See Roles and permissions and Customer portal.