Can we run QubeAuditor across multiple client tenants?

Yes. One administrative operator manages many customer records, and each customer keeps independent API keys, users, findings, reports, policies, webhooks and notifications. The operating process is identical per client, while the data stays separated per tenant.

Can reports carry our branding?

Yes. The technical assessment and executive presentation are generated from the same scan state and can be branded for your practice, which is what makes them usable as your own client deliverable rather than a third-party tool export.

How many operator hours does a client tenant take?

The target after onboarding is under two routine operator hours per tenant per month, and the platform is instrumented so that assumption can be measured rather than assumed. Onboarding itself is heavier, which is why the first engagement is a bounded baseline.

What if we already operate the client's infrastructure?

Then be explicit about it. Position the engagement as an agreed acceptance baseline against a standard, not as independent assurance — an auditor will make that distinction whether or not you do. Where independence matters to the client, Shandoola can operate the assessment while you keep the infrastructure relationship.

Built for

MSPs & MSSPs
Cloud consultancies
NIS2 & ISO advisers
Vendor governance

Turn free scanner output into a service a client renews.

The engines are free. The reason clients pay is the operating layer on top: one process across every tenant, findings that carry an owner and a deadline, fixes that get re-tested, and deliverables with your name on them.

Book a baseline assessment

MSPs & MSSPs
Cloud consultancies
NIS2 & ISO advisers
Vendor governance

The problem

The bottleneck is analyst hours, not detection.

Most providers already run Trivy, Kubescape or Prowler for their clients. What does not scale is what happens afterwards: reconciling formats by hand, rebuilding the same report per client, chasing remediation over email, and having no way to show that last quarter's fixes held.

One process, every tenant

One administrative operator manages many customer records. Each customer keeps independent API keys, users, findings, reports, policies and webhooks — so the process is identical per client while the data never mixes.

Reports with your name on them

The technical assessment and the executive deck are generated from the same scan state and can be branded for your practice, so client-facing output does not require a designer or a copy-paste ritual.

The fleet tells you when it breaks

Agent heartbeat, version and target inventory per client, with stale-target alerts. A scan that silently stopped running two months ago is the fastest way to lose an assurance client.

A reason to renew

Drift and regression detection, SLA tracking, verified-fix rates and refreshed evidence give the client something that only exists if the engagement continues. A one-off audit does not.

Independence

You can be the assessor, the operator, or both — but say which.

If you also operate the client's infrastructure, your security report is not independent evidence, and a serious auditor will say so. QubeAuditor supports either posture honestly.

Partner-operatedYou run it

operator: your team, from one administrative tenancy across your client base
fit: a mature MSP with its own security or cloud practice
note: for clients whose infrastructure you also operate, position it as an agreed acceptance baseline rather than independent assurance

Co-deliveryShared

operator: shared between your team and Shandoola
fit: a consultancy building a security practice without an operations team yet
note: the delivery split is agreed per engagement

ReferralWe run it

operator: Shandoola
fit: a compliance or NIS2 adviser who prescribes the technical evidence workstream but does not want to operate it
note: independence is intact where you do not operate the assessed estate

Commercials

Priced so both sides make money on the same client.

The partner model is a platform base plus a price per active client tenant, with bands for unusually large estates and an annual minimum. The margin is set so that selling, operating and supporting the client relationship is worth your time — because if it is not, the programme fails regardless of the product.

A platform base plus a per-active-tenant price, rather than a flat unlimited licence
Target and scan-cadence bands for large tenants
Managed-agent and analyst add-ons where you would rather not run the fleet
White-label reporting, onboarding checklists and read-only permission templates
A joint evidence workshop for your first client, so the delivery motion is learned rather than described

Exact numbers depend on tenant count, estate size and how much delivery you take on. Tell us what your client base looks like and we will model it with you.

How to start

Start with one client, not a rollout.

The fastest way to know whether this becomes a service line is to run the whole loop once, on a real estate, with a client who has an actual deadline.

01Pick one client with an audit, a vendor handover or a NIS2 request in the next quarter
02We onboard the deployment and design read-only access with your team
03Baseline scan, control review, and the first evidence pack
04Assign findings to whoever operates the estate, with due dates
05Verification rescan within 30–45 days, and a delivery review with your team
06Decide on the partner model with real numbers rather than projections

Questions

Partner questions

Or start with something you already have

Bring one recent security report from the vendor operating your estate. We will map how many of its findings have an accountable owner, a verification state, and evidence you could hand to an auditor.

Book a baseline assessment

Contact

Book a baseline assessment

Tell us what you run and who operates it. We will come back with a scope, a timeline and a fixed price for one estate.